Personal Device Profiles

Personal device profiles are used to enroll personally owned iOS devices with Jamf Pro via user-initiated enrollment. Personal device profiles are also used to perform management tasks on personally owned iOS devices, including defining settings and distributing managed apps.

You can create one personal device profile for each site in Jamf Pro, and one profile for the full Jamf Pro. A personal device profile is only used to enroll and manage devices if the profile is enabled in the General payload.

The personal device profile used to enroll and manage a device is based on the site that the mobile device user has access to. Site access is determined by the LDAP directory account or Jamf Pro user account credentials entered during user-initiated enrollment. For information on specifying the sites that LDAP user groups have access to during enrollment, see User-Initiated Enrollment Settings.

If a profile has been enabled for the site, that profile is used to enroll the device and add the device to the site. If a profile has not been enabled for the site, or if sites have not been added to Jamf Pro, the profile for the full Jamf Pro is used if it is enabled.

Note: Changing the site that a personal device belongs to automatically changes the profile that is used to perform management tasks on the device. If a profile has not been enabled for the new site, the device will continue to be managed by Jamf Pro, but all settings and apps that were previously defined by the old profile are removed.

Personal Device Profile Payloads

The payloads and settings that you can configure using a personal device profile represent a subset of the iOS configuration profile payloads and settings available for institutionally owned mobile devices.

Before creating a personal device profile, you should have basic knowledge of configuration profile payloads and settings, and how they affect mobile devices. For detailed information about each payload and setting, see Apple’s iOS Deployment reference at:

http://help.apple.com/deployment/ios/#/cad5370d089

Managed App Distribution to Personal iOS Devices

When creating or editing a personal device profile, you can specify managed in-house apps and App Store apps to distribute to personal iOS devices. Available apps include all managed apps that have been added to the site that the profile is assigned to, and all managed apps that have been added to the full Jamf Pro.

When a managed app is distributed to personal iOS devices, the personal device profile automatically applies settings to do the following:

  • Distribute the app using the Install Automatically/Prompt Users to Install distribution method

  • Remove the app when the MDM profile is removed

  • Prevent backup of app data

  • Prevent opening documents from managed apps in unmanaged apps

When selecting managed apps to distribute, you have the option to clone an unmanaged app and make it managed. This adds a managed version of the app to Jamf Pro and leaves the original app unmanaged.

Note: Not all apps can be managed by Jamf Pro. For information on the factors that determine whether an app can be managed, see Understanding Managed Apps.

Requirements

To create personal device profiles, the User-Initiated Enrollment settings must be configured to allow user-initiated enrollment for personally owned iOS devices. For more information, see User-Initiated Enrollment Settings.

To enroll and manage personal iOS devices, you need a push certificate in Jamf Pro. For more information, see Push Certificates.

Note: To distribute managed apps to personal iOS devices, the devices must have an MDM profile that supports managed apps. For more information, see Managed App Requirements.

Creating a Personal Device Profile

You can only create a personal device profile if there is an available site (or the full Jamf Pro) that does not have a profile assigned to it.

  1. Log in to Jamf Pro.

  2. Click Devices at the top of the page.

  3. Click Personal Device Profiles.

  4. Click New images/download/thumbnails/18787898/Icon_New_Button.png .
    Note: Only one personal device profile can be created per site in Jamf Pro. If all sites (or the full Jamf Pro) already have an assigned personal device profile, you will not be able to create a new one.

  5. Use the General payload to configure basic settings for the profile, including the display name and the site to assign the profile to.
    Note: If you have site access only, the profile is assigned to the applicable site automatically and the Site pop-up menu is not displayed.
    To enable this personal device profile, select the Enable personal device profile checkbox.

  6. (Optional) Use the Passcode payload to configure passcode policies.

  7. (Optional) Use the Wi-Fi payload to configure how devices connect to your wireless network, including the necessary authentication information.

  8. (Optional) Use the VPN payload to configure how devices connect to your wireless network via VPN, including the necessary authentication information.

  9. (Optional) Use the Exchange ActiveSync payload to define settings for connecting to your Exchange server.

  10. (Optional) Use the Mail payload to define settings for connecting to POP or IMAP accounts.

  11. (Optional) Use the Calendar payload to define settings for configuration access to CalDAV servers.

  12. (Optional) Use the Contacts payload to define settings for configuration access to CardDAV servers.

  13. (Optional) Use the Subscribed Calendars payload to define settings for calendar subscriptions.

  14. (Optional) Use the Certificate payload to specify the X.509 certificates (.cer, .p12, etc.) you want to install on devices to authenticate the device access to your network.

  15. (Optional) Select the Apps payload and then do any of the following:

    • To distribute a managed app to personal iOS devices added to the site (or the full Jamf Pro) that the profile is assigned to, click Install next to the app name. (To distribute all managed apps, click Install All.)

    • To remove a previously distributed managed app from devices, click Remove next to the app name. (To remove all managed apps previously distributed with this profile, click Remove All.)

    • To clone an unmanaged app to add a managed version of the app to Jamf Pro, click the unmanaged app name and then click Clone App and Make Managed. A managed version of the app is added to Jamf Pro and is made available for installation.

  16. (Optional) To add messaging that displays during user-initiated enrollment if the user belongs to multiple LDAP user groups with access to multiple sites, do the following:

    1. Click the Messaging tab, and then click Add images/download/thumbnails/18787898/Icon_Add_Button.png .

    2. Choose a language from the Language pop-up menu.

    3. Use the settings on the pane to specify the site/profile display name, as well as the text to describe the settings included with the profile. In the description for iOS devices, you can also list any managed apps that will be included with the profile.

    4. Click Done.

    5. Repeat this process as needed for other languages.

  17. Click Save.

If the profile is enabled in the General payload, it will be used to enroll personal devices with Jamf Pro when users enter credentials for an LDAP directory account or a Jamf Pro user account that has access to the site (or to the full Jamf Pro).

Cloning, Editing, or Deleting a Personal Device Profile

Consider the following when cloning, editing, or deleting a personal device profile:

  • Cloning—You can only clone a personal device profile if there is an available site (or the full Jamf Pro) that does not have a profile assigned to it.

  • Editing—When a personal device profile is edited and saved, it is automatically redistributed to personal devices belonging to the site (or the full Jamf Pro) that the profile is assigned to.
    When editing an enabled profile, if you deselect the Enable personal device profile checkbox in the profile’s General payload, all personal devices belonging to the site that the profile is assigned to will continue to be managed by Jamf Pro, but all settings and apps that were previously defined by the profile are removed.

  • Deleting—When a personal device profile is deleted, all personal devices belonging to the site that the profile is assigned to will automatically be changed to use the profile assigned to the full Jamf Pro if a profile for the full Jamf Pro is enabled. If an enabled profile for the full Jamf Pro does not exist, or if you are deleting the profile assigned to the full Jamf Pro, then the applicable devices will continue to be managed by Jamf Pro, but all settings and apps that were previously defined by the profile are removed.
    Note: A personal device profile is automatically deleted if the site it is assigned to is deleted from Jamf Pro.

Related Information

For related information, see the following sections in this guide:

Copyright     Privacy Policy     Terms of Use     Security
© copyright 2002-2018 Jamf. All rights reserved.