Jamf Pro 11.33: validate Full Disk Access for Self Service+
Jamf Pro 11.33 can now automatically deliver a PPPC profile granting Full Disk Access to Self Service+ and its bundled binaries during enrolment. That automation is a privilege change: qualify it, retain evidence, then extend it.
1. Define the actual scope
Jamf ties this profile to Jamf App Catalog deployments in Blueprints and to the com.jamf.selfserviceplus bundle ID. It does not grant access to every business application. Inventory the affected Blueprints, new Macs and workflows that genuinely use Self Service+.
2. Test first startup
Prepare a representative ADE Mac and follow its complete path: enrolment, Blueprint delivery, PPPC profile appearance, Self Service+ installation and launch from a standard account. Check in Settings and Jamf that the profile targets only the intended component and is delivered, without confusing it with an inherited manual approval.
- Record the Mac identifier, Blueprint, macOS version and delivery time.
- Test an approved app installation and the expected behaviour when it fails.
- Repeat after erase or re-enrolment to confirm repeatability.
- Prepare scope removal and a support path if the profile does not arrive.
3. Keep proportionate evidence
For every pilot, retain the Jamf status export or capture, the local profile state and the installation outcome. Do not add unnecessary personal data. This record lets Belgian and French teams distinguish an enrolment, catalogue or macOS-permission fault.
4. Decide on expansion
Expand in rings only after validating the profile, business use and rollback. Automatic delivery reduces manual work, but does not replace privilege review or exception monitoring. This complements our guide to Jamf catalogued Mac applications and our Apple enterprise Belgium and Apple enterprise France pages.
Official source: Jamf Pro 11.33 — Other Changes and Improvements.