Skip to main content

​
After this article

You will be able to connect Jamf Pro to Lumos to sync Jamf Pro user accounts and their entitlements (groups, sites, access levels, privilege sets), and to create, enable, disable, and delete Jamf Pro user accounts from Lumos. With the optional Include Devices setting, Lumos also syncs the computers Jamf manages and who holds each one.

​
Capabilities

Notes:
  • Lumos pulls Jamf Pro User Accounts (console users) and their groups. It does not pull Jamf End Users (device users), except that turning on Include Devices adds an account for each person a computer is assigned to. See Include Devices.
  • Group data is read-only: Lumos syncs group memberships for visibility but cannot add or remove users from Jamf groups. Make membership changes in Jamf (or the upstream identity source), and Lumos picks them up on the next sync.
  • Access levels and privilege sets sync as entitlements and can be applied when Lumos creates an account. They cannot be assigned or unassigned on an existing account from Lumos.

​
Required plan and roles

  • Authentication: a Jamf Pro API Client (Client ID + Client Secret, OAuth client credentials).
  • API role privileges, assigned to the API role backing the client. The setup notes on the connection fields in Lumos ask for the full set below, so granting all of them is the simplest path:
    • Read Accounts, Read Sites, Create Accounts, Update Accounts, Delete Accounts, Create Sites, Update Sites, Delete Sites
    • Read Computers, only if you turn on Include Devices
  • What each privilege is actually used for:
    • Syncing accounts, groups, sites, access levels, and privilege sets uses Read Accounts and Read Sites only.
    • Syncing devices with Include Devices on uses Read Computers.
    • Creating an account uses Create Accounts. Activating or deactivating an account uses Update Accounts. Deleting an account uses Delete Accounts.
    • Create Sites, Update Sites, and Delete Sites are not used by any Lumos action against Jamf. They appear in the setup notes but the integration never writes to sites.

​
Read-only access vs provisioning

Is read-only possible? Yes. Jamf’s API role model separates read privileges from write privileges, and every sync call this integration makes is a read, so an API Client backed by only the read privileges provides full sync without provisioning. What read-only requires. An API Client whose API role grants Read Accounts and Read Sites, then follow the steps below to connect. Nothing in the sync path calls a write endpoint, so leaving the write privileges off will not break account, group, site, access level, or privilege set sync. If you turn on Include Devices, add Read Computers as well. What full provisioning requires. The same API Client, with Create Accounts, Update Accounts, and Delete Accounts added on top of the read privileges. Create Accounts covers account creation, Update Accounts covers activate and deactivate, and Delete Accounts covers deletion. Watch out for. Group membership is read-only in every configuration. Even a fully provisioning-scoped API Client can’t add or remove users from Jamf groups, so make those changes in Jamf or the upstream identity source. If you start with a read-only API role and later need provisioning, you’ll need to update the API role’s privileges (or generate a new API Client) since the role’s privileges are fixed at creation. Access levels and privilege sets can only be set when Lumos creates the account. They cannot be changed on an existing account from Lumos.

​
Instructions

Phase 1: Create an API Client in Jamf Pro
  1. In Jamf Pro, create an API Client backed by an API role with the privileges listed above (see Jamf’s API Roles and Clients documentation).
  2. Copy the Client ID.
  3. Generate and copy the Client Secret. It’s displayed only once, so save it securely before leaving the page.
  4. Note your Server Hostname: the hostname you use to access Jamf, without the protocol. For https://example.jamfcloud.com, the server hostname is example.jamfcloud.com. For self-hosted Jamf Pro, use the hostname or IP address of your server, again without http:// or https://.
Phase 2: Connect in Lumos
  1. Find the Jamf card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter the Client ID, Client Secret, and Server Hostname.
  3. Optionally, turn on Include Devices (off by default) to also sync the computers Jamf manages. See Include Devices.
  4. Click Connect.

​
Include Devices

By default, Lumos syncs only the Jamf Pro administrators and their groups, sites, access levels, and privilege sets. Turn on Include Devices to also sync the Jamf Pro computer inventory. Use this setting when you want Lumos to know which person holds which machine, for example to supply device inventory for MCP Governance. When Include Devices is on, Lumos syncs the following in addition to the administrator data:
  • Accounts: One account for each person a computer is assigned to. A device holder who is also a Jamf Pro administrator keeps their existing administrator account. Everyone else is keyed by their Jamf username.
  • Devices: One Device permission for each assigned computer, labelled {model} S/N: {serial}. For example, MacBook Pro S/N: C02XK1ABCDEF.
  • Associations: Each Device permission is associated with the account of the person who holds that computer.
Keep the following in mind:
  • Device permissions are not requestable or assignable. Jamf controls who holds a computer.
  • Lumos skips computers that are not assigned to a user.
  • Turning the setting on can add many more accounts than the administrators synced by default.
  • The setting requires the Read Computers privilege on the API role. Adding it to an existing API role does not require rotating the client secret.

​
API Endpoints Used

​
Troubleshooting

Lost the Client Secret. Jamf shows the client secret only once, at generation. If it wasn’t saved, generate a new secret for the API client and reconnect in Lumos with the new value. Sync works but account actions fail. Sync only needs Read Accounts and Read Sites, so a read-scoped API role syncs cleanly while every write fails. Add Create Accounts, Update Accounts, and Delete Accounts to the API role, then reconnect. The connection fails immediately. Check the Server Hostname field. It is the full hostname such as example.jamfcloud.com, not just the subdomain, and it must not include http:// or https://. Device end users are missing. Expected by default: Lumos syncs Jamf Pro user (console) accounts only. Turn on Include Devices to add an account for each person a computer is assigned to. People with no assigned computer still won’t appear. Can’t add users to a Jamf group from Lumos. Expected: group data is read-only in this connector. Change membership in Jamf or the upstream source managing those users, and Lumos reflects the change after the next sync. Provisioning options missing after reconnecting/migrating the integration. If entitlements sync correctly but AppStore provisioning permissions don’t appear after a reconnect to a new integration card, contact Lumos support. Permissions may need to be regenerated against the new connection.