Endpoint Services, Jamf Pro, Information Collection and Administrator Access
Systems
Jamf Pro
Affected Customers
Faculty, staff, and other users of university-managed Apple devices enrolled in Jamf Pro, and the IT professionals who support them.
Actions
- What is Jamf Pro?
- Why is Jamf Pro installed on my devices?
- What information does Jamf Pro collect?
- Does Jamf Pro collect my documents, email, or messages?
- Does Jamf Pro monitor what I do on my devices?
- Does Jamf Pro track my device’s location?
- What access do IT administrators have through Jamf Pro?
- Who can view information about my devices?
- How long is information kept?
- Where can I ask questions?
What is Jamf Pro?
Jamf Pro is a comprehensive endpoint management solution to help campus units configure and manage Apple devices, including iOS/iPadOS, macOS, tvOS, and visionOS. Jamf Pro enables the deployment of software, configuration of security policies, and management of device settings to help meet university security requirements.
Why is Jamf Pro installed on my devices?
Your IT department uses Jamf Pro to install software, apply settings, manage updates, and check that security features are enabled. These tools help IT staff maintain devices and resolve technical problems.
Jamf Self Service+ also lets you install software and perform support tasks made available by your IT department.
What information does Jamf Pro collect?
Jamf Pro maintains an inventory of your device’s hardware, software, and management status. Depending on how your device is configured, this information can include:
| Category | Examples |
|---|---|
| Device identification | Device name, serial number, model, and asset information |
| Hardware and storage | Processor, memory, storage capacity, and available disk space |
| Operating system and software | Operating system version, installed applications, and application versions |
| User and assignment information | Usernames, local account information, and assigned user, department, building, or room, if configured |
| Network information | IP addresses and hardware network addresses |
| Security and management status | FileVault encryption status, passcode status, configuration profiles, and management check-ins |
| Support and maintenance results | Results and logs from software installations, configuration tasks, and troubleshooting scripts, which may include usernames or file paths |
1 The information available and management features supported vary by device type, operating system, and enrollment method.
Does Jamf Pro collect my documents, email, or messages?
Jamf Pro's standard inventory collection does not collect the contents of your documents, email, chat messages, or photos. It reports information about the device and its configuration.
Does Jamf Pro monitor what I do on my devices?
Routine inventory collection does not record your screen or keystrokes, continuously monitor your activity, or collect your browsing history or the contents of your messages.
Jamf Pro can be configured to collect application usage information on Macs.
Other administrative tools may collect information beyond Jamf Pro’s inventory collection to support device management and troubleshooting. Your unit's IT support team can explain which tools are used on your devices and what information they collect.
Does Jamf Pro track my device’s location?
Jamf Pro does not routinely collect your device’s location. For supervised iPhones and iPads, Lost Mode enables location collection to help recover a missing device. This mode locks the device and displays a message on its lock screen.
Enabling Lost Mode does not automatically provide location information to unit IT administrators. Device location information is provided only upon request and when the criteria outlined in the device location data request guidelines are met.
Routine inventory data may include an assigned building or room and network information, such as an IP address, which could be used to infer a device’s approximate location. This is separate from requesting a device’s location through Lost Mode.
What access do IT administrators have through Jamf Pro?
Jamf Pro provides administrative tools for installing software, applying settings, and resolving technical problems. Access to these tools depends on the IT administrator’s assigned role, device type, and management configuration.
On Macs, administrative tools can run with the elevated permissions needed to install software, adjust settings, and troubleshoot problems. These permissions can also allow access to files on the device, subject to macOS privacy protections. Depending on the device and enrollment method, other management capabilities include retrieving a stored FileVault recovery key for a Mac or locking or erasing a device.
On supported Macs, IT administrators can use Jamf Remote Assist to view the screen or remotely control the device to help troubleshoot problems. When a user is logged in, an attended session requires the user to accept an onscreen screen-sharing request before it begins. Remote assistance is separate from routine inventory collection.
Contact your unit’s IT support team for information about the support tools used on your device and the procedures that govern access to user content.
Who can view information about my devices?
Jamf Pro supports role-based permissions that control which administrators can view device data and perform management tasks. Access can also be limited to particular groups of devices, so an administrator’s access may differ from that of other IT staff.
Your unit’s IT support team can answer questions about who has access to your device's inventory and management tools.
How long is information kept?
Your device’s inventory record is kept while it remains actively managed by Jamf Pro. If the device stops communicating with the service, its record is deleted after its management certificates expire, which may take up to two years.
Where can I ask questions?
Contact your unit’s IT support team.