Jamf Compliance Bridge

Overview

Identity providers make the access decisions, but Jamf is what actually knows whether a Mac is healthy. This bridge connects the two: it reads compliant devices out of a Jamf smart group, resolves them to users, and reconciles the membership of a target Okta or Entra ID group so access policies follow live device posture.

Problem

A Conditional Access policy can only gate on what the identity provider knows. Jamf holds the real compliance signal — FileVault state, OS version, last check-in — but that signal stops at the Jamf console. Jamf’s native connectors cover the common cases, but they don’t help when you need one compliance signal spanning multiple IdPs, gating on custom smart group logic, or running in an environment that isn’t using the Intune connector.

Approach

Built a provider-agnostic reconciler that runs in three phases: read the Jamf smart group and map each device to its assigned user’s email from inventory, pull the current membership of the target IdP group, then compute and apply the adds and removes needed to make them match. A mapping file ties Jamf groups to IdP groups, so a single Jamf group can drive both an Okta and an Entra group at once.

Architecture

sync.py drives the run against a mapping file. The bridge/ package holds a provider interface with Okta and Entra implementations behind it, so adding another IdP means adding one adapter rather than touching reconciliation logic. Reconciliation is idempotent — running twice changes nothing the second time — and the tool is dry-run by default, printing the adds and removes it would make until --apply is passed. Credentials load from environment or a gitignored .env; nothing sensitive lives in code.

Outcome

A scheduled, version-controlled compliance gate that works across both major identity providers, with every decision visible in a diff instead of hidden behind a console toggle.

Lessons Learned

Dry-run by default is what makes a group-membership tool safe to hand to someone else. A reconciler that silently removes the wrong users on its first run never gets a second one — printing the plan first turns an irreversible action into a reviewable one.