> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Jamf

## After this article

You will be able to connect Jamf Pro to Lumos to sync Jamf Pro user accounts and their entitlements (groups, sites, access levels, privilege sets), and to create, enable, disable, and delete Jamf Pro user accounts from Lumos. With the optional **Include Devices** setting, Lumos also syncs the computers Jamf manages and who holds each one.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | Jamf Pro user accounts |
| Group | Permission | Yes | No | Groups |
| Sites | Permission | Yes | No | Sites |
| Access Level | Permission | Yes | No | Roles |
| Privilege Sets | Permission | Yes | No | Privilege sets |
| Device | Permission | Yes | No | Computers assigned to a user, labelled `{model} S/N: {serial}`. Synced only when **Include Devices** is on. Not assignable. |

| Provisioning Action | Type | Description |
| - | - | - |
| Create | User | Creates a Jamf Pro user account. An access level and a privilege set can be set at creation. |
| Deactivate | User | Disables the account in Jamf Pro. The account is not removed. |
| Activate | User | Re-enables a disabled account. |
| Delete | User | Removes the Jamf Pro user account. |

Notes:

* Lumos pulls **Jamf Pro User Accounts** (console users) and their groups. It does **not** pull Jamf **End Users** (device users), except that turning on **Include Devices** adds an account for each person a computer is assigned to. See [Include Devices](#include-devices).
* Group data is **read-only**: Lumos syncs group memberships for visibility but cannot add or remove users from Jamf groups. Make membership changes in Jamf (or the upstream identity source), and Lumos picks them up on the next sync.
* Access levels and privilege sets sync as entitlements and can be applied when Lumos creates an account. They cannot be assigned or unassigned on an existing account from Lumos.

## Required plan and roles

* **Authentication:** a Jamf Pro **API Client** (Client ID + Client Secret, OAuth client credentials).
* **API role privileges**, assigned to the API role backing the client. The setup notes on the connection fields in Lumos ask for the full set below, so granting all of them is the simplest path:
  * **Read Accounts**, **Read Sites**, **Create Accounts**, **Update Accounts**, **Delete Accounts**, **Create Sites**, **Update Sites**, **Delete Sites**
  * **Read Computers**, only if you turn on **Include Devices**
* **What each privilege is actually used for:**
  * Syncing accounts, groups, sites, access levels, and privilege sets uses **Read Accounts** and **Read Sites** only.
  * Syncing devices with **Include Devices** on uses **Read Computers**.
  * Creating an account uses **Create Accounts**. Activating or deactivating an account uses **Update Accounts**. Deleting an account uses **Delete Accounts**.
  * **Create Sites**, **Update Sites**, and **Delete Sites** are not used by any Lumos action against Jamf. They appear in the setup notes but the integration never writes to sites.

## Read-only access vs provisioning

**Is read-only possible?** Yes. Jamf's API role model separates read privileges from write privileges, and every sync call this integration makes is a read, so an API Client backed by only the read privileges provides full sync without provisioning.

**What read-only requires.** An API Client whose API role grants **Read Accounts** and **Read Sites**, then follow the steps below to connect. Nothing in the sync path calls a write endpoint, so leaving the write privileges off will not break account, group, site, access level, or privilege set sync. If you turn on **Include Devices**, add **Read Computers** as well.

**What full provisioning requires.** The same API Client, with **Create Accounts**, **Update Accounts**, and **Delete Accounts** added on top of the read privileges. Create Accounts covers account creation, Update Accounts covers activate and deactivate, and Delete Accounts covers deletion.

**Watch out for.** Group membership is read-only in every configuration. Even a fully provisioning-scoped API Client can't add or remove users from Jamf groups, so make those changes in Jamf or the upstream identity source. If you start with a read-only API role and later need provisioning, you'll need to update the API role's privileges (or generate a new API Client) since the role's privileges are fixed at creation. Access levels and privilege sets can only be set when Lumos creates the account. They cannot be changed on an existing account from Lumos.

## Instructions

**Phase 1: Create an API Client in Jamf Pro**

1. In Jamf Pro, create an API Client backed by an API role with the privileges listed above (see Jamf's [API Roles and Clients documentation](https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/API_Roles_and_Clients.html)).
2. Copy the **Client ID**.
3. Generate and copy the **Client Secret**. It's displayed **only once**, so save it securely before leaving the page.
4. Note your **Server Hostname**: the hostname you use to access Jamf, without the protocol. For `https://example.jamfcloud.com`, the server hostname is `example.jamfcloud.com`. For self-hosted Jamf Pro, use the hostname or IP address of your server, again without `http://` or `https://`.

**Phase 2: Connect in Lumos**

1. Find the Jamf card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter the **Client ID**, **Client Secret**, and **Server Hostname**.
3. Optionally, turn on **Include Devices** (off by default) to also sync the computers Jamf manages. See [Include Devices](#include-devices).
4. Click **Connect**.

## Include Devices

By default, Lumos syncs only the Jamf Pro administrators and their groups, sites, access levels, and privilege sets. Turn on **Include Devices** to also sync the Jamf Pro computer inventory. Use this setting when you want Lumos to know which person holds which machine, for example to supply device inventory for [MCP Governance](/docs/mcp-governance-rollout).

When **Include Devices** is on, Lumos syncs the following in addition to the administrator data:

* **Accounts:** One account for each person a computer is assigned to. A device holder who is also a Jamf Pro administrator keeps their existing administrator account. Everyone else is keyed by their Jamf username.
* **Devices:** One **Device** permission for each assigned computer, labelled `{model} S/N: {serial}`. For example, `MacBook Pro S/N: C02XK1ABCDEF`.
* **Associations:** Each Device permission is associated with the account of the person who holds that computer.

Keep the following in mind:

* Device permissions are not requestable or assignable. Jamf controls who holds a computer.
* Lumos skips computers that are not assigned to a user.
* Turning the setting on can add many more accounts than the administrators synced by default.
* The setting requires the **Read Computers** privilege on the API role. Adding it to an existing API role does not require rotating the client secret.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Lost the Client Secret.** Jamf shows the client secret only once, at generation. If it wasn't saved, generate a new secret for the API client and reconnect in Lumos with the new value.

**Sync works but account actions fail.** Sync only needs Read Accounts and Read Sites, so a read-scoped API role syncs cleanly while every write fails. Add Create Accounts, Update Accounts, and Delete Accounts to the API role, then reconnect.

**The connection fails immediately.** Check the Server Hostname field. It is the full hostname such as `example.jamfcloud.com`, not just the subdomain, and it must not include `http://` or `https://`.

**Device end users are missing.** Expected by default: Lumos syncs Jamf Pro user (console) accounts only. Turn on **Include Devices** to add an account for each person a computer is assigned to. People with no assigned computer still won't appear.

**Can't add users to a Jamf group from Lumos.** Expected: group data is read-only in this connector. Change membership in Jamf or the upstream source managing those users, and Lumos reflects the change after the next sync.

**Provisioning options missing after reconnecting/migrating the integration.** If entitlements sync correctly but AppStore provisioning permissions don't appear after a reconnect to a new integration card, contact Lumos support. Permissions may need to be regenerated against the new connection.