Jamf Account News

Jamf Account Roles and Privileges Enhancements

On July 31, 2025, some exciting enhancements are coming to Jamf Account to provide administrators with more control over sensitive actions and focus user access to only what they need. These changes are occurring only in Jamf Account and do not impact in-product functionality. The current permissions admins have granted users will remain the same through this transition. Their system role name will change, but access to information or actions that they currently have will not. In order for administrators to restrict access to things like Activation Codes or Upgrades that were not previously possible, please login to Jamf Account. These enhancements include:

• System roles will be expanded in Jamf Account extending Administrator control including the ability to create and assign custom roles to users or IdP groups.
• Privileges will provide more granularity about what can be updated and by whom in Jamf Account.
• Enhancements to Jamf ID allowing organizations to have more control over the Jamf IDs for their organization.
• Additional Notes regarding MSP privileges that supersede these new privileges.

System Roles

There will be five pre-set system roles in Jamf Account.

Administrator

Administrators have full access to every privilege and feature in Jamf Account. Administrators assign system roles to users or IdP groups. They can also create and set customized roles per user or per IdP group. Administrators can also choose what privileges are assigned to those roles.

Solutions Administrator

Solutions Administrators can access to the Solutions pages in Jamf Account with the ability to make changes and view activation codes, Jamf Connect license files and cloud upgrades.

Solutions Viewer

The Solutions Viewer has access to the Solutions pages in Jamf Account to view only. This role will not be able to access sensitive info like activation codes, Jamf Connect license files and cloud upgrades.

Organization Administrator

Organization Administrators have access to edit all users, contacts, and SSO settings on the organization.

Organization Viewer

The Organization Viewer has access to view all users, contacts, and SSO settings on the organization.

Privileges

Where roles are assigned to users or IdP groups, privileges are only assigned to a role. Administrators can also choose what privileges are assigned to roles. Below are the new core privileges and what each allows access to in Jamf Account:

• View Jamf Pro: View all current Jamf Pro tabs
• Edit Jamf Pro: View and sync Jamf Pro activation codes in Jamf Account
• Upgrade Jamf Pro: View and click the "Upgrade" button in Jamf Account for a Jamf Pro instance
• View Jamf Protect: View all current Jamf Protect tabs
• Edit Jamf Protect: Spin up Jamf Protect instances
• View Jamf Connect: View all current Jamf Connect tabs
• Edit Jamf Connect: View and download Jamf Connect license file
• View Jamf School:
  • View all current Jamf School tabs
  • View Jamf Safe Internet tabs
• View JETP: View JETP Card
• View Jamf Now: View Jamf Now Card
• View Add-ons: View and download Jamf Add-ons
• View Contacts: View the ‘Team Members’ tab (will be to be re-named ‘Contacts’)
• Edit Contacts: Add, remove or edit contacts
• View Users: View Jamf IDs or IdP users on your organization
• Edit Users:
  • Add Jamf IDs to your org
  • Create roles
  • Assign roles
  • Deactivate Jamf IDs on your organization
• Edit Profiles: Restricts Jamf IDs from being removed from an organization
• View SSO: View IdP configurations
• Edit SSO: Edit IdP configurations
• View Company:
  • View Customer Data Requests (CDRs)
  • View Activity History
• Edit Company:
  • Submit Customer Data Requests (CDRs)
  • Sign Org Agreements
  • Assign emails for things such as privacy notices
• View Roles: View roles and privileges on your organization
• Edit Roles: Edit roles and privileges on your organization
• Enroll Feedback Programs: View and enroll in pre-release programs
• View Training: View the team training tab and organization training passes
• Edit Training: Assign users to organization training passes

Jamf ID

Additionally, we will be updating Jamf ID to provide organizations more control over the Jamf IDs within their organization. Jamf ID is the default identity provider for accessing Jamf products and services, creating a single sign-on experience that requires no integration and set-up. Jamf ID is an alternative to using your own identity provider, ideal for situations where you'd want a simple log-in experience or to get up and running with Jamf products fast. Administrators and Organization Administrators will be able to manage the following for Jamf ID:

• Add new Jamf IDs directly to their organization
• Deactivate Jamf IDs on their organization
• Disable Jamf ID sign in for all first-party Jamf applications at their verified domain

Additional Notes

• Additional SSO improvements have been added over the past few months
• There is no change to the MSP privilege. Currently, MSP privileges supersede any of these new privileges, allowing them to continue to see and manage all products and solutions for their child accounts

Questions? Contact Support within Jamf Account via the "Contact Support" link.