Jamf Pro End-users Integration

Jamf Pro End-users Integration

Partner overview: Veraproof + Jamf

Scimify enables SCIM provisioning for Jamf Pro end-user accounts and user groups, allowing you to manage end-user access through your identity provider.

Overview

This integration pushes users and user groups to Jamf Pro via SCIM. End-user accounts and groups created in Jamf Pro will correspond to those from your identity provider.

Prerequisites

• A Jamf Pro instance
• Administrator access to Jamf Pro
• Ability to create API roles and clients

Configuration Steps

1. Create an API Role in Jamf Pro

1. Log into your Jamf Pro instance as an administrator
2. Navigate to Settings > System > API roles and clients
3. Click “New” in the API Roles section
4. Give the API role a name (e.g., “Scimify End-users Integration Role”)
5. Grant the API role the privileges below for your intended offboarding settings
6. Save the API role

Base privileges (always required)

• Create User
• Read User
• Update User
• Delete User
• Create Static User Groups
• Read Static User Groups
• Update Static User Groups
• Delete Static User Groups

Device offboarding — Unassign devices (default)

Jamf Pro will not delete an end user while computers or mobile devices are still assigned. Scimify clears those assignments before deleting the user. Add:

• Read Computers
• Update Computers
• Read Mobile Devices
• Update Mobile Devices

Device offboarding — Delete devices then user (optional)

If you configure Scimify to delete linked inventory records before deleting the user, also add:

• Delete Computers
• Delete Mobile Devices

Lock linked computers on deactivation (optional)

For immediate termination, Scimify can send a Jamf DeviceLock to each linked computer before offboarding. Add to the Scimify API role:

• Send Computer Remote Lock Command

(Read Computers is already listed under Unassign.)

Jamf administrators who retrieve the unlock PIN in the console need View Computer Device Lock Pin on their Jamf admin account (not on the Scimify API role). See Lock linked computers on deactivation below.

Note: Scimify uses a dedicated API client with this API role, which grants only the privileges above. That least-privilege approach means the integration does not require full Jamf Pro administrator rights on the automation principal; you scope the role to end-user and static user group management (plus the device privileges needed for your offboarding choices) rather than broad admin access.

2. Create an API Client

1. In the same API roles and clients page, click “New” in the API Clients section
2. Give the API client a name (e.g., “Scimify End-users Integration”)
3. Select the API role created in Step 1
4. Click “Save” and copy the Client ID and Client Secret

3. Configure the Integration in Scimify

1. Navigate to the Integrations page in your Scimify admin console
2. Create a new Jamf Pro End-users integration instance
3. Enter the following configuration:
   • Instance URL: Enter your Jamf Pro instance URL (e.g., https://yourinstance.jamfcloud.com or https://jamf.company.com)
   • Client ID: Paste the Client ID from Step 2
   • Client Secret (API Key): Paste the Client Secret from Step 2
   • Device offboarding on user deactivation: How to handle computers and mobile devices linked to the user before Jamf will allow user deletion (see below)
   • Lock linked computers on deactivation (Optional): Send DeviceLock to linked Macs on deactivation (termination use case)
   • Instance Name (Optional): A friendly name to identify this integration instance
   • Group Description (Optional): Custom description for created groups (default: “Created via Scimify for tenant {tenant_id}“)

4. Configure SCIM in your IdP or IGA

Follow the SCIM Configuration guide to connect Okta or Lumos to your Scimify Jamf Pro End-users instance, then assign users and groups as needed.

How It Works

• When users and user groups are pushed from your IdP, Scimify will create corresponding end-user accounts and static user groups in Jamf Pro
• User and group names will match those from your IdP
• Users assigned to groups in your IdP will be added to the corresponding Jamf Pro static user groups
• Group renames and user profile updates: Renaming a group in your IdP updates the corresponding static user group in Jamf Pro. User profile changes are supported for first name, last name, and email.
• User deactivation: Jamf Pro does not offer a disabled or inactive status for end users. When a user is deactivated in your IdP, Scimify reflects that change by deleting the user in Jamf Pro—there is no separate “disabled” state to map to.
• Import from Jamf Pro: You can import users from Jamf Pro into your IdP as well—for example, with Okta’s Import flow for the SCIM app (application user import). That path brings existing Jamf users into the IdP alongside outbound provisioning from the IdP to Jamf.

Device offboarding on deactivation

Jamf returns an error if you try to delete a user who still has computers or mobile devices assigned (for example: “The following items are dependent on this User and need to be updated: Mobile Device:…”). Scimify prepares linked devices first, then deletes the user.

Setting	Behavior
Unassign devices (default)	Clears the user from each linked computer and mobile device, leaves devices in Jamf, then deletes the user. Safest for ongoing MDM.
Delete devices then user	Deletes linked computer and mobile device inventory records, then deletes the user. Higher risk.

Delete devices — recovery: Removing a device from Jamf inventory does not remove the MDM profile from the hardware. The device does not reliably “reappear” as the same managed record. Computers often need IT remediation and re-enrollment (ADE / user-initiated enrollment / QuickAdd). Prefer Unassign unless you intentionally want inventory removed.

Lock linked computers on deactivation

When enabled, Scimify sends a Jamf Classic DeviceLock to each computer linked to the user before unassign/delete and user deletion.

• Applies to computers only (not mobile devices) in this release
• Uses a random 6-digit PIN per computer
• Retrieve the unlock PIN in the Jamf Pro admin console on the computer inventory record (requires the View Computer Device Lock Pin privilege for the Jamf admin viewing it)
• Failures to lock stop the deactivation (fail closed)

Recommended combination for termination: Unassign devices + Lock linked computers. Avoid Lock together with Delete devices—deleting the inventory record after lock removes Jamf’s normal unlock path for that device.

Custom SCIM Attributes

You can sync additional Jamf Pro end-user fields by configuring custom SCIM attributes in your IdP profile mappings.

Attribute 1: phoneNumbers

• Type: String
• External Name: phoneNumbers.^[primary==true].value
• External Namespace: urn:ietf:params:scim:schemas:core:2.0:User
• Attribute Length: Less than 100 characters
• Example Mapping (Okta profile attribute): user.primaryPhone

Attribute 2: customUsername

• Type: String
• External Name: customUsername
• External Namespace: urn:ietf:params:scim:schemas:extension:custom:2.0:User
• Example Mapping (Okta expression language): String.substringBefore(user.login, "@") — sets the attribute to the local part of the user’s email or Okta username (the segment before @).

Note: If you want the username in Jamf Pro to follow a different naming scheme than Okta usernames (for example, when Okta uses an email address), customUsername lets you supply that value. Use Okta Expression Language in profile mappings to derive it for all users, or set it individually on app user profiles (that page includes popular expressions and related syntax).

Static User Groups

This integration creates and manages Static User Groups in Jamf Pro. These groups can be used for:

• Device management policies
• Application deployment
• Access control
• Compliance policies

Additional Resources

• Jamf Pro API Documentation
• Jamf Classic API
• Jamf Marketplace listing

Need Help?

If you encounter any issues during configuration, please contact [email protected] for assistance.