Jamf

Overview

The Jamf connector registers webhooks in Jamf Pro, so Tessel hears about device changes the moment Jamf records them. Each webhook arrives as a typed event with the serial number, user and device details, and it appears in the trace of the run it started.

Teams use it to mark onboarding done when a new hire's Mac enrolls, to open a Zendesk ticket when a device falls out of the encryption smart group, and to lock a lost laptop after Okta deactivates its owner.

Supported versions

• Jamf Pro 10.49 and later, on Jamf Cloud or on-premises

• macOS computers, plus iPhone and iPad as mobile devices

• On-premises servers reachable over TLS from Tessel's static IPs

How webhooks work

Tessel creates one webhook per event type, each with a signing header unique to your workspace. Jamf posts JSON to a regional endpoint, and Tessel checks the header and the schema before starting a run. Repeated posts for the same event are matched by webhook ID and timestamp and dropped.

{
  "webhook": { "id": 12, "name": "Tessel",
    "webhookEvent": "ComputerAdded" },
  "event": { "serialNumber": "C02XK1JHJG5J",
    "username": "dana.lee", "osVersion": "15.1" }
}

{
  "webhook": { "id": 12, "name": "Tessel",
    "webhookEvent": "ComputerAdded" },
  "event": { "serialNumber": "C02XK1JHJG5J",
    "username": "dana.lee", "osVersion": "15.1" }
}

{
  "webhook": { "id": 12, "name": "Tessel",
    "webhookEvent": "ComputerAdded" },
  "event": { "serialNumber": "C02XK1JHJG5J",
    "username": "dana.lee", "osVersion": "15.1" }
}

Remote commands

Lock and erase actions send MDM commands that cannot be undone. Tessel puts them behind an approval step by default, so a named person and a backup confirm before the command leaves.

Permissions needed

Create an API client in Jamf Pro with an API role that holds only the privileges below. The client uses client credentials, and Tessel refreshes its token before it expires.

• Read Computers and Read Mobile Devices for lookups

• Update Computers for inventory fields

• Send Computer Remote Lock Command and Send Computer Remote Wipe Command for device actions