KeySkopeAvailable · Reviewed 2026-09-18
Before you start
- Jamf Pro with API Roles and Clients support.
- An administrator who can create a dedicated API role and client.
Read-only permissions
| Setting | Purpose / value |
|---|---|
| Read Accounts | Read console accounts. For Classic API endpoints, verify the mapping to Read – Jamf Pro User Accounts & Groups in your version. |
Connect Jamf Pro
- Open Settings → System → API roles and clients and create an API role named KeySkope read-only.
- Grant the account-reading privilege required for GET /JSSResource/accounts and GET /JSSResource/accounts/userid/{id}. Do not add create, update, delete or device-management privileges.
- Create an API Client, assign the read-only role, enable the client and save.
- Generate a client secret and store its value securely with the client ID.
- Enter the Jamf Pro HTTPS URL, client ID and secret in KeySkope. Run a sync and compare a console account’s access level.
Connection fields
| Setting | Purpose / value |
|---|---|
| url | Your Jamf Pro server URL. |
| client_id / client_secret | Enabled API Client assigned to the read-only account role. |
What appears in KeySkope
- Jamf Pro console accounts and access levels. Devices and inventory are outside this connector’s scope.
- The account endpoints used here do not supply console login timestamps. Last activity remains unavailable.
Verify the first sync
- Wait for the sync to finish and review its status and any partial-collection notes.
- Compare the same account population in both systems. Check an account identifier, status and assigned role—not just the total.
- For a controlled test account, change its access in the source, sync again and verify the result. Keep approvals in your normal process.
- Record the credential owner and expiry. Rotate the credential in the source, update KeySkope and verify another sync before retiring the old credential.
Troubleshooting
| Setting | Purpose / value |
|---|---|
| 401 | Check the enabled client and current secret. |
| 403 | Check the account-read privilege mapping for your Jamf version. Device read privileges do not substitute for console account access. |
Official references
Vendor documentation reviewed on 2026-09-18. Setup has been checked against the connector implementation. A documentation review is not a live validation of every plan or tenant.
Ready to connect?
Open Connectors in your KeySkope workspace. Enter credentials only in the authenticated connection form.
Use your organisation’s dedicated KeySkope URL from an allowed network. Your workspace administrator can provide the address.