Skip to main content
The Jamf Pro integration enriches Forge device inventory with computer-owner information. It does not create people, sync a directory, manage devices, or change Jamf configuration. This connection is read-only and separate from deploying Forge for devices through Jamf. To install and manage Forge on macOS with Jamf, follow the macOS deployment guide instead.

​
Before you connect

People must already exist in Forge through a directory integration or manual directory management. Forge can then attach Jamf computers to those existing people. In Jamf Pro:
  1. Open Settings → System → API roles and clients.
  2. Create an API Role with only the Read Computers privilege.
  3. Create an API Client and assign the role.
  4. Generate a client secret and copy the client ID and secret. Jamf shows the secret only once.
No write privileges are required.

​
Connect

  1. In Forge, open Settings → Integrations → Jamf Pro.
  2. Enter the Jamf Cloud tenant URL, such as https://company.jamfcloud.com.
  3. Enter the API client ID and client secret, then select Save connection.
  4. Select Test connection. Forge verifies OAuth and computer inventory access.
Forge stores the client credential as a managed secret. Enter both fields again only when rotating the credential.

​
Import devices

Open Device import, select the computers to import, and confirm their owners. Forge resolves each computer as follows:
  • A unique, exact email match links automatically to an existing Person.
  • An email-shaped Jamf username is used when the Jamf email field is empty.
  • Any unresolved computer must be assigned to an existing Person before it is imported. One Person can be applied to all unresolved computers at once.
  • Jamf never creates a Person.
Forge first reuses the stable Jamf computer ID. Otherwise, a unique normalized serial number reconciles the computer with an existing device, including one previously imported from CrowdStrike. Hostnames are not used for identity matching because they can change or collide. If no device matches, Forge creates the canonical device during import. Imports are idempotent and can run before or after another endpoint source. Later imports enrich the same canonical device when its serial number matches. Existing operator-assigned owners are not silently replaced by Jamf evidence.

​
Data read

Forge requests only the Jamf computer inventory sections needed for mapping:
  • GENERAL
  • HARDWARE
  • USER_AND_LOCATION
Imports are limited to 500 computers per batch. The integration does not read mobile devices and does not run scheduled synchronization in this release.

​
Disconnect

Disconnecting removes the stored credential and retires active Jamf source mappings. Canonical devices and people remain available because they may also be referenced by other endpoint or directory sources.