Outbound mode requires Jamf Pro 11.13.0 or later and Jamf AD CS Connector 2.0.0 or later. In outbound mode, the connector will periodically connect outbound to Jamf Pro to retrieve any outstanding certificate requests. By default, the connector will retrieve certificate jobs every 10 seconds. You can change the polling interval when installing the connector. No firewall ports or reverse proxy configuration are required.
After a request from Jamf Pro is returned from the API call to Jamf Pro, the connector converts the web request to Microsoft's native DCOM protocol and passes it to your AD CS server. After the certificate is ready and the next publish call is made, it is returned to Jamf Pro to be re-packed for distribution to a managed device. Devices never connect directly to the connector, so firewall rules can be used to restrict access.
If you have an existing AD CS integration and do not need outbound communication mode, Jamf recommends continuing to use Jamf AD CS Connector 1.1.0. You only need Jamf AD CS Connector 2.0.0 if you want to use outbound communication mode.
To move an existing AD CS integration from inbound to outbound communication mode, you must create a new PKI integration and deploy new or updated configuration profiles.
Outbound mode is intended for Jamf Cloud-hosted environments. If your Jamf Pro instance is hosted in Jamf Cloud and you do not want to open firewall ports to your AD CS infrastructure, you should use the connector's outbound mode. If you have an on-premise Jamf Pro environment and you have remote-signed certificates, you can use the connector's outbound mode. Otherwise, you should use inbound mode.
Jamf Pro provides a number of means for connecting to an issuing certificate authority for the purpose of requesting and revoking identity certificates on behalf of managed devices, including the Jamf AD CS Connector.
In outbound mode, the Jamf AD CS Connector runs as a background service that retrieves client certificate requests from Jamf Pro. The outbound connector verifies the identity of the Jamf Pro server via its TLS certificate subject and authenticates to Jamf Pro using OAuth 2.0.
Allows organizations to use an outbound connection to the connector versus the previous inbound-only communication requirement
Simplifies implementation of the certificate integration by removing the need to configure networking between cloud-hosted Jamf Pro and internal networks
Allows organizations in highly regulated industries that are not permitted to open connections to their internal network to transition from on-premise Jamf Pro environments to Jamf Cloud-hosted environments
Eliminates the need to re-install the connector when renewing Jamf Pro's authentication certificate
If you are comfortable configuring inbound access to your network, or if you self-host your Jamf Pro server on your internal networks, you may prefer to use inbound mode. In most scenarios, inbound mode will provide lower-latency certificate processing as it does not incur the overhead of the additional queuing and polling mechanisms employed when running in outbound mode. Additionally, if you self-host Jamf Pro with a TLS certificate obtained from a CA that is not trusted by Windows, you will need to run the connector in inbound mode since the connector will not be able to initiate a trusted connection to Jamf Pro.
The following diagram illustrates a typical implementation of the Jamf AD CS Connector in outbound mode.
Outbound communication mode does not support manual CA certificate request approval.