Jamf Pro health check
Our Jamf Pro health check service is an independent, read-only review of your Jamf Pro set-up by a Jamf Professional Partner. You get a written report and a prioritised fix list to keep, whoever does the work.
You receive
Trusted by teams across UK government, healthcare, education, charities, financial services and global brands
12 areas
reviewed in every instance, from certificates to documentation
3 renewals
Apple connections that expire every year: push certificate, enrolment token, purchasing token
30 days
before expiry, when Apple starts emailing push certificate reminders, to one person’s address
Sources: Jamf documentation on push certificates, enrolment tokens and volume purchasing tokens, and push certificate reminders.
Most Jamf Pro instances still work. The problems are the ones nobody sees until an Apple release, an audit or a renewal.
Scenario 1
In macOS 27, Apple’s older software update commands, deferrals and cadence settings no longer work. Declarative software update management is now required.
What you can doMove update enforcement to Blueprints in Jamf Pro, with a target version and a deadline, and report on Macs that fall behind.
Scenario 2
The push certificate lasts a year and must be renewed with the Apple Account that created it. Jamf says that if a personal account was used and that person leaves, every device has to re-enrol.
What you can doRecord who owns each certificate and token, move ownership to an organisational account where possible, and put every renewal date in a shared calendar.
Scenario 3
The older Jamf Conditional Access integration was deprecated from 31 January 2025. Device Compliance replaced it.
What you can doCheck that compliant Macs are recognised in Microsoft Entra ID, so conditional access works for Macs as well as PCs.
Scenario 4
macOS 27 runs only on Apple silicon. Intel Macs stay on macOS Tahoe 26 or earlier.
What you can doList the Intel Macs, plan replacements, and keep them on supported updates in the meantime.
We check the same areas on every Jamf Pro instance, so nothing is missed. To look at your own instance first, use our Jamf Pro checklist, which walks through twelve settings to review yourself.
Push certificate, enrolment and purchasing tokens, the Apple Business connection, PreStage enrolment settings, and your Jamf Pro version and hosting.
Smart groups and scoping, policies and triggers, configuration profiles and conflicts, and how far you have moved to Blueprints and declarative management.
FileVault and recovery key escrow, admin rights and local accounts, Compliance Benchmarks against CIS baselines, and Jamf Protect coverage.
macOS and iOS update enforcement, App Installers for third-party Mac apps, the Self Service catalogue, and scripts that hold credentials.
Jamf Connect or Platform SSO with Entra ID, Device Compliance and conditional access results, and single sign-on for Jamf Pro administrators.
Licence counts against devices, stale and retired records, inventory and extension attributes, documentation and naming.
What you know, and what you can act on, once the review is done.
| Area | Before | After |
|---|---|---|
| Renewals | BeforeRenewal dates held in one person’s inbox. | AfterEvery certificate and token listed with its owner and expiry date. |
| Updates | BeforeOlder update settings that macOS 27 ignores. | AfterA plan to enforce updates through Blueprints, with deadlines. |
| Security | BeforeSettings that may or may not match a baseline. | AfterGaps against CIS-aligned baselines, ranked by risk. |
| Clutter | BeforeOld policies, groups and scripts nobody can explain. | AfterA list of what to remove, merge or document. |
| Licences | BeforeLicence counts that do not match the devices in use. | AfterUsage findings to take into your renewal. |
Read-only, with little work for your team and a clear report at the end.
A short call
We talk about your devices, your concerns and any renewal, audit or Apple release coming up, then confirm the scope and cost.
Book a health checkRead-only
Your team gives us read-only access to Jamf Pro. We change nothing during the review.
Every area
Our engineers review all twelve areas and test the most important settings, such as enrolment, compliance and update enforcement.
Yours to keep
A written report and prioritised fix list, walked through on a call, so your team understands each recommendation.
You will know what you use, which licences match real devices and what needs fixing before you commit. Jamf for Mac and Jamf for Mobile plans are Jamf Cloud only, which matters if you host Jamf Pro yourself. See Jamf licensing.
When the person who built Jamf Pro leaves, a review shows what they set up, why, and who now owns the certificates and tokens.
From macOS 26, iOS 26 and iPadOS 26, organisation-owned devices can move to a new management service without being erased. A health check shows what needs tidying first. See migrating to Jamf Pro.
Jamf also runs its own Health Checks, delivered by Jamf Professional Services engineers. As a Jamf partner we can arrange one for you, and help you act on the findings afterwards. Jamf offers three levels.
A focused check of a standard Jamf Pro deployment.
Everything in the Jamf Pro Health Check, with deeper analysis for larger or more complex environments.
A dedicated review of your security configuration, compliance and protection.
Source: Jamf Health Check brochure, 2026. These Health Checks are delivered by Jamf, not by Postremo IT.
The report is yours, whether or not we carry out the work. Many teams fix the quick wins themselves. For the rest, we can deliver the changes as a project, work alongside your team through co-managed IT, or run your Apple devices day to day through Mac IT support.
Two examples from our case studies show what follows. For a global trading company with around 1,000 Macs, update compliance rose from 65% to 98% in four weeks after updates moved to declarative management in Jamf. For a global consumer brand, we rebuilt the Jamf Pro design document from a live configuration pull, so it matched what was really configured.
Can’t see your question? Call us on +44 20 7550 9103 or book a call.
It is an independent, read-only review of your Jamf Pro instance. We check certificates and tokens, enrolment, policies, profiles, security, updates, identity and licences, then give you a written report and a prioritised fix list.
No. It is a read-only review of your Jamf Pro instance, so nothing changes for your users while we look. Any changes are agreed with you afterwards and scheduled separately. Your team can make them, we can make them as a project, or we can take them on as part of a managed Apple service.
Yes. Jamf runs its own Health Checks, delivered by Jamf engineers: a 4-hour Jamf Pro Health Check, a 12-hour Extended Health Check and an 8-hour Jamf Security Health Check. As a Jamf partner we can arrange one, and help you act on the findings.
The health check is quoted before we start, based on the size and complexity of your instance, so you know the cost before any work begins. The quote covers the read-only review, the written report and the prioritised fix list, walked through on a call. If you want help with the fixes, we quote for them separately.
Yes, as a project, alongside your team, or as part of our managed Apple service. The report is yours either way, and there is no obligation to use us.
Yes. Where you use them, we review Jamf Protect as part of security baselines, and Jamf Connect or Platform SSO as part of identity and compliance. That includes checking that Jamf Protect is deployed and reporting, and that Mac sign-in with Microsoft Entra ID works for new and existing users.
Yes. Our free Jamf Pro checklist covers the twelve areas we review. Book a health check when you want an independent view, written findings and a fix list.
Tell us about your devices, your Jamf Pro set-up and anything coming up, such as a renewal or audit. We will confirm the scope and the cost.
London head office
Postremo IT Limited
Level 24, One Canada Square
Canary Wharf
London E14 5AB
+44 20 7550 9103
info@postremoit.com
Also in Dubai
Business Bay, Dubai
Your brief: