Platform Workflows

Platform Workflows

Copy-paste recipes for Platform API administration. Needs platform gateway authentication (jamf-cli platform setup); see Setup Guide#Jamf Pro Quick Start: Platform Gateway (Recommended). For command details, see Platform API Commands. For shared patterns (apply, scaffold, export), see CLI Patterns.

Post-GA setup. The gateway base URL is https://{region}.api.jamfcloud.com, public-beta credentials were revoked at GA, and a profile is scoped at one of three levels. Prefer --environment-id / JAMF_ENVIRONMENT_ID over the legacy --tenant-id. See Platform API GA Migration.

AI Governance, Jamf Account and platform audit live in the top-level platform namespace. Recipes for those are in Jamf Platform Commands.

Most writes below accept -n, --dry-run, which prints the method, the resolved path and the request body to stderr and sends nothing. The preview comes before any confirmation prompt, so -n works under --no-input on destructive commands too:

jamf-cli pro blueprints delete --name "Retired Baseline" -n --no-input
# [dry-run] DELETE /blueprints/v1/blueprints/8f3c...

The three hand-written upserts have no preview of their own, so -n refuses them (blueprints apply, compliance-benchmarks apply and platform-device-groups apply, verified 2026-09-11):

412 [DRY_RUN] refused POST /blueprints/v1/blueprints: --dry-run is set and this
command has no preview mode. Re-run without -n to apply.

Exit 1, and nothing is sent. deploy, undeploy, delete and every generated Platform write print a preview.

Blueprint Management

# List all blueprints (an empty tenant prints [], never null, so it is safe to pipe to jq)
jamf-cli pro blueprints list

# Create a blueprint from a JSON or YAML file
jamf-cli pro blueprints apply --from-file blueprint.json

# Generate a scaffold template, edit, then create
jamf-cli pro blueprints apply --scaffold > blueprint.json
# ... edit blueprint.json ...
jamf-cli pro blueprints apply --from-file blueprint.json

# Deploy a blueprint to its target groups
# (Platform commands take a positional <id>; use --name to look up by name)
jamf-cli pro blueprints deploy --name "macOS Standard"

# Check deployment status
jamf-cli pro blueprints report --name "macOS Standard"

# Undeploy (remove from devices)
jamf-cli pro blueprints undeploy --name "macOS Standard"

# Clone a blueprint for testing (clone is the exception: names positionally)
jamf-cli pro blueprints clone "macOS Standard" "macOS Standard - Staging"

# Export / import round-trip
jamf-cli pro blueprints export --name "macOS Standard" -o yaml > bp.yaml
# ... edit, transfer to another tenant ...
jamf-cli pro blueprints apply --from-file bp.yaml --yes

The round trip above needs a v1.31.1 export. Earlier releases wrote a configuration shape apply cannot read back, so a YAML file from one of them fails. -o json was correct throughout. apply refuses the older file and tells you to re-export it. See Platform API Commands.

Import a Classic Configuration Profile as a Blueprint

import-profile turns a legacy mobileconfig into a native DDM blueprint: it converts compatible payloads to native DDM components and wraps the rest in a configuration-profile component.

# Import a macOS config profile, converting compatible DDM payloads
jamf-cli pro blueprints import-profile "Passcode Policy"

# Import and strip Apple defaults (reduces noise from UI-generated profiles)
jamf-cli pro blueprints import-profile "My Restrictions" --strip-defaults

# Import a mobile device profile
jamf-cli pro blueprints import-profile "MDM Restrictions" --type mobile

# Skip DDM conversion and wrap all payloads as a legacy configuration-profile component
jamf-cli pro blueprints import-profile "My Restrictions" --legacy

# Override the blueprint name
jamf-cli pro blueprints import-profile "FileVault Settings" --blueprint-name "FileVault Blueprint"

# Set the blueprint scope; required when the profile is scoped to no device group
jamf-cli pro blueprints import-profile "Software Update" --computer-group "All Managed Macs"

# Target a specific profile by Classic API ID when display names collide
jamf-cli pro blueprints import-profile 42

Three things to expect:

• A blueprint needs at least one device group. A profile whose scope resolves to none (all computers, individual devices, buildings, or departments) fails with an error naming the problem; set the scope with --computer-group / --mobile-device-group, both repeatable.
• Display names are not unique in Jamf Pro, so a digits-only positional argument is read as a Classic API ID (use --name for a profile named "2024"). An ambiguous name prompts you to pick; under --no-input it errors with the matching IDs. components configuration-profile takes --id for the same job.
• A payload type the blueprints API does not accept standalone (com.apple.MCX, com.apple.Safari, com.apple.SoftwareUpdate, com.apple.Terminal, third-party preference domains, and ~35 others) is delivered as Application & Custom Settings (MCX), so no settings are lost. import-profile also skips the payload types blueprints hard-disables, with a warning; --include-unsupported sends them and the API rejects them. See Platform API Commands#Payload type delivery.

Blueprint Component Scaffolds

DDM component JSON scaffolds are available offline, with no API call:

# List all available DDM component types
jamf-cli pro blueprints components list

# Print the configuration JSON scaffold for a component (no auth required)
jamf-cli pro blueprints components scaffold passcode-settings
jamf-cli pro blueprints components scaffold software-update-settings
jamf-cli pro blueprints components scaffold com.jamf.ddm.safari-settings

# Convert a local .mobileconfig to a configuration-profile component
jamf-cli pro blueprints components configuration-profile --from-file profile.mobileconfig

# Download and convert a profile from Jamf Pro by ID or name
jamf-cli pro blueprints components configuration-profile --id 42
jamf-cli pro blueprints components configuration-profile --name "Firewall Settings"
jamf-cli pro blueprints components configuration-profile --name "Managed Restrictions" --type mobile

# Strip Apple-default keys before converting (fetches schemas from GitHub)
jamf-cli pro blueprints components configuration-profile --from-file profile.mobileconfig --strip-defaults

# Convert a raw preference-domain plist (no Apple payload metadata)
jamf-cli pro blueprints components configuration-profile-plist \
  --from-file com.apple.dock.plist --payload-type com.apple.dock

Compliance Benchmarks

Create benchmarks from baselines, monitor compliance, and drill into per-device results.

# List available mSCP baselines (the starting points)
jamf-cli pro baselines list

# Create a benchmark from a baseline
jamf-cli pro compliance-benchmarks apply --from-file benchmark.json

# List benchmarks to find the benchmark ID
jamf-cli pro compliance-benchmarks list

# Per-rule compliance stats for a benchmark (by ID, or by title with --name)
jamf-cli pro benchmark-reports rules <benchmark-id>
jamf-cli pro benchmark-reports rules --name "CIS macOS 15"

# Drill into devices for a specific rule
jamf-cli pro benchmark-reports devices <benchmark-id> --rule-id <rule-id>

# Overall compliance percentage
jamf-cli pro benchmark-reports compliance-percentage --name "CIS macOS 15"

Scaffold from Baseline

# List baselines to find the baseline ID (they are slugs, such as cis_lvl1)
jamf-cli pro baselines list

# Generate a scaffold pre-populated with all rules from that baseline
jamf-cli pro compliance-benchmarks apply --scaffold-from-baseline "<baseline-id>"

# Edit the scaffold and create
jamf-cli pro compliance-benchmarks apply --scaffold-from-baseline "<baseline-id>" > benchmark.json
# ... edit benchmark.json (title, target groups, rule settings) ...
jamf-cli pro compliance-benchmarks apply --from-file benchmark.json

Export and Clone Benchmarks

Benchmarks are portable across tenants, because export replaces device group IDs with names.

# Export a benchmark as portable YAML (group IDs replaced with names)
jamf-cli pro compliance-benchmarks export "CIS macOS 15" -o yaml > cis-benchmark.yaml

# Apply to another tenant (names are resolved to IDs for you)
jamf-cli pro compliance-benchmarks apply --from-file cis-benchmark.yaml -p staging-platform

# Clone a benchmark with a new title (copies all rules and configuration)
jamf-cli pro compliance-benchmarks clone "CIS macOS 15" "CIS macOS 15 - Staging"

# Clone and point to different target device groups
jamf-cli pro compliance-benchmarks clone "CIS macOS 15" "CIS macOS 15 - Test" \
  --computer-group "Test Devices"

apply is create-only on benchmarks: to change one, export it, delete it, edit the file and re-apply.

DDM Declaration Reports

# Declaration report for one device (by device ID). --filter is required
jamf-cli pro ddm-reports device declarations <device-id> --filter 'active==true'

# Devices reporting a specific declaration. --filter is required
jamf-cli pro ddm-reports declaration devices "com.apple.configuration.passcode" --filter 'active==true'

# Devices with failures, and their error reasons
jamf-cli pro ddm-reports errors "com.apple.configuration.passcode"

Note: device declarations and declaration devices require --filter (RSQL). Without it cobra refuses the call before anything is sent: required flag(s) "filter" not set, exit 2. Use --filter 'validityState=="INVALID"' for the failing declarations, or --filter 'active=in=(true,false)' as the tautology that stands in for an unfiltered read. See Platform API Commands#DDM Reports (ddm) for the allowed filter fields.

declaration get and device get are removed. Rewrite declaration get <id> as declaration devices <id> --filter … and device get <id> as device declarations <id> --filter …. Both successors take --page (0-based) and --size:

for page in 0 1 2; do
  jamf-cli pro ddm-reports declaration devices "com.apple.configuration.passcode" \
    --filter 'active=in=(true,false)' --page $page --size 200 -o json
done

Platform Reports and Audit

These work alongside the existing Pro reports and aggregate in multi mode.

# Blueprint deployment overview
jamf-cli pro report blueprint-status

# Compliance rule breakdown
jamf-cli pro report compliance-rules "CIS macOS 15"

# Non-compliant devices
jamf-cli pro report compliance-devices "CIS macOS 15"

# DDM declaration health
jamf-cli pro report ddm-status

# Full audit with platform checks
jamf-cli pro audit

# Only platform checks
jamf-cli pro audit --checks platform