Skip to main content
Question

Jamf Pro- Making Baseline Configuration More Granular

  • February 28, 2026
  • 1 reply
  • 42 views
L
Forum|alt.badge.img+5

Hi folks,

I’m doing an audit of our config profiles and would like to break our baseline configuration profile into multi profiles. Right now, we have a massive baseline profile. If I need to edit a specific feature or settings, the whole profile gets push out everywhere.

I would like to create smaller profiles that are specific to subsets of settings so I have more granular control over updating settings and the distribution of those settings.

For example I may have profiles like the following as opposed to one massive profile:

Baseline- Network Usage
Baseline- Functionality
Baseline- Setup Steps
Baseline- Hidden Apps

I can certainly created those subset profiles now without any scope assigned. My question is whether people have suggestions on the best order of steps to accomplish this task without the world exploding :-)

For example, if I replicate everything currently in effect within multiple profiles, and I scope those new profiles to my all devices group, then I remove the current massive profile, what will happen? Will the removal of the current profile reverse settings from the newer smaller profiles?

Any advice appreciated.

Respectfully,

Robert

1 reply

Ecco_Luke
Forum|alt.badge.img+9
  • Ecco_Luke
  • Valued Contributor
  • March 6, 2026

When two profiles are installed with the same payload, the most restrictive profile wins. However, I’d advise that you use this issue to your advantage and migrate whatever you can over to DDM-based Blueprints in your environment. Then you’re killing two (metaphorical!) birds with one stone.

Blueprints work differently in that only the changed/removed payloads are affected when a profile is updated/removed, which is totally different to how config profiles work (where all payloads are affected at update/removal - thus the issue with ‘God’ profiles). So you can build ‘God’ Blueprints, but I’m always a fan of modularity for flexibility.

Definitely test on one Mac at first - scope your Blueprints and then exclude the ‘God’ profile once successfully installed. Have a USB-C to Ethernet cable or totally unproxied network on standby in case of any network dropout, but honestly you should be good 😊 

Terms & ConditionsCookie settingsAccessibility statement