Jamf Device Checker - Administrator Guide

Table of Contents

• Why Use Jamf Device Checker?
• Quick Start
• Setup Instructions
• Configuration Reference

Why Use Jamf Device Checker?

The Problem

End users often experience device issues that impact their productivity but don't know how to identify or resolve them:

• Outdated iOS versions

• Low battery health causing unexpected shutdowns

• Storage capacity issues preventing app installations

• Network connectivity problems affecting productivity

• Device overheating causing performance throttling

• High memory/CPU usage slowing down work

These issues typically result in help desk tickets, lost productivity, and frustrated users.

The Solution

Jamf Device Checker empowers end users to self-diagnose and resolve device readiness issues through a simple, color-coded interface:

✅ Green = Device is ready for work
⚠️ Yellow = Warnings that should be addressed soon
🔴 Red = Critical issues preventing productivity

Key Benefits

For End Users:

• Self-service device readiness checks

• Clear, actionable guidance for fixing issues

• Reduces wait time for IT support

• Proactive notifications before deadlines

For IT Teams:

• Reduces help desk tickets

• Ensures compliance with corporate policies (OS versions, required apps)

• Real-time visibility into device health

• Configurable thresholds and monitoring rules

For Organizations:

• Improved end-user productivity

• Better device lifecycle management

• Reduced IT support costs

• Compliance tracking and reporting

Quick Start

Prerequisites

• Jamf Pro server (JPS)
• Admin access to Jamf Pro
• Jamf Self Service app (required for app installation feature)
• Local JSS user account with wizard privileges (see below)

Required API Privileges

The app uses two distinct sets of privileges:

For Wizard Setup (Local JSS user account - used during initial configuration):

Create a local JSS user in Jamf Pro with these 8 privileges:

• Read Mobile Device Applications
• Update Mobile Device Applications
• Read API Integrations
• Create API Integrations
• Update API Integrations
• Read API Roles
• Create API Roles
• Update API Roles

This user account authenticates the wizard via Basic Auth to create the API integration, configure roles, link the native app, and save app config XML. After initial setup, this user is only needed for app config updates.

For Runtime Operation (OAuth API client - automatically configured by wizard):

The wizard automatically creates a "Jamf Device Checker" API role with these 4 privileges assigned to the linked app integration:

• Send Device Information Command
• View MDM command information in Jamf Pro API
• Read Mobile Devices
• Send MDM command information in Jamf Pro API

These privileges allow the device checker to fetch device details and send MDM commands during normal operation using OAuth authentication. End users never see or use these credentials.

5-Minute Setup

Step 1: Purchase and add the app to Jamf Pro

• Purchase "Jamf Device Checker" and assign to Jamf Pro instance in AxM

• Navigate to Mobile Device Apps in Jamf Pro

• Add "Jamf Device Checker" from Apps Purchase in Volume

Step 2: Run the Setup Wizard

• Install the app on your admin device

• Launch the app and long-press the circular status image to enable Wizard mode

• Authenticate with local JSS user (requires 8 wizard privileges - see Required API Privileges below)

• Follow the wizard to:

  • Configure API role with required privileges

  • Create API integration

  • Link native app to API integration for authentication

  • Generate managed app config and save to JPS

There is no step 3

• Just scope to end-user devices

Setup Instructions

Step 1: Add Mobile Device App to Jamf Pro

• Purchase "Jamf Device Checker" and assign to Jamf Pro instance in AxM

• Log into Jamf Pro

• Navigate to Devices > Mobile Device Apps

• Click + New

• Search for "Jamf Device Checker" in Apps Purchase in Volume

• Click Add to add app record to your Jamf Pro instance

Step 2: Run the Setup Wizard

The wizard handles all the authenication and managed app configuration automatically.

Install App on Admin Device

• Assign the app to a test iOS device

• Launch Jamf Device Checker

Enable Wizard Mode

• On the main screen, long-press the circular status image for 3 seconds

• Select Wizard Setup

• Authenticate with the local JSS user credentials created in Prerequisites (requires the 8 wizard privileges)

Complete Wizard Steps

API Role

• Wizard checks for existing "Jamf Device Checker" API role

• If not found, creates role with required privileges:

  • Send Device Information Command

  • View MDM command information in Jamf Pro API

  • Read Mobile Devices

  • Send MDM command information in Jamf Pro API

• Links role to API integration

Native App Authentication

• Wizard links the mobile device app record to the API integration

• Enables OAuth authorization code delivery via Managed App Config

Generate App Config

• Wizard generates complete Managed App Config

• Send to Jamf Pro

Step 4: Scope to Devices

• In the same app record, click Scope

• Add target device groups, smart groups, or individual devices

• Click Save

Configuration Reference

The app is configured entirely through Jamf Pro's Managed App Config. Below is a complete reference of all available keys.

Required Keys

These keys are automatically populated by Jamf Pro — do not modify or remove them.

Branding & Alerts URL

Example:

<key>device-checker-branding-image-url</key>
<string>https://yourcompany.com/logo.png</string>
<key>device-checker-branding-image-height</key>
<string>60</string>

Share Buttons

Control visibility of status sharing and log export features in the More tab.

Example:

<key>device-checker-send-status-enabled</key>
<string>YES</string>
<key>device-checker-send-logs-enabled</key>
<string>NO</string>

UI Behavior

Control the scrolling behavior of the Status tab.

Example:

<key>device-checker-status-tab-scrollable</key>
<string>NO</string>

When to Enable:

Default (NO): Best for most deployments — header and overall readiness status remain visible while scrolling through tiles Enabled (YES): Use when you need the entire view to scroll together, or to accommodate longer branding headers on smaller devices

Operating System Readiness

Monitor OS version requirement with configurable minimum version and deadline.

Example:

<key>device-checker-os-enabled</key>
<string>YES</string>
<key>device-checker-os-min-version</key>
<string>26.2</string>
<key>device-checker-os-deadline</key>
<string>2026-06-30</string>

Status Logic:

✅ **Green (Ready)** — Current OS version meets minimum requirement

⚠️ **Yellow (Warning)** — Current OS version below minimum, but deadline has NOT passed (or no deadline configured)

🔴 **Red (Not Ready)** — Current OS version below minimum AND deadline has passed

App Readiness

Monitor installation status and version requirement for required managed apps.

App List Format:

AppName,bundleID,minVersion,deadline|AppName2,bundleID2,minVersion2,deadline2|...

Example:

<key>device-checker-apps-enabled</key>
<string>YES</string>
<key>device-checker-apps-list</key>
<string>Slack,com.tinyspeck.chatlyio,24.0.0,2026-03-01|Microsoft Teams,com.microsoft.skype.teams,5.0.0,2026-06-01</string>

Status Logic:

✅ **Green (Ready)** — All apps installed and meet minimum versions

⚠️ **Yellow (Warning)** — One or more apps need updating, but deadline has NOT passed

🔴 **Red (Not Ready)** — One or more apps need updating AND deadline has passed

⏳ **Pending** — App installation in progress (see Self Service integration below)

Self Service Integration:

When apps are missing or outdated, users can tap the "Update Apps" button on the Apps tile to automatically install or update required apps

User Action: Taps "Update Apps" button on Apps tile

App Launch: Jamf Self Service app opens automatically with missing/outdated apps queued

Pending State: Device Checker enters "Pending" status and starts a 2-minute auto-refresh timer

Auto-Check: App automatically refreshes every 2 minutes to check if installations completed

Completion: Once all apps meet requirements, status returns to green

Requirements:

• Jamf Self Service app must be installed on the device

• Apps must be available in Self Service and scoped to the device

• Apps must have "Display app in Self Service after it is installed" checked in Jamf Pro

Notes:

• Bundle ID must match exactly (case-sensitive)

• Version comparison uses semantic versioning (e.g., 2.5.0 > 2.4.9)

• Deadline is optional (leave blank if not needed: AppName,bundleID,minVersion,)

Power Source (Battery Level)

Monitor battery charge level with configurable warning and critical thresholds.

Example:

<key>device-checker-power-source-enabled</key>
<string>YES</string>
<key>device-checker-power-source-warning</key>
<string>25</string>
<key>device-checker-power-source-critical</key>
<string>10</string>

Status Logic:

🔴 **Red (Critical)** — Battery ≤ critical threshold

⚠️ **Yellow (Warning)** — Battery ≤ warning threshold (but > critical)

✅ **Green (Ready)** — Battery > warning threshold

⚡ **Charging** — Device is plugged in (always green when charging)

Storage Capacity

Monitor available storage with configurable warning and critical thresholds (based on percentage used).

Example:

<key>device-checker-storage-enabled</key>
<string>YES</string>
<key>device-checker-storage-warning</key>
<string>75</string>
<key>device-checker-storage-critical</key>
<string>90</string>

Status Logic:

🔴 **Red (Critical)** — Storage used ≥ critical threshold

⚠️ **Yellow (Warning)** — Storage used ≥ warning threshold (but < critical)

✅ **Green (Ready)** — Storage used < warning threshold

Battery Health

Monitor battery health status to identify devices that may need battery replacement. This tile displays battery health status and current charge percentage.

Example:

<key>device-checker-battery-enabled</key>
<string>YES</string>

Status Logic:

✅ **Green (Ready)** — Battery health is "Normal" or "Unsupported"

🔴 **Red (Not Ready)** — Battery health is "Service-Recommended" or "Non-Genuine"

⚪ **Gray (Unknown)** — Battery health is "Unknown" or unable to retrieve battery data

Tile Display:

Status color/icon — Based on battery health (Normal/Service-Recommended/Non-Genuine/Unknown/Unsupported)

Subtitle — Shows battery health issue if present, otherwise shows current charge percentage

Detail view — Shows charge level, charging state, Low Power Mode, battery health status, and recommendations

Health Status Values:

Normal — Battery is functioning properly (Green)

Service-Recommended — Battery capacity has degraded, replacement recommended (Red)

Non-Genuine — Non-Apple battery detected, replacement recommended (Red)

Unsupported — Battery health monitoring not available on this device model (Green, shows charge % only)

Unknown — Health data not yet available from iOS (Gray, shows charge % only)

Notes:

• Battery health data comes from Declarative Device Management (DDM)

• New devices may show "Unknown" until iOS calculates health metrics (typically after a few charge cycles)

• Charge percentage is always displayed in the subtitle or detail view

• This device status focuses on battery HEALTH; use Power Source tile for charge LEVEL monitoring with thresholds

Thermal State

Monitor device temperature in real-time using local iOS APIs (no MDM calls required).

Example:

<key>device-checker-thermal-enabled</key>
<string>YES</string>

Status Logic:

✅ **Green (Nominal)** — Normal operating temperature, all features operating normally

⚠️ **Yellow (Fair)** — Slightly elevated, system defers background work like prefetching/indexing

🔴 **Red (Serious)** — High temperature, CPU/GPU throttling active, frame rates may drop to 30 FPS

🔴 **Red (Critical)** — Device critically hot, significant throttling, camera/flash/speaker may disable, risk of shutdown

Use Cases:

• Field devices in hot environments (vehicles, outdoor work)

• Users running intensive apps (video recording, AR)

• Proactive warnings before thermal shutdowns

• Understanding performance throttling

Notes:

• Real-time monitoring via iOS ProcessInfo API

• No API calls or battery drain

• Updates instantly when thermal state changes

Performance (Memory & CPU)

Monitor device memory pressure and CPU usage using local iOS APIs with configurable thresholds.

Example:

<key>device-checker-performance-enabled</key>
<string>YES</string>
<key>device-checker-memory-warning</key>
<string>70</string>
<key>device-checker-memory-critical</key>
<string>85</string>
<key>device-checker-cpu-warning</key>
<string>60</string>
<key>device-checker-cpu-critical</key>
<string>80</string>

Status Logic:

🔴 **Red (Critical)** — Memory OR CPU ≥ critical threshold

⚠️ **Yellow (Warning)** — Memory OR CPU ≥ warning threshold (but < critical)

✅ **Green (Ready)** — Both memory AND CPU < warning thresholds

Notes:

• Updates every 5 seconds when tile is visible

• Monitoring pauses when app is in background (to save battery)

• No remote API calls required — entirely local monitoring

• Uses os_proc_available_memory() for memory, host_statistics() for CPU

Network Status

Monitor WiFi, Ethernet, and cellular connectivity status.

Example:

<key>device-checker-wifi-enabled</key>
<string>YES</string>
<key>device-checker-cellular-enabled</key>
<string>YES</string>
<key>device-checker-network-speed-enabled</key>
<string>YES</string>

Network Speed Test Details:

Purpose: On-demand diagnostic tool to measure download/upload speeds and latency

Data Usage: ~10-15 MB per test (10 MB download + 2 MB upload + overhead)

Test Duration: ~15-20 seconds for complete test

Availability: Button shown in WiFi and Cellular detail views when interface is connected

Cellular Warning: Automatic alert shown before every test on cellular connection (to warn about data usage)

Results: Download speed (Mbps), upload speed (Mbps), latency (ms)

User Experience: Button in network detail views triggers test, progress indicator shown during test

Use Cases: Field workers verifying connectivity, troubleshooting slow performance, validating bandwidth requirements

Note: Speed test results are informational only and do not affect device readiness status

Internet Connectivity Test (WiFi, Ethernet, and Cellular)

Lightweight test to verify actual internet reachability vs just interface connectivity.

Example:

<key>device-checker-internet-connectivity-test-enabled</key>
<string>YES</string>
<key>device-checker-internet-connectivity-test-timeout</key>
<string>5</string>
<key>device-checker-internet-connectivity-test-cache-ttl</key>
<string>60</string>

How It Works:

• Sends lightweight HEAD request to Apple's captive portal endpoint (~200-500 bytes)

• Tests run automatically when:

  • Interface connects (WiFi joins network, Ethernet adapter plugged in, Cellular enabled)

  • Network detail views are opened (if interface connected and cache expired)

• Results cached: 30 seconds for WiFi/Ethernet, 60 seconds minimum for cellular (to save data)

• Network tiles show yellow/warning status if connected but no internet detected

• Per-interface caching and testing (WiFi, Ethernet, and Cellular each tested independently)

Status Behavior by Interface:

WiFi:

• Green (Ready): WiFi connected with internet access verified

• Yellow (Warning): WiFi connected but internet not accessible (captive portal, routing issue)

• Red (Error): WiFi not connected

• Subtitle: Changes to "Connected (No Internet)" when yellow

• Detail View: Shows "Yes (Xs ago)" with latency (e.g., "42 ms") when internet accessible

Ethernet:

• Green (Ready): Ethernet connected with internet access verified

• Yellow (Warning): Ethernet connected but internet not accessible (routing/firewall issue)

• Red (Error): Ethernet not connected

• Subtitle: Changes to "Ethernet (No Internet)" when yellow

• Detail View: Shows "Yes (Xs ago)" with latency when internet accessible

Cellular:

• Green (Ready): Cellular enabled with internet access verified

• Yellow (Warning): Cellular enabled but internet not accessible (carrier issue, account problem)

• Red (Error): Cellular not available or disabled

• Subtitle: Changes to "Enabled (No Internet)" when yellow

• Detail View: Shows "Yes (Xs ago)" with latency when internet accessible

Use Cases:

• WiFi: Detecting captive portal networks requiring authentication (hotels, airports, coffee shops)

• Ethernet: Identifying enterprise network routing/firewall issues on wired connections

• Cellular: Troubleshooting carrier network issues, validating cellular data is working

• All: Distinguishing "connected to network" from "has internet access"

Data Usage:

• ~200-500 bytes per test (vs 12 MB for speed test)

• WiFi/Ethernet with 30-second cache: <100 KB/day typical usage

• Cellular with 60-second cache: <50 KB/day typical usage (longer cache to minimize cellular data)

Status Logic Without Internet Connectivity Test:

WiFi:

✅ **Green (Connected)** — Connected to WiFi network

🔴 **Red (Not Connected)** — Not connected to WiFi

Cellular:

✅ **Green (Ready)** — Cellular data available

⚠️ **Yellow (Warning)** — Cellular access restricted (Settings > Cellular Data toggle off)

🔴 **Red (Error)** — Cellular not available

Jamf Setup Extension Attribute

Display on-duty/off-duty status from a Jamf Pro extension attribute.

Example:

<key>device-checker-jamf-setup-ea-enabled</key>
<string>YES</string>
<key>device-checker-jamf-setup-ea-name</key>
<string>Jamf Setup</string>
<key>device-checker-jamf-setup-ea-on-duty-value</key>
<string>On-duty</string>
<key>device-checker-jamf-setup-ea-off-duty-value</key>
<string>Off-duty</string>

Status Logic:

✅ **Green (Ready)** — EA value matches on-duty value

⚠️ **Yellow (Warning)** — EA value matches off-duty value

⚪ **Gray (Unknown)** — EA not found or value doesn't match either configured value

Notes: - Requires custom extension attribute in Jamf Pro - Extension attribute must be populated by Jamf Setup or other method

Auto-Refresh Throttling

Control how often the app automatically refreshes when returning from background.

Example:

<key>device-checker-auto-refresh-threshold</key>
<string>300</string>

Behavior:

Default (300 seconds / 5 minutes): If user switches apps and returns within 5 minutes, no auto-refresh occurs

Custom threshold: Set to desired seconds (60-3600)

Disable throttling: Set to 0 to always refresh when app becomes active

Always refreshes (throttling bypassed):

• First activation after app launch (to restore data after force quit)

• When in pending state (waiting for app installations — auto-refreshes every 2 minutes)

• Manual refresh button taps

• Timer expiration during pending state

Pending State Behavior:

When the Apps tile enters "Pending" state (after user taps "Update Apps"), the app automatically checks device status every 2 minutes until all required apps are installed. This ensures users see updated status as soon as installations complete, regardless of the auto-refresh threshold setting.

Configuration Examples

Minimal Configuration (Default Settings)

Perfect for quick testing or basic deployments.

<dict>
  <!-- Required keys (auto-populated) -->
  <key>JPS_URL</key>
  <string>$JPS_URL</string>
  <key>JSSID</key>
  <string>$JSSID</string>
  <key>MANAGEMENTID</key>
  <string>$MANAGEMENTID</string>
  <key>OAUTH_AUTH_CODE</key>
  <string>$OAUTH_AUTH_CODE</string>
  <key>APP_CONFIG_REINSTALL_CODE</key>
  <string>$APP_CONFIG_REINSTALL_CODE</string>

  <!-- Enable OS monitoring only -->
  <key>device-checker-os-enabled</key>
  <string>YES</string>
  <key>device-checker-os-min-version</key>
  <string>18.0</string>
</dict>

Full Configuration

Comprehensive setup with branding, multiple device status checks, and custom thresholds.

<dict>
  <!-- Required keys (auto-populated) -->
  <key>JPS_URL</key>
  <string>$JPS_URL</string>
  <key>JSSID</key>
  <string>$JSSID</string>
  <key>MANAGEMENTID</key>
  <string>$MANAGEMENTID</string>
  <key>OAUTH_AUTH_CODE</key>
  <string>$OAUTH_AUTH_CODE</string>
  <key>APP_CONFIG_REINSTALL_CODE</key>
  <string>$APP_CONFIG_REINSTALL_CODE</string>

  <!-- Branding -->
  <key>device-checker-branding-image-url</key>
  <string>https://yourcompany.com/logo.png</string>
  <key>device-checker-branding-image-height</key>
  <string>60</string>

  <!-- OS Readiness -->
  <key>device-checker-os-enabled</key>
  <string>YES</string>
  <key>device-checker-os-min-version</key>
  <string>18.0</string>
  <key>device-checker-os-deadline</key>
  <string>2026-12-31</string>

  <!-- App Readiness -->
  <key>device-checker-apps-enabled</key>
  <string>YES</string>
  <key>device-checker-apps-list</key>
  <string>Slack,com.tinyspeck.chatlyio,24.0.0,2026-06-01|Microsoft Teams,com.microsoft.skype.teams,5.0.0,2026-09-01</string>

  <!-- Device Health Tiles -->
  <key>device-checker-power-source-enabled</key>
  <string>YES</string>
  <key>device-checker-power-source-warning</key>
  <string>30</string>
  <key>device-checker-power-source-critical</key>
  <string>15</string>

  <key>device-checker-storage-enabled</key>
  <string>YES</string>
  <key>device-checker-storage-warning</key>
  <string>70</string>
  <key>device-checker-storage-critical</key>
  <string>85</string>

  <key>device-checker-battery-enabled</key>
  <string>YES</string>

  <key>device-checker-thermal-enabled</key>
  <string>YES</string>

  <key>device-checker-performance-enabled</key>
  <string>YES</string>
  <key>device-checker-memory-warning</key>
  <string>75</string>
  <key>device-checker-memory-critical</key>
  <string>90</string>
  <key>device-checker-cpu-warning</key>
  <string>70</string>
  <key>device-checker-cpu-critical</key>
  <string>85</string>

  <key>device-checker-wifi-enabled</key>
  <string>YES</string>
  <key>device-checker-cellular-enabled</key>
  <string>NO</string>

  <!-- Network Speed Test (optional - disabled by default) -->
  <key>device-checker-network-speed-enabled</key>
  <string>NO</string>

  <!-- Internet Connectivity Test (optional - disabled by default) -->
  <key>device-checker-internet-connectivity-test-enabled</key>
  <string>NO</string>
  <key>device-checker-internet-connectivity-test-endpoint</key>
  <string>http://captive.apple.com/hotspot-detect.html</string>
  <key>device-checker-internet-connectivity-test-timeout</key>
  <string>3</string>
  <key>device-checker-internet-connectivity-test-cache-ttl</key>
  <string>30</string>

  <!-- Jamf Setup EA -->
  <key>device-checker-jamf-setup-ea-enabled</key>
  <string>YES</string>
  <key>device-checker-jamf-setup-ea-name</key>
  <string>Device Status</string>
  <key>device-checker-jamf-setup-ea-on-duty-value</key>
  <string>Active</string>
  <key>device-checker-jamf-setup-ea-off-duty-value</key>
  <string>Spare Pool</string>

  <!-- UI Options -->
  <key>device-checker-alerts-url</key>
  <string>https://status.yourcompany.com</string>
  <key>device-checker-send-status-enabled</key>
  <string>YES</string>
  <key>device-checker-send-logs-enabled</key>
  <string>NO</string>
  <key>device-checker-status-tab-scrollable</key>
  <string>NO</string>

  <!-- Auto-Refresh (10 minutes) -->
  <key>device-checker-auto-refresh-threshold</key>
  <string>600</string>
</dict>

Legal

• Use Agreement: Application End User License Agreement
• Privacy Policy: Jamf Privacy Policy

Document Version

• Version: 1.1.1
• Last Updated: 2026-05-16
• App Version: 1.1.1