Jamf Extender

Extend Jamf interfaces to accomplish more with fewer clicks

Jamf Extender adds powerful inline features to Jamf Pro — available for Safari, Chrome, Edge, and Firefox — with Apple School Manager (ASM) and Apple Business Manager (ABM) tools. If you also use Jamf Security Cloud and Jamf Protect, device security information surfaces directly in Jamf Pro — no need to navigate away from the page. NEW IN 1.2.3 - 1.3.5 - Spotlight-style search and navigation (Cmd+K or the magnifying-glass button) across Jamf Pro, Jamf Protect, and Jamf Security Cloud - Apple School Manager / Apple Business Manager tools are on by default: Location / Org Unit management (move users and classes, reclaim and transfer licenses, delete a location), MDM server management, searchable lists behind the summary rows, and an "ASM / ABM extender" preference to turn them off - Jamf Account AI Governance: export Claude Code and Claude Desktop policies for Windows, and deploy AI Visibility prevent lists to Jamf Protect; both keep working after Jamf's AI Governance API change - Read features now run on your active Jamf Pro sign-in, so they work without Quick Setup (the API client is only needed for the few write actions) - Mobile app security report on Mobile Device Apps and Jamf Security Cloud, with saved keys you can update or remove - Instance Label pill, Extension Attributes in the column picker, and column picker + CSV export on advanced searches, all-devices search, and smart groups - Export and import Jamf Extender preferences between browsers, plus toggles to hide visuals you don't need - Self Service / Install Automatically in Mobile Apps, and an "Attachments" entry in the Computer / Mobile Device Search dropdown - Deeplinks in All Policies dropdowns, a more meaningful Dashboard Node Health status, and a disabled-policy bucket in the Policy Risk Report - API Role Privilege Picker pre-checks existing privileges when editing - Reliability fixes, including Firefox multi-tab startup and Safari ASM / ABM request handling SPOTLIGHT COMMAND PALETTE (Cmd+K) - Press Cmd+K (or Ctrl+K), or click the new magnifying-glass button in the top nav bar, to open a macOS-Spotlight-style search palette anywhere in Jamf Pro - Instantly search computers, mobile devices, users, policies, configuration profiles, scripts, packages, smart/static groups, blueprints, compliance benchmarks, buildings, departments, categories, and sites — plus a full index of every Settings and navigation page - Narrow with scoped queries like serial:, id:, policy:, profile:, os:, app:, and settings:, with fuzzy matching and full keyboard navigation - Limit to a record type with the checkbox filters or by typing !user (!policy, !computer, ...) which locks into a chip while you keep typing; wrap a term in quotes ("yuresko") for an exact-string match - Reuses your existing Jamf Pro session — no second sign-in and no setup required, and every request is read-only - Works in Jamf Protect and Jamf Security Cloud (RADAR) too — the same palette jumps to any console page (Alerts, Plans, Analytics, Devices, Reports, Settings, and sub-pages like Web Protection or Exceptions) by its real route; it also searches computers on Jamf Protect and devices (by user name, email, or device type) on Jamf Security Cloud, reusing your signed-in session with no setup - On by default; toggle it on/off per browser from the popup or the sidebar panel ("Spotlight search") SMART GROUP INTELLIGENCE - Hover over any smart group name or device count to instantly preview its device membership - Expand "Where It's Used" drawers to see every policy, profile, restricted software rule, app, patch policy, eBook, app installer, webhook, and blueprint that targets, limits, or excludes a group - Spot groups with email notifications enabled or nested group criteria at a glance - Convert unused smart groups to advanced searches or delete them directly - Works for both computer and mobile device smart groups CONFIGURATION PROFILES (macOS + iOS) - Expand inline payload drawers showing every configured payload with human-friendly labels - Compare two or more profiles side-by-side to see shared vs. unique payloads and scope differences - Hover over Scope to see targeted groups with device counts, limitations, and exclusions - Hover over Completed/Pending/Failed to see deployment details with device names and serials BLUEPRINTS - Hover over any blueprint name to see all configured settings — DDM profiles, passcode policies, software update settings, and more - Hover over the "Scoped to" text to see which groups and devices are in scope, with an Export CSV button for device lists - A compact loading indicator stays clear of the page's buttons and shrinks to a small circle on narrow windows POLICY SCOPE & RISK ANALYSIS - Hover over any policy's Scope column to see full targeting details - A risk report bar flags potentially dangerous policies — Ongoing frequency with Recurring Check-in trigger, especially when scoped to All Computers - Disabled policies that match the risky configuration are counted in their own neutral pill separate from caution/warning - Package, script, and printer names in policies become links to their detail page, each with "Copy Name" and "Copy Link" buttons SEARCH RESULTS — COLUMN PICKER + CSV EXPORT - Computer and mobile device search results (both advanced and basic) get a "Columns" picker and "Export CSV" button in the toolbar - Add inventory fields from General / Hardware / User & Location / Purchasing / Security — and every Extension Attribute defined in the instance — as extra columns - Drag to reorder, uncheck to hide, then export the table as CSV in the current column order - A Management ID column appears by default; turn it off with the "Management ID column (reports)" preference — it stays available in the Columns picker to add on demand USAGE TELEMETRY - Records interactions with Jamf Extender's own UI (buttons, toggles, dropdown options, modal actions) to help improve the extension - Each event includes the Jamf Pro tenant ID, the feature/element, a label, the action, the page, and a timestamp - Buffered on-device in extension storage and mirrored to the developer console — nothing is sent off-device in this version - The tenant ID is read once per instance from your active Jamf Pro session (no separate API client required) ATTACHMENT SCANNER - The search query-type dropdown on the Computers and Mobile Devices search pages gets a new "Attachments" option - Pick it, then choose an advanced search, smart group, or static group to scan - The extension scans every device in that scope for uploaded attachments and lists the ones that have any — with the device name (opens in a new tab), the attachment count, and each file's name and size - Computer attachments come from the Jamf Pro API; mobile device attachments are read from the device record using your active Jamf Pro session — no extra privileges required APPLICATION USAGE & UNUSED APP SEARCH - Run aggregated application usage reports across any Advanced Computer Search with flexible time ranges - Find devices that have NOT used a specific application — export results as CSV for cleanup workflows - Save and reload search configurations per Jamf Pro instance DDM EXPLORER (FULL-CONTENT OVERLAY) - A "DDM Explorer" button (next to MUT in the Extender sidebar panel) opens a Declarative Device Management explorer that takes over the main content area while the native sidebar stays visible — a web port of the Jamf Concepts DDM Explorer macOS/iOS app - Browse Apple's device-management GitHub repo — Activations, Configurations, Assets, Management, Status — with a branch picker, text search, and OS filter - Detail view shows declaration type, supported OS versions, allowed scopes + enrollments, payload keys with nested subkeys, related status items, a Jamf Summary of expert notes, and notes - Build payloads with a type-aware form, save declarations and predicates locally, manage them, and send to a single test device (search by name/serial or paste a Management ID) via your active Jamf Pro session - Trigger DDM Sync, Remove all declarations, or read back /api/v1/ddm/{managementId}/status-items - No setup: reuses your in-browser session token — no credential entry or Test Connection - For test-device exploration only; production workflows should use Blueprints COMPLIANCE INTEGRATIONS (Microsoft) - A new "Compliance Integrations" sidenav tab on every computer and mobile device detail page shows the device's conditional-access compliance status — applicable, state (Compliant / Non Compliant), vendor, and vendor device ID - Add a "Compliance Device ID" column to Advanced Computer Searches and Advanced Mobile Searches via the Add Column dropdown - Toggle the tab on/off in Preferences MOBILE APP SECURITY REPORT - Configure your mobile app security report API key in the Jamf Extender popup under "Mobile App Security Report" - On the Mobile Device Apps list page, each app shows its security risk score, risk category, and recommendation from your app security provider - Data is fetched from your configured AWS API Gateway instance (dev or prod) with per-customer API key authentication - Click an app's risk score to expand a drawer showing detailed security findings (latest snapshot) and a time-series history of risk assessments - Only apps on your list are looked up; saved keys and portal credentials can be replaced (Update) or deleted (Remove) in settings - Enable developer mode and toggle "App Security Report: Use Dev Endpoint" to switch between dev and prod instances without changing stored credentials - All credentials are stored locally and encrypted by the browser's storage system; API keys are never logged or transmitted outside the extension MOBILE DEVICE APPS — XML VALIDATOR - Live XML/Plist syntax assistant on the mobile device app detail page - Validates bracket balance, tag matching, plist structure, and more as you type - Warns about leading/trailing whitespace and empty values that could cause unexpected behavior - Line number gutter for easy reference — no credentials required API ROLE PRIVILEGE PICKER - Resource-grouped CRUD grid with per-resource Create/Read/Update/Delete checkboxes — much faster than Jamf Pro's text-only combobox search - Category filter pills (All, Selected, Create, Read, Update, Delete, Other) to narrow the list at a glance - Paste a comma- or newline-separated list of privilege names to filter and highlight exactly those entries, then click "Select From Input" to toggle them all on at once — ideal for replicating a role across instances - "Select All Visible" and "Deselect All" for bulk operations on whatever's currently filtered - "Save Role" writes selected privileges directly via the Jamf Pro API (POST for new, PUT for existing) without needing to click through the native save flow - "View on GitHub" link and the running version in the popup footer and the sidebar panel footer DASHBOARD REQUEST ACCEPTANCE - Inline "Request acceptance:" indicator next to the Jamf Pro version on the dashboard - Polls Jamf Pro's built-in /api/v1/health-status endpoint and reads the oneMinute request-acceptance rate for each bucket (api, ui, device, and so on) - Shows "100%" when every bucket admitted everything that arrived in the last minute, "{N} at capacity" when any bucket is at its throughput ceiling, or "Unavailable" if the endpoint doesn't respond - Expandable per-bucket breakdown so you can see which subsystem is queueing without leaving the dashboard - Collapsible "What this means" explainer at the bottom of the breakdown, quoting the endpoint's own API documentation ("Retrieve request acceptance ratios for this Jamf Pro node") - "At capacity" is not a fault: that bucket is processing its maximum concurrent workload and asking clients to retry the overflow — for devices it means the MDM command processor is fully saturated, not that fewer devices are being handled - Reflects Jamf Pro's own internal admission metrics — does not cover certificate expiry, disk space, backup state, or patch feed freshness - Show or hide it with the "Request acceptance (dashboard)" toggle in Preferences ADD CATEGORY INLINE - "+ Add Category" option pinned to the top of every category dropdown in Jamf Pro (Policies, Profiles, Apps, Patch Policies, Scripts, Packages, Restricted Software, eBooks) - Picking it opens a small modal that creates the category via the Pro API and selects it in place - Requires the "Create Categories" privilege on the API role (auto-added by Quick Setup) PACKAGES — USAGE SCAN, DELETE UNUSED, DOWNLOAD - On Settings > Computer Management > Packages, a "Scan Package Usage" button appears next to the pagination summary - The scan walks every policy and every Computer PreStage Enrollment and adds a new "Used" column to the left of the checkbox column with a green check (used) or red X (no usage found) for each row - Hover the green check for a popover listing the policies and prestages that reference the package, each linking to the relevant edit page - Clicking the red X confirms and then deletes the package via the Pro API; requires the "Delete Packages" privilege on the API role (auto-added by Quick Setup) - The scan itself uses the captured Jamf Pro session token, so users without delete permission can still see which packages are unused - On an individual package's page, a "Download" button is added to the left of the "History" button, matching the per-row Download button the packages list already has - The download resolves the package's file name and a short-lived presigned Jamf Cloud Distribution Service URL in the background and hands it to the browser's download manager, so the signed URL never reaches the page - Runs on your active Jamf Pro session; only packages stored in the Jamf Cloud Distribution Service can be downloaded (file-share distribution points have no API download path, and that case is explained rather than failing silently) MASS UPDATE TOOL (MUT) - Upload a CSV to update Jamf Pro inventory records in bulk — computers, mobile devices, users, static groups, and prestage enrollments - Download CSV templates with optional pre-fill: "Pre-filled" fetches real serial numbers or usernames from your instance; "Blank" downloads an empty template - Preview records before submitting, track progress in real time, cancel mid-batch, and download a results log - Accessible from both the extension popup and the inline sidebar settings panel APPS AND BOOKS LICENSES - Apps and Books license low-balance alert pill — shows on the mobile device apps and Mac apps list pages, immediately to the left of the "New" button, whenever any app's remaining licenses fall below your configurable percent threshold (default 10% of total purchased) - Click the pill to open a drawer listing every app under the threshold with its current Remaining count; the header shows the live "{N} app(s)" total - Ad-hoc threshold tuner inside the drawer re-filters the list on the fly without changing the saved preference - Each row links to the app's detail page in a new tab so you can replenish licenses without leaving the list view - Apps and Books Licenses dashboard widget — a card in the Jamf Pro dashboard's Inventory information section that surfaces low-balance Mobile and Mac apps in one place, with an expandable per-app list. Populated by background-loading the apps list pages, no API calls or extra permissions. Show or hide it with the "Apps & Books widget (dashboard)" toggle in Preferences - Deployment column on the mobile device apps list — a new column after "Source" shows whether each app is Self Service or Install Automatically, loaded in one background request using your active session HOME SCREEN LAYOUT VISUAL BUILDER - "Visual Builder" button on iOS configuration profile edit pages with a Home Screen Layout payload — opens a fullscreen overlay with an iPhone or iPad mockup - Drag and drop apps between the dock, every page, and the picker pane on the