Jamf Pro checklist: 12 settings to review yourself

This Jamf Pro checklist covers the twelve settings worth reviewing in any instance. Jamf Pro environments often grow without a plan. Policies are added for one-off problems, smart groups multiply, scripts are copied from forums and nobody remembers why a profile exists. Most things still work, until an Apple release, an expired certificate or an audit shows the problems. These are the same twelve areas we review in a Jamf Pro health check, so you can work through them yourself first.

1. Apple connections and expiry dates

Three connections to Apple expire, and each one stops something when it does:

• The Apple push certificate. Jamf says it must be renewed every year with the same Apple Account that created it, and when it expires, device communication stops. Jamf recommends an organisation-owned Apple Account: if it belongs to someone who leaves, every device has to be re-enrolled.
• The Automated Device Enrollment token, renewed yearly from Apple Business. Jamf advises against deleting the expired instance before uploading the new token.
• The Apps and Books content token. Apple says it becomes invalid after a year, or when the password changes on the Managed Apple Account that downloaded it.

Record which account owns each one, and put renewal dates in a shared calendar.

2. Enrolment and PreStage settings

Review PreStage enrolments for the right Setup Assistant screens, account creation, naming and whether management is mandatory and cannot be removed. Confirm new devices from Apple Business are assigned to the right Jamf Pro server automatically.

3. Smart groups

Too many smart groups, or groups nested several levels deep, slow Jamf Pro down and make scoping hard to follow. Remove unused groups, flatten complex ones and adopt a naming convention that shows what each group is for.

4. Policies

Look for policies scoped to all computers on a recurring trigger, policies with no scope, and policies that fail every day. Each one adds server load and hides real problems. Remove what is no longer needed and document the rest.

5. Configuration profiles

Check for duplicate or conflicting payloads, settings Apple has deprecated, and profiles that could now be delivered with declarative device management through Blueprints.

6. Scripts and API credentials

Scripts should never contain passwords or API credentials in plain text. Jamf Pro’s API roles and clients use client credentials, and Jamf recommends a specific role for each client, so each integration gets only the privileges it needs. Review who can read script contents, and retire old API accounts.

7. Software updates

This area changed the most in 2026. In macOS 27, Apple’s legacy software update commands, deferrals and cadence settings stopped working; declarative software updates are now required. In Jamf Pro that means Blueprints with a target version and a deadline. Check that you can report how many devices are out of date, and plan for Intel Macs, which cannot run macOS 27. For one global trading company with around 1,000 Macs, moving to declarative updates in Jamf took update compliance from 65% to 98% in four weeks. Our guide to macOS 27 software updates covers the change in detail.

8. Third-party app patching

Browsers, Zoom, Microsoft 365 apps and other common software should be kept up to date automatically. App Installers do this from the Jamf App Catalog, and Jamf says updates are usually available within one business day. Manual packages that nobody updates are a common finding.

9. Security baselines

Confirm FileVault is enforced and recovery keys are escrowed. From macOS 26.4 FileVault is on by default during setup, but without management nobody holds the key and users can turn it off. Check the firewall and Gatekeeper, and that local admin rights are removed or managed. Compliance Benchmarks in Jamf Pro, built on the macOS Security Compliance Project, apply and report on CIS Level 1 and Level 2 baselines. Check that Jamf Protect is deployed and reporting.

10. Identity and compliance integration

If Macs sign in with Microsoft Entra ID through Jamf Connect or Platform SSO, check it works for new and existing users. If device compliance feeds conditional access, confirm you are on Jamf’s Device Compliance integration: the older conditional access integration was deprecated from 31 January 2025. Then confirm compliant Macs are actually recognised as compliant.

11. Admin access to Jamf Pro

Remove old accounts, use single sign-on for administrators, give each person only the privileges they need, and review the change history for anything unexpected.

12. Inventory, Self Service and documentation

Check inventory collection frequency and extension attributes, because slow ones affect every check-in. Make sure Self Service offers what people actually need. Document the design so it does not depend on one person. For a global consumer brand, we rebuilt the Jamf Pro design document from the live configuration, because the original no longer matched what was deployed.

What to do next

If you find more than a few issues, it is usually quicker to fix them as a planned project than one at a time. Our Jamf Pro health check is a read-only review of all twelve areas. You get a written report and a prioritised fix list, walked through on a call, whether or not we carry out the work. As a Jamf Professional Partner and MSP, we can then fix the issues as a project, alongside your team, or as part of our managed Apple and Jamf service. For day-to-day help, see Mac IT support.