Jamf API permissions

Assign Pro should have enough Jamf access to do its job, with only the permissions Assign Pro needs.

What this helps with

A focused Jamf API client for looking up computers and updating static group membership with less risk.

Follow these steps.

1. Create a dedicated Jamf API client for Assign Pro.
2. Grant only the read permissions needed to match computers.
3. Grant only the static group permissions needed for add or remove actions.
4. Store the credentials through the app so macOS Keychain handles them.
5. Run a preview before the first real assignment.

Checks before you move on

• Dedicated API client used
• Least privilege reviewed
• Credentials stored in Keychain
• Preview succeeds before write

Related guides

• Import file formats
• Reviewing unmatched Macs
• Static group change logs

Set up the required permissions

Follow Configure a Jamf API client for the permissions and client setup, then connect Assign Pro to Jamf.