Jamf Toolkit

Overview

An open collection of the scripts, Extension Attributes, and configuration profiles I actually run against managed Mac fleets. Everything here came out of production work across fleets ranging from 300 to 2,800+ endpoints, and is written to prioritize safety, reliability, and clear logging over cleverness.

Problem

Fleet automation tends to live as untracked snippets pasted into the Jamf console — no version history, no peer review, and no way to reuse a solved problem on the next fleet. The useful patterns stay locked in one admin’s head.

Approach

Pulled the recurring workflows out of the console and into a version-controlled repository, organized by how Jamf actually consumes them: Scripts/ for policy-attached scripts, ExtensionAttributes/ for inventory collection, ConfigProfiles/ for managed preferences, and HelpfulNotes/ for the operational context that usually goes undocumented.

Each tool sits in its own folder with a README beside the code, covering what it does, its Jamf parameters, and the deployment details worth knowing before you scope it. Documentation next to the thing it documents survives; documentation in a single root file goes stale the moment the repo grows.

Architecture

Featured scripts. ForcePlatformSSO detects Macs that never completed Platform SSO registration and re-prompts the user through swiftDialog, closing the enrollment gap Apple’s user-initiated flow leaves behind — deployed to production across a 300-device fleet against Microsoft Entra ID, and validated against Okta in a developer tenant. RestartMac escalates restart pressure on uptime: silent under seven days, deferrable through thirteen, a ten-minute countdown at fourteen. FirefoxLatest, GoogleChromeLatest, and Office365Latest install current releases straight from the vendor CDN, removing the need to maintain packaged installers.

Extension Attributes and profiles. SecureTokenUsers reports which accounts can actually unlock a FileVault volume — the state FileVault depends on and standard inventory does not expose. AppAutoPatchStatus reads App Auto-Patch receipts and reports per-title results split into successes and failures. VSCodeEnterpriseRestrictions enforces an approved VS Code extension allowlist through managed preferences.

Controls paired with their evidence. Several tools are built as pairs — a control that enforces something, and an Extension Attribute that proves it is working on a given device. The privilege elevation profile collects a justification; a matching attribute surfaces those justifications into inventory. The VS Code allowlist denies extensions; a matching attribute reports what is actually installed. “The profile is scoped” and “the thing is happening on this endpoint” are different claims, and only the second is evidence.

Scripts run as root via the Jamf binary and are deployed the standard way: added to Jamf Pro, scoped to a smart group, triggered at check-in, enrollment, or through Self Service, and piloted before fleet-wide rollout. Scripts taking Jamf parameters ($4–$11) document them at the top of the file.

Outcome

A reusable, peer-reviewable base of fleet automation that carries between environments instead of being rebuilt per employer, and a public reference for the Platform SSO enrollment gap that most fleets hit silently.

Lessons Learned

The Platform SSO script is the clearest example of why this repo exists: Apple’s user-initiated registration flow fails quietly, so a fleet looks fully enrolled while a meaningful share of devices never registered. Detection had to come before remediation — you cannot fix an enrollment gap you have no visibility into.