Connect & Integrate Jamf

Last updated: August 14, 2026

Introduction

This guide explains how to connect YeshID with Jamf Pro.

Jamf has two separate kinds of “users,” and YeshID handles both:

  • Jamf Pro admin accounts — the people who can log into the Jamf Pro console. YeshID imports these as the application’s users and can create, update, and delete them, so console access is governed like any other app.

  • Device holders — the people assigned to computers in Jamf inventory. YeshID imports these into Resources, together with the computers themselves, giving you a live view of who has which Mac.

YeshID can also remotely lock or wipe a user’s computers during offboarding.

You will need a Jamf Pro API Client (recommended) or a Jamf Pro username and password, plus your Jamf Pro instance URL (for example, https://yourorg.jamfcloud.com).

Steps

  1. Log in to Jamf Pro as an administrator.

  2. Navigate to Settings > System > API roles and clients.

  3. On the API Roles tab, click New and create a role named YeshID.

  4. Assign the role the following privileges:

    • Create Jamf Pro User Accounts

    • Read Jamf Pro User Accounts

    • Update Jamf Pro User Accounts

    • Delete Jamf Pro User Accounts

    • Read Computers

    • Send Computer Remote Lock Command

    • Send Computer Remote Wipe Command

    • Read User (only needed if you also want device-inventory users imported into Resources)

  5. On the API Clients tab, click New and create a client named YeshID.

  6. Assign the YeshID API role to the client, click Enable API client, and save.

  7. Click Generate client secret and copy both the Client ID and Client Secret. (The secret is only shown once — if you lose it, generate a new one and update it in YeshID.)

  8. In YeshID, navigate to Applications, select Jamf, and open the provisioning setup.

  9. Enter your credentials:

    • Instance URL (for example, https://yourorg.jamfcloud.com)

    • Client ID

    • Client Secret

  10. Enable the actions you want YeshID to run (Import Users, Create User, Update User, Delete User, Import Resources, Lock Computer, Wipe Computer).

  11. If you enable Create User, choose what new accounts should get:

    • Privilege Level: Administrator, Auditor, or Enrollment Only.

    • Access Level: Full Access, Site Access, or Group-Based Access.

    • YeshID sets a strong random password on the new account and requires a password change on first login.

  12. If you enable Lock Computer, configure the action:

    • Lock PIN: A six-digit PIN sent with the lock command. This PIN is required to unlock the computer afterward, so store it somewhere safe.

    • Lock Message (optional): Shown on the lock screen.

    • Phone Number (optional): Shown on the lock screen.

  13. If you enable Wipe Computer, configure the action:

    • Confirm Wipe: Type ERASE here to arm the action. Erasing a computer is irreversible, so YeshID will not send the command unless this is set.

    • Lock PIN (optional): A six-digit PIN used to lock older Macs during the erase. Leave blank on Apple Silicon.

  1. Run Import Users to verify the connection. Your Jamf Pro admin accounts will appear in the application’s user list.

  2. Run Import Resources to bring in your computers and their assigned holders.

FAQ

What actions does the YeshID integration support today?

  • Import users (Jamf Pro admin accounts)

  • Create user (admin account, with configurable privilege and access level)

  • Update user (name and email; privileges are never changed)

  • Delete user (revokes console access)

  • Lock computer

  • Wipe computer

  • Import resources (computers and device holders, with assignments)

I enabled Lock Computer but I don't see it in my workflow. Where is it?

Lock Computer and Wipe Computer aren't listed by name in the workflow task menu — searching for "lock" won't find them. Add the task Run provisioner action for user, then select Jamf as the Application and Lock Computer as the Action.

Two things to check if it still isn't available: the action must be enabled on the Jamf integration under Custom Actions (not under Actions, where the user actions live), and Run provisioner action for user is a paid feature — if the task doesn't appear in the menu at all, it isn't included in your plan.

Which Jamf users does YeshID manage?

YeshID manages Jamf Pro admin accounts — the people who can log into the Jamf Pro console. That’s the population that matters for access governance: who can administer your device fleet. The rest of your employees usually don’t have Jamf accounts at all; they appear as device holders in Resources instead.

Import Users only shows my IT team. Where is everyone else?

That’s expected. Most employees don’t log into Jamf — they just have a Mac assigned to them. Those people (and their computers) come in through Import Resources, which reads each computer’s assignment. Jamf’s separate “Users” inventory list is often empty, and that’s fine: YeshID builds the who-has-which-computer view from the computers themselves.

I set everything up and immediately got a 401. Why?

Newly created API clients and roles take a few minutes to propagate inside Jamf Cloud. If your credentials fail right after setup, wait five minutes and try again before changing anything. If it still fails: confirm the Enable API client toggle is on (Jamf creates clients disabled), and re-generate and re-paste the client secret (it’s shown only once, and mis-pastes are common).

I get a 403 “INVALID_PRIVILEGE” error. Why?

The API role is missing a privilege for the action you ran — most commonly Read Jamf Pro User Accounts for Import Users. Add the privileges from step 4 to the role. Changes take effect for new tokens right away, so just re-run the action afterward; you do not need to regenerate the client secret.

What happens when YeshID creates an admin account?

YeshID creates the account with the privilege and access level you configured, sets a strong random password, and flags the account to require a password change on first login. YeshID never stores or displays the password. If an account with the same email or username already exists, YeshID links to it instead of creating a duplicate.

Does updating a user change their privileges?

No. Update User only syncs the person’s name and email. Privilege level, access level, account status, and username are always preserved exactly as they are in Jamf.

Why does the Lock Computer action require a six-digit PIN?

macOS requires a six-digit PIN with every remote lock command, and the same PIN is what unlocks the machine afterward. Set a PIN your IT team controls and keep it somewhere safe — without it, a locked Mac needs Apple support to recover.

How does Wipe Computer work, and how is it kept safe?

Wipe Computer sends Jamf’s remote erase command to the user’s computers — typically at offboarding, to clear a device before it’s returned or reassigned. Because an erase is irreversible, the action is disarmed by default: YeshID will not send the command unless the Confirm Wipe parameter is set to ERASE. It resolves the user’s computers the same way Lock Computer does.

Can I use a username and password instead of an API Client?

Yes. Leave Client ID and Client Secret empty and provide a Jamf Pro username and password instead. We recommend an API Client because its access is limited to exactly the privileges in the role you created, and it can be rotated without affecting a person’s login.

What shows up in Resources?

Your Jamf Pro instance, every computer (with serial number, model, and last check-in), and the people they’re assigned to, connected by assignment — a live view of who has which computer. Device holders appear here even if they’ve never had a Jamf login.

Related Articles