Check-In Date Vs. Inventory Update

Check in is how often the binary does a GET request to the jamf pro app. It will also update the check in time and the IP address of the system. System state information, like what apps are what versions are only updated at inventory submission.

Check-in Date is just that, it lists the last time the client has done a check-in with your JSS. This is the equivalent of running "sudo jamf policy" at the command line. It will check for any Policies and Patch Policies that apply to it at that moment, run them, and exit. On the Mac, this is triggered by a launch daemon with a time interval of whatever you have set in Jamf Pro Settings > Computer Management - Management Framework > Check-In. My memory is shot so I can't remember if I ever changed this on my JSS from the default, but I believe it's 15 minutes, though that's set on a random interval, so its around 15 minutes.

Inventory is how Jamf Pro decides what Policies to run, at least if you have your Policies scoped to smart groups, buildings, network segments, really anything other than the specific computer. It is also when the server receives full Inventory data from the client (Application usage, plugins, etc etc). Basically everything you see in a computer record in the web console is gathered during Inventory. This is the equivalent of running "sudo jamf recon" at the command line. Example output of that command:

Retrieving inventory preferences from https://yourjamfurl.com:8443/...
Finding extension attributes...
Locating hard drive information...
Locating applications...
Locating package receipts...
Locating software updates...
Locating plugins...
Locating accounts...
Locating printers...
Searching path: /System/Applications
Searching path: /var/root/Library/Internet Plug-Ins
Searching path: /private/var/jamf/Library/Internet Plug-Ins
Searching path: /Library/Internet Plug-Ins
Searching path: /Users/wmehilos/Library/Internet Plug-Ins
Searching path: /Applications
Locating hardware information (Mac OS X 10.15.5)...
Gathering application usage information...
Submitting data to https://yourjamfurl.com:8443/...
<computer_id>523</computer_id>

After a Check-In, as far as I can remember the only properties updated are the Last Check In and IP Address. If you need Inventory to update after a Policy, you can always kick off a recon using the "Update Inventory" checkbox in the Maintenance section of a Policy.

For your example, if you installed an app using a Policy, your Jamf Pro server wouldn't show that application in the computer's inventory record until the next Inventory Update. Let's build this example up a bit. Let's say you use Adobe Remote Update Manager to keep your Adobe CC products up to date, but you don't want to deploy it to machines that don't have any Adobe products installed. So you have an "Install Adobe Remote Update Manager" Policy, triggered once per computer at check-in. It is scoped to a Smart Group called "Macs with Adobe Products", whose search criterion is "Application Title Has Adobe*".

Client #1's user installs Photoshop, the first Adobe application to be installed on their Mac, using Self Service, three hours after that day's scheduled Inventory Update. Client #1 checks in, but the Jamf Pro server isn't going to tell it "hey you need to install Adobe Remote Update Manager", because as far as your server is concerned, Client #1 has no Adobe products installed, because it hasn't updated it's inventory since it's first Adobe application was installed. Remote Update Manager will install at the first check-in after the next day's Inventory Update, since it will finally belong to the Smart Group "Macs with Adobe Products". If you wanted to be sure that RUM gets installed very soon after Photoshop is installed, you should check the "Update Inventory" box for the Self Service policy that installs Photoshop. Hopefully that's not too contrived. Let me know if you need anything else clarified.

Thanks @wmehilos and @tlarkin for the super detailed response :)

Question:
Do we need an Inventory Update or just a Check In for JSS to see/detect a Mac has recently updated the system software?

An Inventory Update is needed to get the current system software. A check-in does not directly update inventory.

Today (June 17, 2021) I have a number of clients that are reporting a recent Inventory Update, but long past Check-In time.

Last Inventory Update: 4 minutes ago
Last Check-in: 11/11/2020 at 9:01 AM

I have no failed commands for these devices. What would be preventing them from checking in with the JSS?

Cheryl

I want to know this as well.  Should I be concerned that something is wrong on the endpoint?

I am discovering this pattern on several of my computers as well. As I understand it, wouldn't the computer have to do a Check-In before it could update inventory, considering Recon itself is a policy?