{"slug":"restrict-device-access-with-jamf-pro","title":"Restrict device access with Jamf Pro","tags":["tailscale","access-control","devices"],"agent_summary":"Last validated: Jan 28, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Restrict device access with Jamf Pro\r\n\r\nLast validated: Jan 28, 2026\r\n\r\nThis integrationis available for [the Standard, Premium, and Enterprise plans](https://tailscale.com/pricing).\r\n\r\n[Jamf Pro](https://www.jamf.com/products/jamf-pro/) collects a series of signals from the MDM profile installed on devices and these signals can be used to determine the security posture of a device. Tailscale can fetch these signals from Jamf Pro and use them as device posture attributes in access rules, which can allow organizations to grant access to sensitive resources only to devices that have a high enough level of trust.\r\n\r\nYou can achieve this Tailscale's [device posture management](https://tailscale.com/docs/features/device-posture) features:\r\n\r\n- [Device Identity Collection](https://tailscale.com/docs/features/access-control/device-management/how-to/manage-identity), which collects identifiers (for example, serial numbers), used to match devices in Tailscale to devices in Jamf Pro.\r\n- Jamf Pro posture integration, which synchronizes signals from Jamf Pro to device posture attributes in Tailscale.\r\n- [Posture conditions in access rules](https://tailscale.com/docs/features/device-posture#device-posture-conditions), which lets you configure access restrictions based on device attributes.\r\n\r\nThis guide explains how to enable Device Identity collection for your Tailscale network (tailnet) and configure Jamf Pro posture integration.\r\n\r\n## [What is Jamf Pro posture integration?](https://tailscale.com/docs/integrations/jamf-pro\\#what-is-jamf-pro-posture-integration)\r\n\r\nThe Jamf Pro integration syncs data between Jamf Pro and Tailscale on a recurring schedule.\r\nDuring each sync, Tailscale performs the following actions:\r\n\r\n1. Fetches a list of hosts and their reported data from your Jamf Pro account.\r\n2. Matches Jamf Pro devices to devices in your tailnet based on serial numbers.\r\n3. Writes the Jamf Pro data to device posture attributes on each matched device.\r\n\r\nThe integration writes the following device posture attributes to matched devices:\r\n\r\n| **Attribute key** | **Description** | **Allowed values** |\r\n| --- | --- | --- |\r\n| `jamfPro:remoteManaged` | Whether the device is managed by Jamf Pro | `true`, `false` |\r\n| `jamfPro:supervised` | Whether the device is supervised by Jamf Pro | `true`, `false` |\r\n| `jamfPro:firewallEnabled` | Whether the macOS firewall is enabled | `true`, `false` |\r\n| `jamfPro:fileVaultStatus` | Status of FileVault disk encryption | `ALL_ENCRYPTED`, `SOME_ENCRYPTED`, `BOOT_ENCRYPTED`, `NOT_ENCRYPTED`, `NOT_APPLICABLE` |\r\n| `jamfPro:SIPEnabled` | Whether macOS System Integrity Protection is enabled | `NOT_COLLECTED`, `NOT_AVAILABLE`, `DISABLED`, `ENABLED` |\r\n\r\n## [Prerequisites](https://tailscale.com/docs/integrations/jamf-pro\\#prerequisites)\r\n\r\nBefore you can set up the Jamf Pro integration, make sure you have:\r\n\r\n- [Device Identity Collection](https://tailscale.com/docs/features/access-control/device-management/how-to/manage-identity) enabled, and devices in your tailnet are reporting identifiers.\r\n- A Jamf Pro account for which you have permission to create an API token.\r\n\r\n## [Create Jamf Pro API Token](https://tailscale.com/docs/integrations/jamf-pro\\#create-jamf-pro-api-token)\r\n\r\nTo authenticate your Jamf Pro account with Tailscale, you'll need to create a Jamf Pro API Token.\r\nThe Jamf Pro integration uses these to fetch a list of devices and their data from Jamf Pro.\r\n\r\nTo create a Jamf Pro API Token:\r\n\r\n1. In Jamf Pro, in the left-hand panel, select **Settings**.\r\n\r\n2. Select **API roles and clients**.\r\n\r\n3. Select **\\+ New** in the upper right corner.\r\n\r\n4. Add a Display Name for the API role and add \"Read Computers\" to **Privileges** and then select **Save**.\r\n\r\n5. Go back to the **API roles and clients** screen and select **API Clients** and select **\\+ New** in the upper right corner.\r\n\r\n6. Add a Display Name for the API Client and select the API Role created in the previous step, toggle **Enable API client**, and then select **Save**.\r\n![The Jamf Pro Add an API client dialog](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fjamfpro-add-token.402a48c1.png&w=750&q=75)\r\n7. Select **Generate client secret** and select **Create secret** in the pop-up dialog. Make sure to copy the **Client ID** and **Client Secret** for use in the next section.\r\n\r\n\r\n## [Configure Jamf Pro posture integration](https://tailscale.com/docs/integrations/jamf-pro\\#configure-jamf-pro-posture-integration)\r\n\r\nTo configure Tailscale to fetch data about devices from Jamf Pro:\r\n\r\n1. Open the [Device management](https://login.tailscale.com/admin/settings/device-management) page of the Tailscale admin console.\r\n\r\n2. Under the **Device Posture Integrations** section, locate the Jamf Pro integration, then select **Connect**.\r\n\r\n3. Enter your **Jamf API URL**, the URL you use to access the Jamf Pro console.\r\n\r\n4. Enter your **Client ID**.\r\n\r\n5. Enter your **Client Secret**.\r\n![The configuration screen for connecting to Jamf Pro from the Tailscale admin console.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fconfigure-integration.6c506685.png&w=1080&q=75)\r\n6. Select **Connect to Jamf**.\r\n\r\n\r\n## [Review the integration status](https://tailscale.com/docs/integrations/jamf-pro\\#review-the-integration-status)\r\n\r\nNext, check to ensure the Jamf Pro integration has run successfully.\r\n\r\n1. Go to the **Device Posture Integrations** section of the [Device management](https://login.tailscale.com/admin/settings/device-management) page.\r\n2. Locate the Jamf Pro integration under the **Integrations** section.\r\n\r\nAfter the Jamf Pro integration runs successfully, it shows the time of the most recent sync, the number of synced devices, and any errors that occurred while synchronizing.\r\n\r\n![Integrations: Jamf Pro: Last sync 4 minutes ago, 1 match between 2 Tailscale devices with identifies and 3 Jamf devices](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fintegration-status.39f17089.png&w=1200&q=75)\r\n\r\n## [Check node attributes](https://tailscale.com/docs/integrations/jamf-pro\\#check-node-attributes)\r\n\r\nAfter you set up the Jamf Pro integration, you can confirm that Tailscale is writing the new node attributes for your Jamf Pro devices from the Tailscale admin console.\r\n\r\n1. Open the [Machines](https://login.tailscale.com/admin/machines) page of the Tailscale admin console.\r\n2. Select a device to inspect.\r\n3. The node attributes for the device are in the **Machine Details** section. This should include the set of `jamfPro:` attributes listed previously.\r\n\r\n![View of the machine attributes in the Machines page.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fmachine-attributes.b7eb1162.png&w=640&q=75)\r\n\r\nYou can also check device attributes using the [Tailscale API](https://tailscale.com/api#tag/devices/GET/device/%7BdeviceId%7D/attributes).\r\n\r\n## [Adjust Tailscale access rules](https://tailscale.com/docs/integrations/jamf-pro\\#adjust-tailscale-access-rules)\r\n\r\nAfter you set up the Jamf Pro posture integration, and your devices have device posture attributes that reflect their signals as reported by Jamf Pro, you can use those device posture attributes as part of your posture rules.\r\n\r\nFor example, to only permit access to `tag:production` from devices that are actively managed and supervised by Jamf Pro, you can create a new posture and use it as part of a corresponding access rule:\r\n\r\n```json\r\n\"postures\": {\r\n \"posture:trusted\": [\\\r\n \"jamfPro:remoteManaged == true\",\\\r\n \"jamfPro:supervised == true\",\\\r\n ],\r\n},\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"autogroup:member\"],\\\r\n \"dst\": [\"tag:production\"],\\\r\n \"ip\": [\"*\"],\\\r\n \"srcPosture\": [\"posture:trusted\"]\\\r\n }\\\r\n]\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n## [Schedule](https://tailscale.com/docs/integrations/jamf-pro\\#schedule)\r\n\r\nFor each configured integration, Tailscale will aim to sync device posture\r\nattributes every 15 minutes, with a few exceptions:\r\n\r\n- Adding a new integration, or changing configuration of an existing one,\r\nwill trigger an out-of-schedule sync.\r\n- If an integration fails due to authentication error (usually caused by invalid\r\ncredentials), it will be paused for up to 24 hours.\r\n\r\n## [Audit log events](https://tailscale.com/docs/integrations/jamf-pro\\#audit-log-events)\r\n\r\nThe following [audit log events](https://tailscale.com/docs/features/logging/audit-logging#events) are added for device posture.\r\n\r\n| **Target** | **Action** | **Description** |\r\n| --- | --- | --- |\r\n| Integration | Create posture integration | A new posture integration was created |\r\n| Integration | Update posture integration | A posture integration was updated |\r\n| Integration | Removed posture integration | A posture integration was removed |\r\n| Node | Update node attribute | Device posture attributes for a node were changed |\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Restrict device access with Jamf Pro

\n

Last validated: Jan 28, 2026

\n

This integrationis available for the Standard, Premium, and Enterprise plans.

\n

Jamf Pro collects a series of signals from the MDM profile installed on devices and these signals can be used to determine the security posture of a device. Tailscale can fetch these signals from Jamf Pro and use them as device posture attributes in access rules, which can allow organizations to grant access to sensitive resources only to devices that have a high enough level of trust.

\n

You can achieve this Tailscale's device posture management features:

\n\n

This guide explains how to enable Device Identity collection for your Tailscale network (tailnet) and configure Jamf Pro posture integration.

\n

What is Jamf Pro posture integration?

\n

The Jamf Pro integration syncs data between Jamf Pro and Tailscale on a recurring schedule.\r\nDuring each sync, Tailscale performs the following actions:

\n
    \n
  1. Fetches a list of hosts and their reported data from your Jamf Pro account.
    2. \n
  2. Matches Jamf Pro devices to devices in your tailnet based on serial numbers.
    3. \n
  3. Writes the Jamf Pro data to device posture attributes on each matched device.
    4. \n
\n

The integration writes the following device posture attributes to matched devices:

\n

| Attribute key | Description | Allowed values |\r\n| --- | --- | --- |\r\n| jamfPro:remoteManaged | Whether the device is managed by Jamf Pro | true, false |\r\n| jamfPro:supervised | Whether the device is supervised by Jamf Pro | true, false |\r\n| jamfPro:firewallEnabled | Whether the macOS firewall is enabled | true, false |\r\n| jamfPro:fileVaultStatus | Status of FileVault disk encryption | ALL_ENCRYPTED, SOME_ENCRYPTED, BOOT_ENCRYPTED, NOT_ENCRYPTED, NOT_APPLICABLE |\r\n| jamfPro:SIPEnabled | Whether macOS System Integrity Protection is enabled | NOT_COLLECTED, NOT_AVAILABLE, DISABLED, ENABLED |

\n

Prerequisites

\n

Before you can set up the Jamf Pro integration, make sure you have:

\n\n

Create Jamf Pro API Token

\n

To authenticate your Jamf Pro account with Tailscale, you'll need to create a Jamf Pro API Token.\r\nThe Jamf Pro integration uses these to fetch a list of devices and their data from Jamf Pro.

\n

To create a Jamf Pro API Token:

\n
    \n
  1. \n

    In Jamf Pro, in the left-hand panel, select Settings.

    \n
    2. \n
  2. \n

    Select API roles and clients.

    \n
    3. \n
  3. \n

    Select + New in the upper right corner.

    \n
    4. \n
  4. \n

    Add a Display Name for the API role and add \"Read Computers\" to Privileges and then select Save.

    \n
    5. \n
  5. \n

    Go back to the API roles and clients screen and select API Clients and select + New in the upper right corner.

    \n
    6. \n
  6. \n

    Add a Display Name for the API Client and select the API Role created in the previous step, toggle Enable API client, and then select Save.\r\n\"The

    \n
    7. \n
  7. \n

    Select Generate client secret and select Create secret in the pop-up dialog. Make sure to copy the Client ID and Client Secret for use in the next section.

    \n
    8. \n
\n

Configure Jamf Pro posture integration

\n

To configure Tailscale to fetch data about devices from Jamf Pro:

\n
    \n
  1. \n

    Open the Device management page of the Tailscale admin console.

    \n
    2. \n
  2. \n

    Under the Device Posture Integrations section, locate the Jamf Pro integration, then select Connect.

    \n
    3. \n
  3. \n

    Enter your Jamf API URL, the URL you use to access the Jamf Pro console.

    \n
    4. \n
  4. \n

    Enter your Client ID.

    \n
    5. \n
  5. \n

    Enter your Client Secret.\r\n\"The

    \n
    6. \n
  6. \n

    Select Connect to Jamf.

    \n
    7. \n
\n

Review the integration status

\n

Next, check to ensure the Jamf Pro integration has run successfully.

\n
    \n
  1. Go to the Device Posture Integrations section of the Device management page.
    2. \n
  2. Locate the Jamf Pro integration under the Integrations section.
    3. \n
\n

After the Jamf Pro integration runs successfully, it shows the time of the most recent sync, the number of synced devices, and any errors that occurred while synchronizing.

\n

\"Integrations:

\n

Check node attributes

\n

After you set up the Jamf Pro integration, you can confirm that Tailscale is writing the new node attributes for your Jamf Pro devices from the Tailscale admin console.

\n
    \n
  1. Open the Machines page of the Tailscale admin console.
    2. \n
  2. Select a device to inspect.
    3. \n
  3. The node attributes for the device are in the Machine Details section. This should include the set of jamfPro: attributes listed previously.
    4. \n
\n

\"View

\n

You can also check device attributes using the Tailscale API.

\n

Adjust Tailscale access rules

\n

After you set up the Jamf Pro posture integration, and your devices have device posture attributes that reflect their signals as reported by Jamf Pro, you can use those device posture attributes as part of your posture rules.

\n

For example, to only permit access to tag:production from devices that are actively managed and supervised by Jamf Pro, you can create a new posture and use it as part of a corresponding access rule:

\n
\"postures\": {\r\n  \"posture:trusted\": [\\\r\n    \"jamfPro:remoteManaged == true\",\\\r\n    \"jamfPro:supervised == true\",\\\r\n  ],\r\n},\r\n\"grants\": [\\\r\n  {\\\r\n    \"src\": [\"autogroup:member\"],\\\r\n    \"dst\": [\"tag:production\"],\\\r\n    \"ip\": [\"*\"],\\\r\n    \"srcPosture\": [\"posture:trusted\"]\\\r\n  }\\\r\n]\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Schedule

\n

For each configured integration, Tailscale will aim to sync device posture\r\nattributes every 15 minutes, with a few exceptions:

\n\n

Audit log events

\n

The following audit log events are added for device posture.

\n

| Target | Action | Description |\r\n| --- | --- | --- |\r\n| Integration | Create posture integration | A new posture integration was created |\r\n| Integration | Update posture integration | A posture integration was updated |\r\n| Integration | Removed posture integration | A posture integration was removed |\r\n| Node | Update node attribute | Device posture attributes for a node were changed |

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}