Global consumer brand: a Jamf Pro design that matches reality

The client

The client is a global consumer goods brand. Its people use Macs in offices in several countries. The Mac fleet is managed with Jamf Pro and connects to the company’s Microsoft Entra ID, security and network services.

The challenge

A Jamf Pro environment changes over time. New integrations, profiles and policies are added. A design document written at the start soon stops matching what is actually configured.

The client needed a technical design document that described the environment as it really was.

What we did

Jamf Connect and Platform SSO

Earlier in our work with the client, we deployed Jamf Connect and Platform SSO. People sign in to their Macs with their Microsoft Entra ID account.

A design document built from the live configuration

We pulled the live configuration from Jamf Pro. We then updated the technical design document so it matched that configuration, not an older plan.

Integrations covered

• SCEPman, a cloud certificate authority that issues device certificates (public key infrastructure, or PKI)
• 802.1X network authentication, which uses those certificates to control access to the network
• Zscaler, for secure internet and application access
• SentinelOne, for endpoint protection
• Platform SSO with Microsoft Entra ID, for Mac sign-in

For each integration, the document explains how it is configured in Jamf Pro and how it depends on the other services.

The impact

• A technical design document that matches the live Jamf Pro environment
• One reference for certificates, network access, security tools and sign-in

Why a design document drifts

A design document is usually written when a Jamf Pro environment is first built. After that, the environment keeps changing. In a typical environment, certificates may be added for network access, a security tool may be replaced, or sign-in may move to Platform SSO with Microsoft Entra ID. Each change makes sense on its own, but the document is easy to leave behind.

Building the document from the live configuration, rather than from memory or an older plan, means it describes what is really there. For an environment with several connected services, it also shows how each one depends on the others.

Reviewing your own Jamf Pro environment

If your Jamf Pro environment has grown over several years, it is worth checking whether your own documentation still matches it. Our Jamf Pro health check is an independent review of an instance, and our Jamf Pro checklist shows the areas we look at.

For ongoing help with Mac, iPhone and iPad, see our Apple and Jamf services.