Extension Attribute - List MDM Capable Users

With the declarative management changes in macOS 27, users will need to have MDM-capable accounts to receive certain blueprints. Because of this, tracking MDM-capable users is becoming increasingly important.

While Jamf Pro displays this information in Computer Inventory, there doesn’t appear to be a way to use it as criteria for a Smart Group. To address this, I’ve created an Extension Attribute to help track MDM-capable accounts in Jamf Pro. No API required!

 

#!/bin/bash

####################################################################################################
#
# Jamf Pro Extension Attribute: MDM Capable Users
#
# Author:   Brandon Woods
# Date:     2026-10-27
# Version:  1.0
#
# Reports the username(s) of the MDM-managed (MDM capable) user account(s) on this Mac.
#
# Method:
#   1. Pull the managed user GUID(s) from the "Managed User" entries in
#      system_profiler SPConfigurationProfileDataType. This works even when the
#      managed user is logged out.
#   2. If nothing is found there, fall back to mdmclient's ActiveManagedUsers
#      (only populated while the managed user is logged in).
#   3. Resolve each GUID to a short username with dscl (GeneratedUID lookup).
#
# Output:
#   <result>username</result>                 one managed user
#   <result>user1, user2</result>             multiple (e.g. network/mobile accounts)
#   <result>Unresolved: GUID</result>         GUID found but no matching local record
#   <result>None</result>                     no managed user found
#
# Based on:
#   https://derflounder.wordpress.com/2025/04/04/identifying-mdm-managed-user-accounts-on-macos-sequoia/
#   ekw's EA (2025-10-16) using system_profiler "Managed User"
#
# Data type in Jamf Pro: String
#
####################################################################################################

guidPattern='[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}'
managedUserGuids=""
managedUserList=""

# Step 1: system_profiler (works whether or not the managed user is logged in)
managedUserGuids=$(/usr/sbin/system_profiler SPConfigurationProfileDataType 2>/dev/null \
	| /usr/bin/grep "Managed User" \
	| /usr/bin/grep -oE "$guidPattern" \
	| /usr/bin/sort -u)

# Step 2: fall back to mdmclient ActiveManagedUsers (logged-in managed users only)
if [[ -z "$managedUserGuids" ]]; then
	managedUserGuids=$(/usr/libexec/mdmclient QueryDeviceInformation 2>/dev/null \
		| /usr/bin/awk '/ActiveManagedUsers/,/\);/' \
		| /usr/bin/grep -oE "$guidPattern" \
		| /usr/bin/sort -u)
fi

# Nothing found at all
if [[ -z "$managedUserGuids" ]]; then
	echo "<result>None</result>"
	exit 0
fi

# Step 3: resolve each GUID to a username
for userGuid in $managedUserGuids; do
	userName=$(/usr/bin/dscl . -search /Users GeneratedUID "$userGuid" 2>/dev/null \
		| /usr/bin/awk 'NR==1 {print $1}')

	if [[ -z "$userName" ]]; then
		userName="Unresolved: $userGuid"
	fi

	if [[ -z "$managedUserList" ]]; then
		managedUserList="$userName"
	else
		managedUserList="$managedUserList, $userName"
	fi
done

echo "<result>$managedUserList</result>"
exit 0