Enabling Additional JamfAAD Logging

Technical Paper: Device Compliance with Microsoft Entra and Jamf Pro
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
To troubleshoot issues with users logging in to the wrong server or using an incorrect email address, use the logPII preferences key to log additional personally identifiable information from the Azure login process. Personally and organizationally identifiable information is only logged on the computer's local log system— it is not sent to the Jamf Pro server. JamfAAD writes logs to the macOS unified log system. The log will report the following information:

  • userID—Email address used to log in

  • Authority host—Server the user was redirected to for sign in

  • Token number

You can enable JamfAAD logging in the following ways:

  • Deploy a PLIST file using a configuration profile with the Custom Settings payload configured.

  • Run a script using a policy with the execution frequency of "Once per user per computer".
    Note:

    To retrieve JamfAAD logs from a computer, open Terminal and execute the following command: log show --predicate 'subsystem CONTAINS "jamfAAD"'

PLIST Example
To enable JamfAAD logging by deploying a PLIST file, use the following example:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>logPII</key>
<string>true</string>
</dict>
</plist>

When configuring the Custom Settings payload, enter the following in the Preference Domain field:com.jamf.management.jamfAAD

Script Example
To enable JamfAAD logging by running a script using a policy with the execution frequency of "Once per user per computer", use the following example:
#!/bin/sh
defaults write com.jamf.management.jamfAAD logPII -bool true
If you want to disable JamfAAD logging, you can use the following script:
#!/bin/sh
defaults delete com.jamf.management.jamfAAD logPII