Skip to main content

Jamf Pro Beyond Identity Integration Guide

  • Updated

Introduction

This document describes how to set up a Jamf Pro environment, integrate it with a Beyond Identity tenant, create an authentication policy based on the device being managed or unmanaged and test the authentication policy. 

 

Important: If you already have a Jamf environment configured, go directly to this section: Integrate Jamf Pro with Beyond Identity – Jamf Pro Configuration.

 

Contents


Configure Jamf Pro

Set up the Jamf Pro environment

  1. Access the Jamf Pro environment by logging in to the following link as an administrator:

https://<yourinstancename>.jamfcloud.com

Replace <yourinstancename> with the name of your Jamf Pro instance.

Login using your Jamf Pro admin username and password.

  1. Create additional users, if required. To create additional users, follow these steps:

https://docs.jamf.com/10.28.0/jamf-pro/administrator-guide/Jamf_Pro_User_Accounts_and_Groups.html

  1. You can integrate with a third-party identity provider (IdP) to enable single sign-on (SSO) for portions of Jamf Pro. When SSO is configured and enabled, users are automatically redirected to your organization's IdP login page. After authentication, users obtain access to the resource they were attempting to access. To configure SAML, follow these steps:

https://docs.jamf.com/10.28.0/jamf-pro/administrator-guide/Single_Sign-On.html

 

Prepare for Computer and Device Enrollment

Apple Push Notification Certificate

Creation of an APNs certificate is required for enrollment of iOS devices and macOS devices. This certificate enables secure communication between Jamf Pro and Apple’s servers which support and enable MDM protocols, such as automated deployment of apps, configuration profiles and remote commands.

 

It’s important to note that this certificate must be renewed annually using the same Apple ID that is used to create the certificate. If for any reason, the original Apple ID cannot be used during the renewal process, all devices will need to be re-enrolled. It may make sense to create an Apple ID solely for this purpose.

 

Please follow the instructions in the article at the below link to create the APNs certificate, once you’ve identified an appropriate Apple ID to use.

https://www.jamf.com/jamf-nation/articles/111/generating-and-renewing-an-apple-push-notification-service-apns-certificate



Configure User-initiated Enrollment Settings

While the majority of customer (production) environments utilize Automated enrollment using Apple Business Manager, for the demo environment, you can configure User-initiated enrollment. 

 

Before enrolling devices, the server must be configured to support user-initiated enrollment. Follow the steps below to enable enrollment of both iOS and macOS devices.

  1. Login to Jamf Pro.
  2. In the top-right corner of the page, click Settings.
  3. Click User-Initiated Enrollment.
  4. Click Edit.
  5. The default settings for the General and Messaging tabs should be sufficient, but feel free to customize your end-user experience as desired.
  6. Click Platforms and from the macOS tab, check the box to Enable user-initiated enrollment for computers.
    1. In the Username field, enter any username for the administrative account that will be associated with the managed device.
      Note: Although required, the configuration of this field is only relevant for the use of the Jamf Remote application.
  1. Click the iOS tab and check the box for Enable user-initiated enrollment for institutionally owned iOS devices and personally owned iOS devices.
  2. Click Save in the bottom-right corner of the page. Your environment is now configured to allow users to enroll devices without the use of Apple Business Manager.

 

Enroll Computers

  1. On the test device you intend to deploy the app to, navigate to https://yourInstanceName.jamfcloud.com/enroll
  2. On the Login screen, enter the credentials for the account used to login to Jamf Pro, then click Log in.
  3. On the Assign to user screen, click Enroll without entering anything in the text box.
    Important: Entering data into the text box will prevent enrollment if no LDAP servers are configured (none are by default).
  4. You will be presented with the following dialog box.
  5. Click Continue.  This will download a file “CA Certificate.mobileconfig” on your Mac.
  6. Click on the file “CA Certificate.mobileconfig”. The following dialog is displayed.
  7. Go to Mac System Preferences > Profiles. You will see the CA Certificate listed there.
  8. Click on Install.
  9. Click Install.


    The CA Certificate is now installed.


  10. In your browser, you will be presented with the following dialog box. Click Continue.
    This will download a file “enrollmentProfile.mobileconfig” on your Mac.




  11. Click on the file “enrollmentProfile.mobileconfig”. The following dialog is displayed.
  12. Go to Mac System Preferences > Profiles.  You will see the MDM Profile listed there.
  13. Click on Install.
  14. Click Install again. 


    The MDM Profile is now installed. After the MDM profile has been installed, jamf binary, agents and other management tools will automatically begin installing in the background, please allow a few minutes for this process to complete before attempting to perform management tasks on the device. 
  15. Quit the browser to ensure all Jamf Pro sessions are closed.
     

More information and screenshots of the end user experience can be found in the Jamf Pro Administrator’s Guide at the following link:

https://www.jamf.com/resources/product-documentation/jamf-pro-administrators-guide/

 

Enroll Mobile Devices

  1. On the test device you intend to deploy the app to, navigate to https://yourInstanceName.jamfcloud.com/enroll
  2. On the Login screen, enter the credentials for the account used to login to Jamf Pro, then tap Log in.
  3. When prompted to choose between a Personally Owned or Institutionally Owned device, tap Personally Owned and then tap Enroll.

  4. Tap Continue when prompted to install the CA certificate.
  5. Tap Allow when prompted to download the configuration profile.
  6. Tap Close and then close the browser.
  7. Open the Settings app on the device and tap General, then Profiles.
  8. Tap the CA Certificate, followed by Install in the top-right corner.

  9. Follow the on-screen prompts to complete the installation process.
    Note: If a warning prompts about the authenticity of the MDM Profile, tap Install. This is expected when Jamf Pro is configured to skip certificate installation during enrollment.


More information and screenshots of the end-user experience can be found in the Jamf Pro Administrator’s Guide at the following link:

https://www.jamf.com/resources/product-documentation/jamf-pro-administrators-guide/

 

Integrate Jamf Pro with Beyond Identity – Jamf Pro Configuration

  1. Login to the Jamf Pro Admin Console.
  2. Go to All Settings > Jamf Pro User Accounts & Groups > + New > Create Standard Account.
  3. Click Next.
  4. Under the Account tab, fill in the following information:
    • Username: bi-api-user
    • Privilege Set: Custom
    • Access Status: Enabled
    • Full Name: API User
    • Email Address: <your_email_address>
    • Password:
    • Verify Password:
    • Force user to change password at next login: Leave unchecked
  1. Under the Privileges tab, fill in the following information
    • Click on Jamf Pro Server Objects.
    • Select READ permissions for all.
    • Leave other permissions unchecked.
  1. Click Save.

Note: You will need the username and password in the next section.

 

Integrate Jamf Pro with Beyond Identity – Beyond Identity Configuration

  1. Log into the Beyond Identity Admin console.
  2. Go to Integrations > Endpoint Management.
    integrations page.png  

     3. Click the Edit Configuration icon.

  1. Enter the following information obtained from Jamf Pro Admin UI.
    1. API URL: e. g. https://<yourjamfinstance>.jamfcloud.com
    2. Username: bi-api-user
    3. Password: <password>

      Edit jamf.png
  1. Click Save Changes.

 

Push the Beyond Identity Authenticator to Mobile Devices

In order to leverage JAMF mobile attributes in the Beyond Identity policy and determine a managed state, the Beyond Identity Authenticator must be pushed to managed mobile devices with a specific app configuration.

  1. Go to Devices > Mobile Device Apps > + New.
  2. Click App Store app or apps purchased in volume.
  3. Search for and add the Beyond Identity mobile application.


  4.  On the 'New Mobile Device App' page, go to App Configuration and enter the following:

    <dict><key>serialNumber</key><string>$SERIALNUMBER</string><key>DeviceUid</key><string>$UDID</string><key>JamfProID</key><string>$JSSID</string></dict>



  5. Click Save.


Configure the MDM Authentication Policy

  1. Log into the Beyond Identity Admin console.
  2. Go to Policy > Edit Policy > Add rule.
  3. Create a rule to deny authentication if the device is not in a “managed state” as shown below.
    unmanaged state.png

  4. Click Add.  
    Note: This rule will take effect immediately. 

 

Test the MDM Authentication Policy

  1. Login to the Beyond Identity Admin console first from a computer that is enrolled in Jamf Pro and then from a computer that is not enrolled in Jamf Pro. 
  2. Confirm that the policy behavior is as expected.
  3. Check the Events tab to ensure that the correct rule is triggered.

 

Appendix: How to unenroll computers and devices

  1. Open the Jamf Pro Admin Console.
  2. Click on Computers.
  3. Click on Search.
  4. Click on your computer (or Devices) listed there.
  5. Click on Management (in the tab at the top).
  6. Click on Delete (bottom right).


    This will delete your computer (or mobile device) from the Jamf Pro management

    You can now go back and check that Beyond Identity detects that the computer (or device) is no longer managed.




Related articles

Comments

0 comments

Please sign in to leave a comment.