Configuration profiles provide an easy way to define settings and restrictions for computers
enrolled in Jamf Pro.
Profiles can enforce passcode compliance, provide WiFi settings, administer restrictions,
and much more.
My name is Nate- welcome to Computer Configuration Profiles.
Configuration profiles are .mobileconfig files and can be created with a few different tools,
like Apple Configurator 2, Profile Manager, and Jamf Pro.
You could also write them by hand, but that's highly advanced and can be a little risky.
Let's create a couple profiles of our own.
One of the simplest and most effective ways to secure data on computers is to require
users to create and maintain secure passcodes.
Begin by navigating to the Computers tab in Jamf Pro and selecting Configuration Profiles
from the sidebar.
From here we have a few options.
If there are lots of profiles already created in the server we can filter them with the
field to the left.
We can create new profiles with the New button, or if we have existing profiles from another
MDM solution or acquired from another admin we can add them to our server with the Upload
button.
Select New, and we have a few objects in this interface.
Along the top are two tabs - Options and Scope.
To the left is the payload sidebar, which contains everything from Passcode to Network
to VPN to Restrictions and many more configuration profile options.
Select the General payload at the top, and in the middle of the screen we have configurable
options.
Let's provide a name for this profile - I'm going to call this Passcode Requirements.
A description field is available which may help us remember what this profile does in
the future, and inform our fellow admins.
Be warned - this description will also show up in the Profiles pane of System Preferences
if you allow users to access it, so keep it work-safe.
Let's provide a category as well - I'm going to put this in Security - and a distribution
method.
Install Automatically will deploy this profile to any computers in scope as soon as we save
it and the restrictions will apply immediately.
Self Service will make this available in the Self Service app for users to install themselves.
I don't think many users will willingly apply passcode requirements to themselves, so let's
leave this at Install Automatically.
Next, select Passcode from the list to the left.
There are a myriad of options here, from simply requiring a minimum passcode length - anywhere
from 1-16 characters - to locking the computer should there be too many failed attempts at
the login screen.
The settings you deploy may depend on an administrator's preference, or the security and compliance
team's requirements.
Each option can be enabled or disabled with the toggle to the right.
Let's toggle Require Passcode to on.
Next, toggle the minimum passcode length length for this profile and set it to 8 characters
with the pop-up menu.
I also want my users to include at least one complex character using the Minimum Number
of Complex Characters option - something non-alphanumeric - and let's set passcodes to expire after
30 days with the Maximum Passcode Age option, which will require users to create a new unique
passcode regularly.
Once the options are configured appropriately, select the Scope tab.
If you're unfamiliar with scope, I'd recommend checking out our video titled Computer Scope.
Because it's important all computers are secured, I'm going to use the Target Computers menu
and flip this from Specific Computers to All Computers.
Click Save and the profile will install on computers using the Apple Push Notification
service and mobile device management.
Because my computer is enrolled, we can test this by opening System Preferences, selecting
Users and Groups, and Change Password to the right.
If I enter a new password that does not meet the configuration profile's requirements,
a pop-up will let me know.
Let's create one more profile.
Navigate back to Jamf Pro, Configuration Profiles, and create a new profile.
Call this Restrictions and provide a description, something like, "this configuration profile
restricts options in System Preferences".
Again, because I don't think users will voluntarily surrender access to parts of the operating
system, we'll install this automatically.
Next, scroll down to the payload sidebar, select Restrictions, and Configure.
There are six tabs along the top for this payload - Preferences, Applications, Widgets,
Media, Sharing Services, and Functionality.
Let's start with Preferences and select the checkbox to Restrict items in System Preferences.
Flip the radio button from enable selected items to disable selected items, and I'm going
to prevent computers from accessing Users and Groups so they can't create or modify
existing users, Date and Time since that's set automatically, and Profiles, so users
can't remove the MDM profile if the computer wasn't enrolled with a PreStage Enrollment.
I encourage you to explore the other tabs in this payload, but for this demo let's send
this out by selecting the Scope tab.
Click Add to the right, and I'm going to scope this to my computer just to test it out and
make sure it works before it's deployed to users' computers.
Click Save, and typically within a few seconds the profile will apply.
Open System Preferences, and I no longer have access to Users and Groups, Date and Time,
or Profiles.
Hovering over one of these objects reveals the administrator has restricted access.
If for some reason profiles are not applying, check the logs by navigating back to Jamf
Pro, select the profile in question, and Logs near the bottom.
This will reveal whether the profile has installed successfully, is pending, or has failed.
To remove profiles from computers, it's as simple as excluding those computers from scope.
If I edit this profile, I can remove this computer, click Save, open System Preferences,
and see access has been restored.
You may need to close and reopen System Preferences to see this take effect.
Another thing to note: there are lots of payloads available for configuration profiles that
affect macOS on a number of levels.
To keep things granular and organized, we recommend configuring as few payloads per
profile as possible.
These demos used a single payload each.
That's because, just in case something goes awry, I can pull individual profiles from
computers when troubleshooting, instead of one massive profile containing all the settings
for that computer.
For example, if I use a single profile to configure restrictions and wifi, and I pull
that profile to remove the restrictions, my users may also lose access to the internet.
Another way to determine whether a configuration profile has installed on computers is to check
the management history by navigating to Computers, perform a search, select the inventory record,
select the History tab, and Management History.
Configuration profiles are powerful management tools available for computers and mobile devices.
Because of their vast capabilities, it's important to test them before deployment, and keep payloads
separate for troubleshooting.
Thanks for watching, and we'll see you soon.