Extension Attribute: Surfacing Why People Took Admin

Overview

An extension attribute that reads Jamf Connect’s privilege elevation log on each Mac and reports the five most recent justifications into Jamf Pro inventory. It’s the reporting half of the time-boxed admin rights profile — the profile collects the reasons, this makes them visible.

The problem

Configure UserPromotionReason and Jamf Connect starts requiring a justification before it grants admin. Good. It writes each one to a log:

/Library/Logs/JamfConnect/UserElevationReasons.log

And that’s where it stops. The log is local to each machine. It’s an audit trail scattered across every endpoint in the fleet, readable only by going to the device — which means for any question worth asking across a fleet, it may as well not exist.

You’ve collected the data and gained nothing, because collection isn’t visibility.

What it does

reasonLog="/Library/Logs/JamfConnect/UserElevationReasons.log"

if [[ -f "$reasonLog" ]]; then
    reasons=$(/usr/bin/tail -n 5 "$reasonLog")
else
    reasons="No Jamf Connect privilege elevation reasons found"
fi

Read the log, take the last five entries, hand them back in the <result> block Jamf expects. Runs on every inventory check-in.

Three small decisions carry it:

Last five, not the whole file. Extension attributes go into every inventory record for every device, forever. Unbounded output makes recon payloads heavy and the field unreadable. Five is enough for recent-behavior review, which is the actual use case — anything older belongs in a real log pipeline.

An explicit message when the file is missing, not an empty result. A device with no elevations and a device where the profile never landed are different situations, and an empty string can’t tell you which one you’re looking at. That distinction is the difference between “nobody needed admin” and “your control isn’t deployed.”

No filtering or parsing of the reason text. Whatever the user typed is what gets reported. Cleaning it up would only hide the users writing “asdf,” and those are exactly the ones worth seeing.

What it unlocks

Once it’s a field on the inventory record, it’s a smart group criterion and a search term. You can find devices elevating unusually often, spot justifications that are obviously nonsense, and see whether one team is elevating constantly — which usually means something they need is missing from Self Service and the real fix isn’t a policy conversation at all.

Outcome

Elevation justifications became searchable across the fleet instead of sitting in a local file nobody was ever going to read. The control and its evidence live in the same console.

Lessons Learned

Collecting audit data and having audit visibility are different projects, and the second one rarely happens on its own. Jamf Connect did the hard part — capturing intent at the moment of elevation — and then wrote it somewhere nobody would look. A thirteen-line extension attribute was the entire distance between a compliance checkbox and a control anyone actually uses.