> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Jamf Pro

> Map Jamf computers to existing Forge people and endpoint devices.

The Jamf Pro integration enriches Forge device inventory with computer-owner
information. It does not create people, sync a directory, manage devices, or
change Jamf configuration.

This connection is read-only and separate from deploying Forge for devices
through Jamf. To install and manage Forge on macOS with Jamf, follow the
[macOS deployment guide](/integrations/device-agent#macos-setup) instead.

## Before you connect

People must already exist in Forge through a directory integration or manual
directory management. Forge can then attach Jamf computers to those existing
people.

In Jamf Pro:

1. Open **Settings → System → API roles and clients**.
2. Create an API Role with only the **Read Computers** privilege.
3. Create an API Client and assign the role.
4. Generate a client secret and copy the client ID and secret. Jamf shows the
   secret only once.

No write privileges are required.

## Connect

1. In Forge, open **Settings → Integrations → Jamf Pro**.
2. Enter the Jamf Cloud tenant URL, such as
   `https://company.jamfcloud.com`.
3. Enter the API client ID and client secret, then select **Save connection**.
4. Select **Test connection**. Forge verifies OAuth and computer inventory
   access.

Forge stores the client credential as a managed secret. Enter both fields
again only when rotating the credential.

## Import devices

Open **Device import**, select the computers to import, and confirm their
owners. Forge resolves each computer as follows:

* A unique, exact email match links automatically to an existing Person.
* An email-shaped Jamf username is used when the Jamf email field is empty.
* Any unresolved computer must be assigned to an existing Person before it is
  imported. One Person can be applied to all unresolved computers at once.
* Jamf never creates a Person.

Forge first reuses the stable Jamf computer ID. Otherwise, a unique normalized
serial number reconciles the computer with an existing device, including one
previously imported from CrowdStrike. Hostnames are not used for identity
matching because they can change or collide. If no device matches, Forge
creates the canonical device during import.

Imports are idempotent and can run before or after another endpoint source.
Later imports enrich the same canonical device when its serial number matches.
Existing operator-assigned owners are not silently replaced by Jamf evidence.

## Data read

Forge requests only the Jamf computer inventory sections needed for mapping:

* `GENERAL`
* `HARDWARE`
* `USER_AND_LOCATION`

Imports are limited to 500 computers per batch. The integration does not read
mobile devices and does not run scheduled synchronization in this release.

## Disconnect

Disconnecting removes the stored credential and retires active Jamf source
mappings. Canonical devices and people remain available because they may also
be referenced by other endpoint or directory sources.