Mobile Device Configuration Profiles

Mobile device configuration profiles are XML files (.mobileconfig) that provide an easy way to define settings and restrictions for mobile devices.

Jamf Pro can be used to deploy mobile device configuration profiles to the following types of mobile devices:

  • iPads, iPhones, or iPod touches with iOS 4 or later

  • Apple TV devices with Apple TV software based on iOS 7 or later, or Apple TV devices with tvOS 10.2 or later

A configuration profile will deploy containing both the iOS and tvOS selected options to all devices in scope. Devices will ignore the options that do not pertain to their device type.

For detailed information on payload capabilities for iOS and tvOS devices, see Payload Capabilities for Mobile Device Configuration Profiles.

You can use Jamf Pro to manually create a mobile device configuration profile or upload a configuration profile that was created using Apple’s tools.

Before creating a configuration profile, you should have basic knowledge of configuration profile payloads and settings, and how they affect mobile devices. For detailed information about each payload and setting, see Apple’s Profile Manager documentation at:

https://help.apple.com/profilemanager/mac

Some configuration profile settings are unique to Jamf Pro. For more information on these settings, see the following Knowledge Base article:

Configuration Profiles Reference

There are two different ways to distribute a configuration profile to an iOS device—install it automatically (requires no interaction from the user) or make it available in Self Service. For tvOS devices, configuration profiles must be distributed by installing automatically. You can also specify the mobile devices and users to which the profile should be applied (called “scope”).

Note: Mobile device configuration profiles cannot be distributed to personally owned mobile devices.

Payload Variables for Mobile Device Configuration Profiles

There are several payload variables that you can use to populate settings in a mobile device configuration profile with attribute values stored in Jamf Pro. This allows you to create payloads containing information about each mobile device and user to which you are distributing the profile.

To use a payload variable, enter the variable into any text field when creating a profile in Jamf Pro. When the profile is installed on a mobile device, the variable is replaced with the value of the corresponding attribute in Jamf Pro.

Variable

Mobile Device Information

$DEVICENAME

Mobile Device Name

$ASSET_TAG

Asset Tag

$SITENAME

Site Name

$SITEID

Site ID

$SERIALNUMBER

Serial Number

$UDID

UDID

$USERNAME

Username

$FULLNAME or $REALNAME

Full Name

$EMAIL

Email Address

$PHONE

Phone Number

$ROOM

Room

$POSITION

Position

$DEPARTMENTNAME

Department Name

$DEPARTMENTID

Department ID

$BUILDINGNAME

Building Name

$BUILDINGID

Building ID

$MACADDRESS

MAC Address

$JSSID

Jamf Pro ID

$PROFILEJSSID

Jamf Pro ID of the Configuration Profile

Note: An $EXTENSIONATTRIBUTE_<#> variable is generated each time you create an extension attribute with the "LDAP Attribute Mapping" input type. For more information, see Mobile Device Extension Attribute Input Types.

Manually Creating a Mobile Device Configuration Profile

  1. Log in to Jamf Pro.

  2. Click Devices at the top of the page.

  3. Click Configuration Profiles.

  4. Click New images/download/thumbnails/16440139/Icon_New_Button.png .

  5. Use the General payload to configure basic settings for the profile, including a distribution method.

  6. If you chose to make the profile available in Self Service, do the following:

    1. Choose a Security setting.

    2. Click the Self Service tab, and specify an icon to display in Self Service.

    3. Click the Options tab to continue configuring the profile.

  7. Use the rest of the payloads to configure the settings you want to apply.

  8. Click the Scope tab and configure the scope of the profile.
    For more information, see Scope.
    Note: For limitations or exclusions to be based on LDAP users or LDAP user groups, the Username field must be populated in the mobile device's inventory.

  9. Click Save.

The profile is distributed to mobile devices in the scope the next time they contact Jamf Pro.

Uploading a Mobile Device Configuration Profile

You can create a mobile device configuration profile by uploading a profile that was created using Apple’s tools.

Note: Some payloads and settings configured with Apple's tools are not displayed in Jamf Pro. Although you cannot view or edit these payloads, they are still applied to mobile devices.

  1. Log in to Jamf Pro.

  2. Click Devices at the top of the page.

  3. Click Configuration Profiles.

  4. Click Upload and upload the configuration profile (.mobileconfig).

  5. Use the General payload to configure basic settings for the profile, including a distribution method.

  6. If you chose to make the profile available in Self Service, do the following:

    1. Choose a Security setting.

    2. Click the Self Service tab, and specify an icon to display in Self Service.

    3. Click the Options tab to continue configuring the profile.

  7. Use the rest of the payloads to configure or edit settings as needed.

  8. Click the Scope tab and configure the scope of the profile.
    For more information, see Scope.
    Note: For limitations or exclusions to be based on LDAP users or LDAP user groups, the Username field must be populated in the mobile device's inventory.

  9. Click Save.

The profile is distributed to mobile devices in the scope the next time they contact Jamf Pro.

Downloading a Mobile Device Configuration Profile

If you want to view the contents of a mobile device configuration profile for troubleshooting purposes, you can download the profile (.mobileconfig) from Jamf Pro.

  1. Log in to Jamf Pro.

  2. Click Devices at the top of the page.

  3. Click Configuration Profiles.

  4. Click the configuration profile you want to download.

  5. Click Download.

The profile downloads immediately.

Viewing the Status of a Mobile Device Configuration Profile

For each mobile device configuration profile, you can view the number of mobile devices for which the profile installation has a status of Completed, Remaining, or Failed.

Note: Depending on your system configuration, some historical status data may not be available for profiles installed using Jamf Pro 9.63 or earlier.

  1. Log in to Jamf Pro.

  2. Click Devices at the top of the page.

  3. Click Configuration Profiles.
    A list of mobile device configuration profiles is displayed.
    For each profile, you can view the number of mobile devices for which the profile installation has a Completed, Remaining, or Failed status.
    Note: If a device becomes unmanaged after a profile is successfully distributed to it, the profile will continue to be displayed in the Completed column.

  4. To view a list of mobile devices for which the profile installation has a Completed, Remaining, or Failed status, click the number displayed in the corresponding column. Then click Done.

Viewing Logs for a Mobile Device Configuration Profile

The logs for a mobile device configuration profile include a list of mobile devices that are in the scope of the configuration profile, as well as the date/time the status was last updated and the status of the profile for each mobile device.

Note: Depending on your system configuration, some historical log data may not be available for profiles installed using 9.63 or earlier.

  1. Log in to Jamf Pro.

  2. Click Devices at the top of the page.

  3. Click Configuration Profiles.
    A list of mobile device configuration profiles is displayed.

  4. Click View next to the configuration profile you want to view logs for.
    A list of mobile devices that are in the scope of the configuration profile is displayed.

  5. To view logs for a different date range, specify the starting and ending dates using the Date Range pop-up calendars.

  6. Click Done.

Related Information

For related information, see the following sections in this guide:

For related information, see the following Knowledge Base article:

Distributing Apps to Mobile Devices with App Store Restrictions After Upgrading to Jamf Pro 9.5 or Later
Learn about the steps necessary to redistribute mobile device configuration profiles that contain App Store restrictions so that you can distribute apps to mobile devices with restrictions after upgrading from Jamf Pro 9.4 or earlier.

For related information, see the following technical paper:

Enabling Jamf Pro as SCEP Proxy
Learn how to enable Jamf Pro as SCEP Proxy for distributing certificates via configuration profiles.

Copyright | Privacy | Terms of Use | Security
© copyright 2002-2017 Jamf. All rights reserved.