Jamf Pro 11.34: validate SSO and sensitive actions
Jamf Pro 11.34.0 adds, among other capabilities, OIDC SSO for enrolment and Self Service+ for mobile, as well as a log for lock, wipe, unmanage and delete actions. For an organisation, these changes affect identity and traceability, so they deserve acceptance testing before a broad rollout.
1. What Jamf confirms
Jamf says OIDC SSO can be configured for Automated Device Enrollment, user-initiated enrolment and sign-in to Self Service+ for mobile. Configuration is on the OIDC tab of the SSO settings and works with an OIDC-compliant identity provider. Jamf says Self Service+ support for macOS will be added in a future release, so it should not be assumed in a Mac scenario today.
2. Test identity journeys separately
Build a pilot with a representative tenant, identity provider, device and test account. Check authentication, user assignment, the return to Jamf and access to Self Service+ for mobile. Also test denial paths: disabled accounts, missing groups, expired sessions and out-of-scope devices. Record the result for each journey rather than treating administrative SSO as proof of the whole end-user experience.
3. Govern high-impact actions
The new Action Log records lock, wipe, unmanage and delete actions for computers and mobile devices. It shows the initiator, time, target, number of affected devices and response status; a per-device view distinguishes successful and failed commands. Viewing it requires the “View Event Logs” privilege, so check that support and security roles maintain a sound separation of duties.
4. Put compliance through acceptance testing
In device-compliance-integrated environments, inventory now shows compliance status, applicable status, last compliance sync and whether a grace period applies. Jamf lets organisations configure that period from one hour to 30 days and target affected devices with the “In Grace Period” smart-group criterion. Have identity, security and business teams approve its duration: too short disrupts work, while too long defers a known risk.
5. Prepare the upgrade and recovery path
Document the current version, OIDC integrations, contingency accounts, affected roles and test cases. Before switching, simulate a sensitive action on a lab device and check both the console record and the device outcome. For Apple enterprise Belgium and Apple enterprise France, also record who can approve a wipe, who reviews the log and how a user is supported when access is denied.
6. Underside analysis: tie identity to evidence
Jamf presents these functions as product capabilities; they do not replace a delegation policy or an incident procedure. We recommend treating the action log as evidence that your procedure was executed, not as its only control. Link every SSO test and sensitive action to an owner, ticket and outcome record. This is Underside’s analysis, not Jamf guidance.
7. Mobile prerequisite and Jamf Cloud window
The November 10 announcement specifies Self Service+ for mobile 12.2.0 or later as a prerequisite. The schedule lists eu-central-1 from November 13 at 23:00 to November 14 at 10:00 UTC, and germanywestcentral Azure from November 13 at 23:00 to November 14 at 01:00 UTC. Jamf notes that this schedule may change.
A decision for each instance
For a Belgian or French business, we recommend recording each instance’s hosted region before arranging support coverage. Users’ country alone does not determine the window. Check the official schedule and portal messages again before intervention; record the observed version after the window rather than assuming success from the announced timing.
Complete the acceptance record
Add the Self Service+ for mobile version to each pilot device’s record. A test on an outdated version cannot establish that the identity provider has failed. For a small business, appoint an owner and a backup; for a multisite organisation, share the same record between local and central teams. Keep the region, server version, app version, OIDC journey outcome and rollout decision. Distinguish Jamf administrative access.
Official source: Jamf — Jamf Pro 11.34.0 release notes ; Jamf — announcement and Cloud schedule.