The short version
Before Jamf Pro 11.34.0, using Blueprints and compliance benchmarks required SSO, meaning a Jamf ID or federation to the customer's cloud identity provider. Blueprints and compliance benchmarks are features of the Jamf platform, and a local Jamf Pro user account could not use them because the Jamf platform had no record of the sign-in. Starting with Jamf Pro 11.34.0, local Jamf Pro user accounts sign in through Jamf’s identity broker, the identity service that the Jamf platform uses, so Jamf Pro users with local accounts can use Blueprints and compliance benchmarks without SSO. The username, the password, and the Jamf Pro login page are unchanged, and the Jamf Pro user takes no action.
The goal remains for all customers to adopt SSO, either by configuring sign-in with a Jamf ID or by federating with an identity provider of their choice. For customers that have not yet configured SSO or integrated an identity provider, this change gives those customers access to a limited set of Jamf platform capabilities within Jamf Pro.
Jamf will deprecate local logins in Jamf Pro in late 2027.
Why this matters now
Apple removed the MDM software update commands in OS 27, which shipped in September 2026. Jamf Pro customers can now manage software updates with Blueprints, and Blueprints requires a Jamf platform session. Jamf changed how local accounts sign in so that Jamf Pro users can use Blueprints without requiring SSO.
What happens, in order
-
With the release of Jamf Pro 11.34.0, Jamf enables the change gradually by region with a feature toggle. Jamf Pro tenants in different regions therefore receive the change at different times.
-
A Jamf Pro user with a local account signs in to Jamf Pro with the existing username and password, after the change is enabled for the region of that tenant.
-
If the Jamf Pro user account qualifies (see below), Jamf Pro migrates the account to a private user store that Jamf hosts for that tenant, in the region that matches the hosting region of the Jamf Pro tenant. The sign-in completes against the local password hash, and a background job then migrates the account using the password that the Jamf Pro user just entered, so the existing password continues to work and no password reset is required. Jamf Pro syncs the user password over an encrypted connection, and hashes the password when the password arrives. Jamf Pro also keeps the local password hash, so a fallback always exists. At each later sign-in, Jamf Pro authenticates the Jamf Pro user with the password, and Jamf issues a platform session when the password is correct.
-
If the Jamf Pro user account has an email address, the Jamf Pro user receives a one-time confirmation email from communication@jamf.com with the subject "You are connected to the Jamf platform." The email confirms that the Jamf Pro user is now enabled for platform access and invites the Jamf Pro user to set up a Jamf ID.
-
Blueprints and compliance benchmarks appear the next time the Jamf Pro user signs in to Jamf Pro. For an immediate effect, the Jamf Pro user can sign out of Jamf Pro and sign in again.
Why local accounts can now use Blueprints and compliance benchmarks
Blueprints and compliance benchmarks run on the Jamf platform, not inside Jamf Pro. Every request to a Jamf platform service must include a platform session. A platform session is a signed credential that Jamf issues when a person signs in through the Jamf platform identity broker. The credential states the identity of the person, confirms that the person authenticated, and names the Jamf Pro tenant that the credential applies to. Before 11.34.0, a local Jamf Pro user account signed in against Jamf Pro's own database, so the Jamf platform had no record of the sign-in, no platform session was issued, and the Jamf platform services had no way to learn that the Jamf Pro user had signed in. The Jamf platform services therefore rejected the requests.
What the migrated account is, and is not
The migrated account is a step toward SSO, either with a Jamf ID or with federation to the customer's identity provider, and the migrated account does not replace either. A Jamf ID or a federated identity is a Jamf-wide identity with stronger sign-in checks built in. The migrated account is an identity that the Jamf platform accepts for one Jamf Pro tenant only.
|
| Migrated Jamf Pro user account | Jamf ID or federated identity provider |
|---|---|---|
| Where the account works | That one Jamf Pro tenant | Across Jamf products |
| Blueprints, compliance benchmarks | Yes | Yes |
| MFA and passkeys | Not enabled | Enabled through the Jamf ID or through the identity provider |
| Single sign-on | Not available | Available |
| Groups and permissions in Jamf Pro | Managed in that Jamf Pro tenant | Managed in that Jamf Pro tenant |
Who is and is not affected
| Affected | Not affected |
|---|---|
|
|