Overview
Vanta’s Jamf Pro integration enables automated evidence collection and continuous monitoring of your managed devices.
Vanta synchronizes the following data from Jamf Pro:
Computers: Device details, including hardware information, operating system version, disk encryption status, installed applications, running services, configuration profiles, and local user accounts.
Accounts: Jamf user accounts used for linked account monitoring.
Vendors: Third-party software vendors inferred from installed applications (identified by bundle ID) on your Jamf-managed computers, used for vendor inventory and related workflows in Vanta.
This data syncs approximately every hour and is used within Vanta for:
Device compliance monitoring
Automated evidence collection
Endpoint inventory tracking
Security posture assessments (such as disk encryption, screen lock configuration, antivirus detection, and password manager detection)
How it works
Authentication
Vanta connects to Jamf Pro using OAuth 2.0 through Jamf’s API Roles and Clients framework.
During setup:
You create an API Role with specific read-only permissions
You generate a Client ID and Client Secret
Vanta uses these client credentials to obtain OAuth access tokens whose lifetime you configure in Jamf Pro for the API client. Vanta refreshes tokens automatically as needed. No passwords are stored.
How Vanta Uses This Data
Device compliance monitoring: Evaluates whether computers meet security requirements such as disk encryption (FileVault), screen lock configuration, and antivirus presence.
Automated evidence collection: Generates compliance evidence for frameworks such as SOC 2, ISO 27001, and HIPAA based on collected device data.
Password manager detection: Identifies whether approved password managers are installed on devices.
Linked accounts: Maps Jamf user accounts to Vanta personnel to support access review workflows.
Vendor inventory: Surfaces third-party applications observed via Jamf as vendor records, including which managed computers have them installed.
Use Cases
Connecting Jamf enables the following capabilities within Vanta:
Demonstrate Endpoint Compliance for Audits (SOC 2, ISO 27001, HIPAA): Automatically provide evidence that managed macOS devices meet security requirements such as disk encryption (FileVault), screenlock enforcement, antivirus protection, and password manager usage — without manual evidence collection.
Continuously Monitor macOS Fleet Security Posture: Maintain ongoing visibility into device compliance status across your organization, including OS version, encryption state, installed applications, and running security services.
Scope audit evidence to relevant devices: Use Jamf Sites or the "VantaNoAlert" computer group to filter which devices Vanta monitors, ensuring compliance reporting includes only machines relevant to a specific audit or business unit.
Reduce IT effort during audit preparation: Eliminate manual exports, screenshots, and spreadsheet compilation by synchronizing device and account data directly from Jamf Pro into Vanta.
Jamf admin account access reviews: Map Jamf Pro admin accounts to your personnel directory to support periodic access reviews of who has administrative access to your MDM.
Prerequisites
To connect the Jamf Pro (OAuth) integration, you must have:
A Jamf Pro Cloud instance (for example, yourdomain.jamfcloud.com)
Administrator access or sufficient privileges to create API Roles and API Clients in Jamf Pro
Note: Vanta does not currently support on-premise deployments, Jamf Now, or Jamf Business.
Connect the integration
Step 1: Create an API Role in Jamf Pro
Before connecting Vanta, define the specific read-only permissions the integration will use.
Log in to your Jamf Pro dashboard.
Click the Settings (gear icon) in the top right or side navigation.
Go to System → API roles and clients.
Select the API Roles tab and click + New.
Under Display Name, enter vanta_test_role (or a name of your choice).
In the Privileges section, search for and add the following Read permissions:
Read Accounts: Account names, emails, roles, access levels, enabled status
Read Computers: Computer names, OS versions, disk encryption status, installed applications, running services, user/location data, hardware info
Read Static Computer Groups:Group names per computer
Read macOS Configuration Profiles: Profile payloads to verify screenlock enforcement
Click save.
Step 2: Create an API Client and Generate Credentials
Next, generate the client credentials required for the Vanta connection.
Switch to the API Clients tab and click + New
Under Display Name, enter vanta_client_cred
Under API Roles, select the role created in Step 1 (for example, vanta_test_role)
Ensure the client is set to Enabled
Click Save
After saving, click Generate Client Secret
Important: Copy the Client ID and Client Secret immediately. The Client Secret will not be visible again after you close this window.
Step 3: Connect Jamf Pro to Vanta
Open Vanta and navigate to Integrations from the left-hand panel
Search for Jamf Pro in the Available tab and select Connect
In the connection modal, provide the following:
Jamf Cloud Hostname: Your full Jamf Cloud URL (e.g., company.jamfcloud.com).
Client ID: The ID generated in Step 2
Client Secret: The Secret generated in Step 2
Select Validate and store
If the connection is successful, you will see a confirmation message indicating that the Jamf Pro connection has been created.
Step 4: Configure Resource Scope
After connecting, configure which resources Vanta should monitor.
Navigate to Connected Integrations
Locate Jamf Pro and select Configure Scope
Review the list of Jamf Accounts and Computers
Toggle specific resources In Scope or Out of Scope based on your compliance requirements
Note: Resource scoping changes may take at least one hour to fully update across the platform.
Permissions
Vanta requires the following permissions to monitor:
Permission | Description | Use cases |
Read Accounts | Account names, emails, roles, access levels, enabled status | With this permission, Vanta can pull in Jamf admin and user accounts for access management and deprovisioning checks. |
Read Computers | Computer names, OS versions, disk encryption status, installed applications, running services, user/location data, hardware info | With this permission, Vanta can pull in device info such as hardware details, installed applications, antivirus status, password managers, and disk encryption. |
Read Static Computer Groups | Group names per computer | With this permission, Vanta can identify device groupings for MDM scoping and exclude specific devices from compliance checks.
|
Read macOS Configuration Profiles | Profile payloads to verify screenlock enforcement (askForPassword, askForPasswordDelay, loginWindowIdleTime) | With this permission, Vanta can pull in screenlock settings to verify that devices require a password after the screensaver activates.
|
Vanta will be able to write:
Nothing - Vanta has read-only access and cannot modify your Jamf Pro configuration, devices, or policies
Monitored resources
The Jamf Pro integration monitors macOS computers only. Although Jamf Pro also manages iOS and iPadOS devices, Vanta does not currently sync mobile device data from this integration. Windows, Linux, and Android are not supported by Jamf Pro.
For each managed Mac, Vanta collects: hardware details, OS version, serial number, UDID, asset tag, last contact date, enrollment date, and site assignment. It reads macOS configuration profiles to verify screenlock enforcement. It checks installed applications and running services to detect recognized antivirus products and approved password managers.
Resource type | Windows | macOS | Linux | iOS | Android |
Device Monitoring | Not supported by Jamf | ✅ | Not supported by Jamf | ❌ | Not supported by Jamf |
Screenlock Settings | Not supported by Jamf | ✅ | Not supported by Jamf | ❌ | Not supported by Jamf |
Antivirus detection | Not supported by Jamf | ✅ | Not supported by Jamf | ❌ | Not supported by Jamf |
Password Manager | Not supported by Jamf | ✅ | Not supported by Jamf | ❌ | Not supported by Jamf |
Vendor inventory | Not supported by Jamf | ✅ | Not supported by Jamf | ❌ | Not supported by Jamf |
Additional Guidance
If you have computers that are not managed by Jamf Pro, install the Vanta Device Agent on those machines to ensure full compliance coverage.