Jamf Connect and Jamf Protect are Jamf’s identity and security products for Apple devices. Jamf Connect handles Mac sign-in through a cloud identity provider, password synchronization and Kerberos-based access.[3] Jamf Protect is an endpoint and network security product with real-time monitoring, threat detection and mobile threat defense.[8] Both are Product Offerings under the Jamf Software License and Services Agreement (SLASA), sold as subscriptions with User or Device quantity limits set in the Quote or Order.[5] Today they mostly reach customers inside per-device plans. Jamf for Mac and Jamf for Mobile are “powered by” Jamf Pro, Jamf Connect and Jamf Protect.[6] Jamf for K-12 combines Jamf School, Jamf Safe Internet, Jamf Connect and Jamf Protect.[7] Jamf Now also integrates with Jamf Protect and Jamf Connect.[9] For the agreement as a whole, see Jamf licensing.
Editions
| How bought | Contents | Unit |
|---|---|---|
| Jamf for Mac | Jamf Pro, Jamf Connect, Jamf Protect | Per macOS device per month, billed annually, 25-device minimum[6] |
| Jamf for Mobile | Jamf Pro, Jamf Connect, Jamf Protect | Per mobile device per month, billed annually, 25-device minimum[6] |
| Jamf for K-12 | Jamf School, Jamf Safe Internet, Jamf Connect, Jamf Protect | Custom; device minimums apply[7] |
| Jamf Connect or Jamf Connect Basic subscription | Jamf Connect | Licence file downloaded from Jamf Account[4] |
| Jamf Protect subscription | Jamf Protect (macOS Security portal, Jamf Security Cloud portal) | Per Quote[5][8] |
Jamf’s public pricing pages publish no standalone price for Jamf Connect or Jamf Protect.[6] Jamf School’s documentation names a Jamf Connect Basic subscription as one that entitles a school to download a licence. Jamf does not publish what separates Basic from the full product.[4]
Metrics
Identity and security products are often sold per person. The SLASA defines a User as “the individual end user of a Device”. For user-based licensing it excludes end users who access shared devices used by multiple employees, such as shift workers.[5] A Device is a customer device, including iOS, iPadOS, macOS and tvOS devices.[5] Which unit applies to a Jamf Connect or Jamf Protect subscription is stated in the Quote. Inside the Jamf for Mac and Jamf for Mobile plans the unit is the device.[6] Catalog: User excludes end users of shared multi-employee devices; Device means a customer device, including iOS, iPadOS, macOS and tvOS devices.
Counting / floors
Jamf Connect licence file. Jamf Connect is activated by a licence downloaded from Jamf Account. Administrators either upload a .jamfconnectlicense file to the Jamf Connect Configuration app, or paste a Base64-encoded licence string into the LicenseFile setting of a configuration profile, which Jamf recommends.[1] Downloading a licence needs a Jamf Connect subscription associated with the administrator’s Jamf ID. The licence has to be included in only one configuration profile and preference domain.[1] Because one licence profile can be scoped to any number of Macs, the product itself does not stop over-deployment. Jamf monitors it instead. It may collect hashed licence-usage data to track the number of Jamf Connect licences in use, without personal information.[1] Catalog: Jamf Connect runs in trial mode for 30 days after release date without a licence.
Use limits. If the quantity in the Quote is exceeded, the SLASA’s general rule applies. Jamf works with the customer to order more or reduce use, and may suspend access if the customer does not comply.[5] Jamf may also use Telemetry Data and usage data to check compliance with contractual usage limits.[5] For Jamf Protect, telemetry is how the product works, so the deployed agent count is visible to Jamf. Catalog: Exceeding User or Device limits: order more or reduce use, else suspension; Jamf may use usage and telemetry data to check contractual usage limits.
Floors. The bundles have the minimums of their plans: 25 devices for Jamf for Mac and Jamf for Mobile, and unpublished device minimums for education.[6][7]
Term, renewal and expiry
Annual licence files. Jamf Account generates a new Jamf Connect licence file each year on the subscription start date. Administrators must download it and deploy it to keep the product working.[2] Jamf Connect 2.43 and later gives a grace period as the licence nears expiry. When the grace period ends, the About window in Jamf Connect and Self Service+ shows “UNLICENSED”.[2] Catalog: Jamf Connect licence file is regenerated yearly and must be redeployed.
What stops on expiry. With an expired or invalid licence, account management in Self Service+ stops, the Sign In window stops working, continuous password checks (password syncing) stop, and Kerberos functions such as automatic file-share mounting stop. Users can no longer change passwords through Jamf Connect. Local login keeps working unless network authentication is required.[3] Catalog: Expired Jamf Connect licence disables sign-in, password sync and Kerberos functions.
Trial mode. Without a licence, Jamf Connect runs in trial mode, which expires 30 days after the installed version’s release date. The 30 days do not start at installation.[1] A newly installed older build may therefore have little or no trial left.
Leftover software. When a Mac is unenrolled from Jamf Now, the Jamf Protect and Jamf Connect packages that Jamf Now installed are not removed. A user must delete them or use an uninstaller.[12] The packages left behind still appear in software inventories after the subscription for the device has ended.
Virtualization & partitioning
Jamf publishes no virtualization rules for Jamf Connect or Jamf Protect. They are counted by the Users or Devices in the Quote, so a virtual Mac running the agent counts like a physical one.
Cloud / BYOL
Jamf Protect includes access to the macOS Security portal and the Jamf Security Cloud portal, both run by Jamf.[8] Jamf may use de-identified, anonymized and aggregated telemetry and usage data to improve its threat detection and threat intelligence.[5] No bring-your-own-licence terms apply.
AI Offerings and APIs
AI Addendum. The Jamf AI Addendum governs AI Offerings that are Optional Features or Product Offerings. Optional AI features are opt-in. Customer Input and Customer Output are Customer Content, and Jamf will not use them to train, develop or refine AI Models.[10] Customers may use Output for internal business purposes only and must not present it as human-generated.[10] The pricing FAQ says the AI Governance capability needs no separate licence in Jamf for Mac and Jamf for Mac - Higher Education.[6] Catalog: AI Offerings: output for internal business purposes only; no training on customer input or output.
Jamf APIs. Developers who build integrations accept the Jamf API License and Developer Policy Agreement. It grants a limited, revocable right to use the Jamf APIs solely to develop, test and maintain Applications that interoperate with Jamf Product Offerings.[11] Developers may not use Customer Data, API documentation, the APIs or Jamf Application Data to train large language models or AI systems. They also may not use the APIs to build competing products.[11] Catalog: Jamf API licence: build interoperating Applications; no AI training on customer data.
Out of scope
- Jamf Executive Threat Protection, which has separate terms, and Jamf Mobile Forensics, which has its own terms of service.
- Jamf Safe Internet and Jamf Trust (mobile) licensing details.
- The internal fields of the Jamf Connect licence file, and the feature differences between Jamf Connect and Jamf Connect Basic.