Manage your Apple fleet as code with Jamf and Terraform

If your team has already moved networking, cloud resources, and CI/CD pipelines to infrastructure as code (IaC), there's a good chance someone has asked the obvious next question: "What about endpoint management?"

It's a fair question. If you’re team already uses Git-backed, peer-reviewed, fully auditable infrastructure, managing endpoint management with IaC closes the gaps in your controls — with no manual intervention in the console required.

IaC looks different for different organizations. Many choose Terraform because it offers:

• A declarative plan you can review and diff before anything changes
• Real state tracking so you know exactly what's deployed
• A provider model that lets one toolchain manage many systems the same way.

Terraform goes beyond YAML files in your Git repo, or a CLI wrapper that shells out to an API. With Terraform, teams declare the end state of their fleet, and their tech stack ensures devices meet those standards without manual intervention. It’s a valuable tool; it makes your management more efficient, scalable and auditable.

Managing your Jamf environment with IaC

To get the most out of it, your IaC endpoint management needs a deep understanding of how to get endpoints in their declared, compliant state. For your Mac fleet, that means a platform that can handle the unique attributes of Apple devices and comprehensively covers both management and security.

Jamf fully supports infrastructure as code with:

• Jamf-owned Terraform providers than span the entire Jamf platform
• A unified API layer for automation and platform-wide support, the Platform API Gateway
• Open documentation

Define your Jamf configurations in code, review them like any other pull request, and deploy them through a controlled pipeline. Teams running this way already benefit from:

• Peer-reviewed changes. Nothing reaches production without review, cutting the risk of a fat-fingered policy taking down a fleet.
• A real audit trail. Every change is a Git commit with a timestamp and an author. No more guessing who changed what, or when.
• Repeatable instance builds. Configure a new Jamf Pro instance with a known baseline in minutes, not days.
• Consistent multi-tenant management. Push the same configuration across every Jamf instance you manage from a single codebase.
• One-command rollback. If a change causes problems, reverting is a Git operation, not a support ticket.

Jamf's Terraform provider ecosystem

Jamf's Terraform coverage spans the Jamf platform:

Jamf Platform provider

• Ownership: Jamf-owned, strategic direction
• What it manages: Blueprints, compliance benchmarks, device groups, Jamf Security Cloud, AI governance, Jamf Account surfaces, plus the full Jamf Pro surface

Jamf Pro provider

• Ownership: Community-maintained
• What it manages: Policies, profiles, scripts, Smart Groups, prestages, and hundreds of other resources

Jamf Protect provider

• Ownership: Jamf-owned
• What it manages: Endpoint security plans, threat prevention, telemetry, device control, access management

Jamf Security Cloud provider

• Ownership: Jamf-owned
• What it manages: Network resources, access policies, SwiftConnect configuration

Jamf School provider

• Ownership: Jamf-owned
• What it manages: Users, user groups, device groups, classes, iBeacon regions

Jamf's Terraform providers manage the entire product surface, not just the infrastructure a management platform happens to run on. Some IaC tooling in this space stops at deploying the server; ours reaches all the way into the environment you're actually managing.

Further reading: Managing Jamf Configuration with Terraform and GitOps Workflows

Unsure where to start?

Jamf Platform: Jamf-owned and covering the full Jamf surface, this is a good place to start for new IaC work.

Jamf Pro: If your team is already deep in this community-maintained provider, it’s reasonable to stay here for now. If you start hitting limits of this provider or want support, maintenance, a roadmap or other information from Jamf, consider migrating to Jamf Platform.

Beyond Terraform, two Jamf-owned tools make your IaC configuration more efficient:

• jamformer connects to an existing Jamf instance and generates a Terraform project from it: a fast way to get an environment under version control instead of writing configuration from scratch.
• jamf-cli is a command-line tool for exploring the API, exporting configuration, and scripting the tasks that don't belong in Terraform state. It spans Jamf Pro, Jamf Protect, Jamf School, Jamf Security Cloud and Jamf Platform,

The Platform API Gateway: one foundation underneath it all

Terraform providers are the interface your team writes code against. Underneath them, every one of those providers, Jamf-owned or community, ultimately talks to Jamf's APIs. That's where the  Platform API Gateway comes in.

The Platform API Gateway is Jamf's unified API infrastructure: a single endpoint and authentication model covering both Platform APIs and product APIs across Jamf Pro, Jamf Protect, Jamf School and Jamf Security Cloud. Instead of managing separate credentials per product, your team creates API clients in Jamf Account with least-privilege scoping, and uses them across your entire automation stack, Terraform included.

For a DevOps team building serious IaC pipelines, that matters in a few concrete ways:

• One credential model, not five. A single client can carry scoped access across the platform instead of juggling separate logins per product console.
• Least-privilege by default. Every credential is scoped to only what it needs, which matters when that credential lives in a CI/CD pipeline.
• A foundation built to scale. As Jamf's Terraform coverage and platform APIs grow, they're built on the same access model your team already knows, so there's no re-architecting your automation every time coverage expands.

This is the plumbing that makes "Jamf as code" possible beyond just Terraform syntax, and it's a big part of why we can say, plainly, that Jamf fully supports infrastructure as code as a first-class way to run your environment.

Built for the team that's already standardized on code

None of this is about forcing every Jamf admin into a DevOps workflow. Plenty of teams manage Apple devices successfully through the console, and that's not going away. IaC is a fit for organizations that already have the team and the practices to support it: version control discipline, a DevOps-capable admin, and a real need to manage complexity at scale, not manual work for its own sake.

If that's your team, the message is simple: Jamf fully supports infrastructure as code today, with Terraform providers across the platform, a unified API foundation built for automation, and documentation that gets you from zero to a running pipeline.

Get started today

Jamf Protect provider guide

Jamf Platform provider guide

Learn about our Platform APIs and the Platform API Gateway