Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

JAMF Pro Integration

Follow these steps to create your client ID and secret on JAMF Pro, link your JAMF Pro account to your HPE Mist Networking organization, and verify the integration.

Mist Access Assurance allows you to integrate natively into JAMF Pro Endpoint Management platform for checking managed endpoint compliance state.

JAMF evaluates JAMF managed devices (MacBook, iPad, iPhone and other iOS devices) for compliance. Evaluation is done using Smart Computer Groups for MACbooks and Smart Device Groups for iPads and iOS devices for presence of antivirus, firewall status, software version, and so on. Mist Access Assurance obtains the compliance state of the devices and leverages that state in authentication policy rules to perform posture assessment.

Figure 1: JAMF Evaluation of Managed Devices Diagram illustrating Mist Access Assurance workflow with JAMF Pro, showing device compliance evaluation, network authentication via EAP-TLS, and policy decisions using JAMF managed device info.

JAMF Device Data Retrieval

Mist Access Assurance retrieves JAMF managed device data in the following manner:

  • Access Assurance uses API-based polling mechanism toward JAMF every two hours for every managed client that has been previously authenticated. Compliance states information is cached for fast retrieval.

  • Information retrieval is performed out-of-band, that is, after the authentication process to avoid any additional delays. After initial device onboarding, information is updated every two hours.

  • In case device compliance status changes, then Mist Access Assurance automatically trigger a Change Of Authorization to re-run the policy and apply respective action.

  • HPE Mist Networking access points (APs), which connect JAMF managed devices to the wireless network, must have firmware version 0.14 or higher.

Mist Access Assurance uses the following information during client authentication to match a client with a device record in JAMF:

  • Non-randomized MAC address—This method can be used with EAP-TTLS or EAP-TLS authentication. Client MAC device is matched with a device MAC present in JAMF. For wireless profile, make sure MAC randomization or rotation is disabled.
    Note:

    iOS devices do not have native Ethernet NIC, so this method is only useful with iOS devices that are connected through wireless.

  • JAMF Device UDID encoded in SAN:DNS certificate attribute. Figure 2 shows location of UDID in configuration profile.
    Figure 2: Locating Unique Device ID SCEP Proxy configuration interface in Jamf Pro showing fields for Redistribution Profile, Subject, Subject Alternative Name Type dropdown, NT Principal Name, and an external Certificate Authority checkbox.

Create Client ID and Secret on the JAMF Pro

For integration with JAMF Pro, you need client ID and secret.
Note:

The screenshots from third-party applications are correct at the time of publishing. We have no way to know when or if the screenshots will be accurate at any future time. Please refer to the third-party website for guidance about changes to these screens or the workflows involved.
  1. In the JAMF Pro dashboard navigate to Settings > API roles and clients.
  2. Create a role for Mist Access Assurance connector and assign the permissions.
    Figure 3: Configuring API Roles and Clients User interface for creating a new API role with a display name field showing Mist AA as an example and links to Jamf Pro API documentation and Classic API documentation. Privileges like reading smart groups, users, devices, and computers are listed with options to remove each.
    Assign the following read-only permissions:
    • Read Computer Check-In
    • Read Mobile Devices
    • Read Computers
    • Read Mobile Device Inventory Collection
    • Read Static User Groups
    • Read Static Computer Groups
    • Read Mobile Device Self Service
    • Read Conditional Access
    • Read Smart Computer Groups
    • Read Computer Inventory Collection
    • Read Smart Mobile Device Groups
    • Read Smart User Groups
    • Read User
    • Read Webhooks
  3. Navigate to API Clients tab, and add a new client.
    Figure 4: Configure New API Client User interface for creating a new API client with fields for Display Name set to Mist AA Client, API Roles set to Mist AA, Access Token Lifetime set to 86400 seconds, and an option to disable the API client.
    Select the API role created in the previous step and set access token refresh time (example 24 hrs). Then click Enable/disable API Client to toggle it to Enable API Client.
  4. Save the details and click Generate client secret on the next page.
    Figure 5: Generate Client Secret Configuration page for API roles and clients showing Mist AA Client as the display name, Mist AA as the API role, access token lifetime set to 86400 seconds, unique Client ID, a Generate client secret button, and the API client enabled.

    The client secret is generated.

  5. Copy both Client ID and Secret and save it in safe place to retrieve later.
    Figure 6: Client Secret Details Save client secret dialog with warning to securely save the secret, shows client ID, partially blurred client secret, API token endpoint instructions, and buttons to copy credentials or close.

Link JAMF Pro Account to Mist Access Assurance

  1. From the left menu of the HPE Mist management portal, navigate to Organization > Access > Identity Providers.
  2. In the Identity Providers page, scroll down to Linked Account section and click Link Account to select JAMF Pro.
    Figure 7: Linking to JAMF Pro Account Dropdown menu titled Link Account with options: Microsoft Intune, Jamf Pro highlighted with cursor, VMware Workspace ONE UEM.
  3. In the Link Account pop-up window, enter the details. Figure 8 shows a sample of link account details.
    Figure 8: Details for Linking JAMF Pro Configuration screen for linking a Jamf Pro account with fields for Instance URL, Client ID, Client Secret, Smart Group Name CompliantGroup, and buttons for Link Account and Cancel.
    • Instance URL—JAMF Pro instance URL. Example: https://<yourjamfurl>.com.

      Remove any trailing / in the Instance URL field.

    • Client ID—Client ID generated while creating Client ID and Secret on the JAMF Pro dashboard.
    • Client Secret—Client secret generated while creating Client ID and Secret on the JAMF Pro dashboard.
    • Smart Group Name—Smart group name to match against. JAMF Pro allows you to create groups for managed computers, mobile devices, or users. Smart Groups (both computer and mobile device smart groups) offer dynamic rule based matching, which allows you to set policies such as running software, OS versions of your managed devices. In case a client is found in JAMF and is part of selected Smart Group then it is considered as MDM compliant.
      Note: During JAMF account linking, Access Assurance validates the Smart Group name only against Computer Smart Groups in JAMF Pro. Although JAMF supports Smart Groups for both computers and mobile devices, the Smart Group must exist under Computers to complete the linking. If only mobile devices are managed, create a Computer Smart Group with the same name (a dummy group is sufficient).

After linking is complete, you can see last sync status and time as shown in Figure 9.

Figure 9: JAMP Pro Sync Status Jamf Pro interface showing synchronization details: Last Sync June 27, 2024 10:08:53 AM, Last Status Success, Account ID 23027b3c-8166-4381-93ed-e30339274064, Linked By vdementyev@juniper.net, Company Name same as Account ID, Linked Timestamp June 27, 2024 10:08:33 AM, Application Jamf Pro.

Verification

From the left menu of the HPE Mist management portal, select Monitoring > Insights > Client Events to see the information. Under Client Insights, you can see MDM lookups are performed for iOS managed devices as shown in Figure 10.

Figure 10: MDM Lookup Details Client Events dashboard showing network events categorized as Good, Neutral, or Bad with timestamps. Detailed event info includes AP BRQLAB-AP2, MAC Address cc:08:fa:a0:50:8f, User Name slava, MDM Provider jamf, Compliance Status compliant, Last Check Time Jun 27, 2024, 12:27:17 AM, Provider ID 23027b3c-8166-4381-93ed-e0339274064, Port Type wireless. Some details highlighted with red circles.

Note that during initial MDM lookup for a new client, lookup is performed post initial authentication. After MDM state changes, Mist Access Assurance initiates CoA to re-authenticate the client and apply the correct policy. Upon subsequent authentications, NAC uses MDM cache which is updated periodically to reflect any changes for every 2 hours. Figure 11 shows a sample of compliance status change.

Figure 11: MDM Lookup Details- MDM Status Change Dashboard showing client events summary: 103 events categorized as 86 good, 3 neutral, 14 bad. Event details include timestamps, descriptions, and statuses color-coded green for success, red for failure, blue for changes. Selected event details display MAC address, compliance status change, MDM provider jamf, compliance status compliant, previous status unknown, check time Jun 27 2024, port type wireless.

See Also