Configure a Jamf API Client

Assign Pro uses Jamf OAuth client credentials to read computers, list static computer groups, and update the selected static group during a confirmed assignment run.

For the current Jamf Pro interface, use Jamf's official API Roles and Clients documentation as the source of truth for creating API roles, API clients, client secrets, secret rotation, and disabling clients.

Minimum Role For Assign Pro

Create a dedicated role for Assign Pro with only the privileges needed by the supported workflow:

• Read Computers
• Read Static Computer Groups
• Update Static Computer Groups

These permissions allow Assign Pro to look up computers, list target static groups, and send the final static-group add or remove update after confirmation.

Permissions Not Required By The Current Workflow

Assign Pro does not currently need:

• Read Smart Computer Groups
• Update Policies
• Broad administrator privileges

If those permissions exist in a broader admin role, keep that as an internal operational decision. They are not required by the Assign Pro setup documented here.

Client Setup Checklist

1. Create or reuse an API role with the minimum Assign Pro permissions.
2. Create an API client assigned to that role.
3. Generate a client secret.
4. Store the client ID and secret using your organisation's approved secret-handling process.
5. Open Assign Pro and enter the Jamf URL, client ID, and client secret.
6. Confirm that static groups load after connection.

Security Notes

• Use a dedicated client for Assign Pro instead of sharing a broad automation credential.
• Rotate the client secret using your organisation's normal credential lifecycle.
• Disable the client when it is no longer needed.
• Avoid copying client secrets into tickets, documentation, screenshots, or video recordings.