Skip to content

Integrating SailPoint with Jamf Using SSF

The Shared Signals Framework (SSF) is a security architecture that allows different security solutions to share and consume security events and alerts. This integration allows real-time sharing of security events related to Apple devices. For more information about SSF, refer to Shared Signals Framework.

In this architecture:

  • Jamf acts as the Transmitter, monitoring the security state of managed Apple endpoints.
  • The SailPoint serves as the Receiver, enforcing access policies based on device trust signals.

By leveraging the SSF Receiver, organizations can significantly reduce the time it takes to detect, respond to, and remediate identity-related threats. Jamf sends security events to SailPoint, which correlates them with identity data, providing comprehensive visibility and triggering workflow based on the received signals.

Key benefits of integrating Jamf with SailPoint include:

  • Device State Monitoring (Jamf - Transmitter)

    Jamf continuously monitors all managed devices for compliance with your organization's security baseline. This includes checks for:

    • Operating system updates and patch level
    • FileVault disk encryption
    • Firewall and Gatekeeper configurations
    • Presence and status of required security tools

  • Compliance Deviation Detection

    If a device falls out of compliance, when a required setting is disabled or unauthorized software is detected, Jamf immediately flags this change.

  • Real-Time Signal Transmission

    Upon detecting a compliance change, Jamf generates a Security Event Token (SET). This token contains:

    • Subject Identifier
    • Device Identifier
    • Previous and current compliance status
    • Timestamp and contextual metadata
    • Jamf transmits this SET in real time to the SailPoint's SSF endpoint.

  • Receiver-Side Workflow: Policy Enforcement

    The SailPoint (Receiver) evaluates the incoming device-compliance-change signal and initiates appropriate policy response based off predefined Workflows. For example, if the device status changes to non-compliant, a Workflow would initiate the following:

    • Notify the device owner's manager
    • Admin alerts via a ticketing systems
    • Disable access to accounts or sensitive entitlements

This real-time, event-driven architecture supports Zero Trust principles by enabling dynamic access decisions based on the current compliance state of a user's device. It eliminates reliance on periodic polling or manual intervention - delivering a scalable, automated, and secure model for device-aware access control.

This guide provides specific information about configuring Jamf and SailPoint using Shared Signal Framework.

Supported Features

The SSF integration between Jamf Security Cloud (integrated with Jamf Pro) and SailPoint supports the following features:

  • Real-time transmission of DEVICE_COMPLIANCE_CHANGE events from Jamf Security Cloud to SailPoint.
  • Event mapping and correlation of device compliance changes with user identities in SailPoint.
  • Workflow triggered by CAEP Device Compliance Change Events. For more information, refer to Workflow Triggers.

Prerequisites

Before proceeding with the SSF integration between Jamf and SailPoint, ensure that the following prerequisites are met:

  • Jamf Pro integration with Jamf Security Cloud

    Jamf Pro should be integrated with Jamf Security Cloud using UEM Connect. For more information, refer to the Jamf Security Cloud Setup Guide.

  • SSF Stream Registration in Jamf Security Cloud

    Ensure to register SSF streams in Jamf Security Cloud. To register follow these steps:

    1. Go to Integrations > SSF streams in the Jamf Security Cloud instance.
    2. Select Create new SSF stream.
    3. In the Audience field, enter the URL for your SSF signal receiver and select Create. Ensure the URL is a unique identifier linking the Receiver to the Transmitter. For example, https://identitynow.com or https://tenant.identitynow.com or {your-tenant-base-url}.
    4. Copy and save the token shown in the window, then select Confirm.

    5. Verify the obtained URL.

      The token and Well known URL obtained during SSF stream registration will be required as input while configuring the Shared Signal Receiver in SailPoint.

  • Obtain the necessary API credentials from Jamf Pro and SailPoint to authenticate and authorize the SSF integration. Ensure that the API credentials have the appropriate permissions to access and manage the integration.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.