Jamf Pro

Overview

Jamf Pro is an Apple device management platform. Its REST APIs expose selected computer inventory and management records. A customer-owned adapter can map a small record set to Pomerium Enterprise external data.

Selected Jamf Pro data can add organization, inventory, or security context to an access decision. A small, reviewed record set is easier to understand and protect than a broad export of the source system.

Pomerium can evaluate selected Jamf Pro records after a customer-owned adapter maps them to supported request or user keys. Pomerium does not call the vendor API directly and does not manage the source system.

How it works

Create a least-privilege Jamf Pro API client. Prefer the Jamf Pro API where it exposes the required inventory fields. Read only the computer and user records that the access policy needs.

Map only the fields that policy needs. Each imported record must use a Pomerium-supported foreign key: user.id, user.email, request.ip, or request.client_certificate.fingerprint.

Publish the records through a protected JSON, CSV, tar, or ZIP source. Configure Pomerium Enterprise to poll that source. Evaluate the imported fields with a Pomerium Policy Language record matcher.

Example

An adapter reads managed computer records from Jamf Pro and maps an approved work email to a narrow inventory state. Pomerium evaluates that imported state for the authenticated user. The Jamf computer ID itself is not treated as proof of the device that made the request.

Considerations

• Use minimal read privileges and protect the Jamf Pro API credentials.
• Prefer the current Jamf Pro API when it supports the required field. The Classic API has a different model and lifecycle.
• This is a customer-owned connector pattern, not a built-in Pomerium connector.
• External data sources need Pomerium Enterprise and update on a polling schedule.
• A vendor device or asset ID does not prove which device made the current Pomerium request.