Jamf Self Service+: validate privilege elevation with SSO
Using a targeted Self Service+ fix as a starting point, this protocol helps teams validate privilege elevation on managed Macs, including denials and support handling.
1. The documented fix and its precise scope
The Jamf Self Service+ 2.32.0 release note dated 13 October 2026 describes fix PI-1131: on macOS 26.4, authentication could fail during privilege elevation using the VerifyUserPromotion key when a single sign-on extension profile was present. This concerns a specific combination; it does not guarantee operation across every macOS version or identity provider.
2. Build a matrix before deployment
Our proposed method records the macOS version, Self Service+ version, installed SSO profile, VerifyUserPromotion configuration and expected privilege policy for each pilot population. Identify users allowed to request elevation and those who must remain excluded. Have identity and security owners approve this matrix before making changes.
3. Test the full journey, including denials
On a representative test Mac, document the initial result and apply the candidate version approved by your team. Repeat the request with an authorised account and check authentication, the actual privileges granted and their removal under your policy. Repeat with an excluded account: denial is a success criterion. Also test cancellation and failed authentication; neither scenario should grant privileges in your acceptance tests.
4. Organise evidence and exceptions
We recommend a test record containing the device, versions, configuration, expected and observed results, timestamp and decision. Retain only information needed for diagnosis, without passwords or tokens. If the pilot fails, open a support case with relevant technical details and set a review deadline for the exception. Avoid resolving the blockage by granting permanent administrator rights without a risk assessment.
5. What changes for a Belgian or French organisation
For an SME, we advise testing the workflow with the provider managing its Macs before announcing availability to users. A mid-sized company, large enterprise or public administration can organise pilots by identity configuration and business use. Across Belgian, French and other European sites, share acceptance criteria and schedule changes around available support. The fix alone does not demonstrate regulatory compliance.
6. Underside analysis: treat elevation as a controlled service
Our view is that successful authentication is only one acceptance criterion: teams should verify who receives which privileges and how support handles failures. Link tests to MDM configurations and their owners, then expand deployment by group after approval. These steps are Underside recommendations, separate from the capabilities announced by Jamf. Do not treat this SSO extension case as general validation of Platform SSO.
Run a pilot with an authorised user and an excluded user; require evidence of the outcome and privilege removal. Underside, an Apple Business Partner, supports organisations in Belgium, France and Europe with Apple fleet management and security.
Plan your Mac pilotSource : Jamf — Self Service+ 2.32.0 (2026-10-13).