In the world of computers there are many types of users with varying degrees of authority.
You can log into your computer with a local user.
As an admin, you'll deploy policies and configuration profiles to users defined in Jamf Pro.
In this video, we'll create Jamf Pro users, used to log into the web app and the Jamf
Pro suite of apps like Jamf Admin or Jamf Remote.
My name is Nate, and today we're going to look at the different types of Jamf Pro users
available.
Let's start from the Jamf Pro Dashboard.
You may be tempted to select the Users tab from the Dashboard, but this is the home for
our users receiving apps and ebooks, not Jamf Pro users.
Instead, let's navigate to Settings by selecting the button in the top right, select System
Settings, and the Users and Groups object.
There are six columns here that provide information at a glance.
First, the username, which is used to log into the server, followed by the full name
of the user and their email address.
Note some of these fields are blank - they're optional - more on that in a minute.
Next we have the type of user.
We'll focus on Standard Users today.
Next is their access level and, again, we'll come back to this.
Finally we have a Privileges column.
This indicates what rights the user has to the server.
Let's create a new user to learn more.
Select New in the top right, and let's start by creating a new standard user.
Select Next, and provide a display name.
I'm going to create myself a new user with Kyle as the username.
Next, we need to determine which privileges this user will have.
Expanding the menu will reveal four options - Administrator, Auditor, Enrollment Only,
and Custom.
Administrators have unlimited access to the server.
If we select that option then select the Privileges tab we see every single box is checked.
We can create anything we want, view anything will full read access, update existing management
actions, and delete content.
Navigate back to account to fill in some more information.
Below privileges we can enable or disable this account.
This simply prevents the user from logging in.
Perhaps we're not quite ready to deploy new accounts, or we need to disable an account
for a former employee but don't want to delete it quite yet.
Let's leave our account enabled for now.
Next we can provide a full name and email address.
Both of these fields are optional, however, if we want this user to be eligible to receive
email notifications from Jamf Pro, we need to provide an email address - which I'll do
now.
Finally, we need to provide and verify a password.
Since this is an account for me, I won't select the option to 'force user to change password
at next login'.
However, if this was an account for a colleague, I may want them to create their own, unique
password, in which case this box would be helpful.
Let's click save, and our new account is ready for use.
Let's take a look at a couple other privilege sets.
Create a new user, create a standard account by selecting Next, and let's call this Manager.
Another useful set is Auditor.
This is a read-only account that can view, but not touch, anything configured in the
server.
Selecting Auditor and navigating to the Privileges tab reveals only the read boxes are selected,
but create, update, and delete are deselected.
This is great because now our manager can read search reports and monitor inventory,
but maybe we take this one step further and allow them to create their own searches.
As it stands they can only read Advanced Computer and Mobile Device searches, and I can't select
Create because we're using a privilege set.
Let's navigate back to Account and change Auditor to Custom.
Now, if we navigate back to Privileges, the read boxes are still selected, but I can add
or remove specific privileges.
Let's allow our manager to create and update both Advanced Computer and Mobile Device Searches.
Once that's done, navigate back to Account, provide a full name, email address, password,
and let's have them change it when they log in.
Click save, and we have a new account.
Let's explore the last privilege set by creating a new group.
Select New and change the radio button from Standard Account to Standard Group and click
Next.
Groups have fewer options than users, since they essentially contain users and assign
privileges to them, so we don't need to configure user passwords or email addresses here.
Let's say we have a group of interns incoming this summer.
They don't know much about MDM, but we can let them enroll the massive shipment of devices
we're getting in preparation for the incoming fall class.
I'm going to call this group Interns and, under privilege set, select Enrollment Only.
That's all we need to configure under this tab.
Select Privileges and we can see they don't have much - in fact most of the Jamf Pro server
will be invisible to them.
They can, however, see things like mobile devices - to confirm the enrollments are successful,
enroll computers and mobile devices, and use Recon.
The catch here is that, if we click on Members, we may not see any available options.
That's because this is our first group and none of our existing users have the right
kind of access.
So let's save this group and create one of our interns.
Click Done, New at the top right, Create Standard Account, and let's provide our user an identity,
Sam L. Since we now have a group, under Access, we can select Group access.
This will remove the privileges menu because the privileges of the group will override
whatever existing, individual privileges this user might have.
Let's add our full name, email address, and temporary password.
Next, select the Group Membership tab, and we can assign them to the Interns group.
Finally, click save.
Jamf Pro users and groups permit access to Jamf Pro for technicians and administrators.
Be careful with the privileges, especially when creating administrators, and it's a good
idea to test out custom privilege sets before allowing less-experienced users to run amok
on your server.
Thanks for watching, and we'll see you soon.