Jamf Pro 11.31: secure SMTP alert continuity

Article created August 29, 2026 · Source reviewed August 29, 2026 · Official source: Jamf · Topic: Jamf Pro, Apple MDM, identity and security

Jamf Pro 11.31 removes the Basic Credentials and None SMTP authentication options from newly created instances. Existing configurations are unaffected, but this difference between old and new tenants warrants a continuity check: an MDM console that still works while its alerts disappear creates an operational blind spot.

1. What Jamf actually changed

In the official Jamf Pro 11.31.0 release notes, Jamf lists two removals: the Basic Credentials and None options in SMTP server authentication settings. The removal applies to newly created instances; Jamf explicitly says pre-existing instances are not affected.

Jamf is therefore not announcing an immediate shutdown of existing configurations or an automatic migration. Teams should not invent a deadline the vendor has not provided. However, rebuilding a tenant, preparing disaster recovery or standardizing multiple instances can now produce different results if the runbook still assumes those options exist.

2. Why SMTP belongs in the MDM control plane

Jamf email can carry alerts, workflow notifications and signals that support teams need. Losing it does not interrupt APNs, Apple Business Manager or Automated Device Enrollment, but it can delay the detection of a certificate, integration or operation requiring human action.

The risk spans the full chain: sender identity, mail provider, OAuth 2.0 where supported, conditional-access rules, DNS, outbound filtering, relay, reputation and destination mailbox. A successful interface test is not a substitute for monitoring a message that was actually received.

3. Design a durable service identity

A Jamf SMTP identity needs an owner, a defined scope and a recovery process. Do not tie it to an administrator’s personal account. Document the mail tenant, sender address, minimum permissions, renewal mechanisms and the people authorized to change the configuration.

Where both the mail platform and Jamf support OAuth 2.0, treat the setup as an application integration: consent, secret or certificate, lifetime, revocation and logs. The exact choice depends on the Jamf version and provider. Validate it against the documentation for the specific instance instead of assuming a setting seen elsewhere is universally available.

4. What changes for a Belgian or French organization?

An SMB should first verify that alerting does not depend on an old account or forgotten anonymous relay. A mid-market company, large enterprise or public body operating in Belgium and France should compare its tenants, recovery environments and Microsoft 365 or Google Workspace policies: the same procedure may succeed on a legacy instance and fail on a new one.

For IT and security leaders, useful evidence combines configuration, periodic testing, delivery and logging. This supports internal controls and ISO 27001 or NIS2 programs without proving compliance by itself. Support teams also need an alternative channel when email or federated identity is unavailable.

5. Underside analysis: test the signal, not just the button

Our view is that removing the legacy modes exposes a dependency that is often poorly documented. SMTP should not remain a box configured once during installation: it is a service with an identity, network dependencies and a measurable delivery expectation.

A sound control periodically generates a harmless notification, verifies its arrival within the expected time and alerts through a separate channel on failure. This complements the move to OIDC for Jamf administrators and centralized Apple and MDM log collection.

6. Recommended action plan

• Inventory every Jamf instance, its SMTP mode and its mail provider.
• Identify unauthenticated relays and basic credentials still in use.
• Create a service identity with an owner, minimum permissions and revocation process.
• Validate the modern mode actually supported by the Jamf version and provider.
• Test sending, delivery, filtering, latency and logging from every environment.
• Add SMTP configuration to tenant-build and disaster-recovery runbooks.

Official source: Jamf Pro 11.31.0 Release Notes — Deprecations and Removals.