> For the complete documentation index, see [llms.txt](https://learn.netmaker.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://learn.netmaker.io/integrations/mobile-device-management.md). # Mobile Device Management Sync device enrollment and compliance status from Intune, Jamf Pro, JumpCloud, or Iru into Netmaker. This section covers how to connect each provider. ## Overview Netmaker can pull device enrollment and compliance status from Mobile Device Management (MDM) platforms, giving you fleet-wide device posture visibility inside Netmaker itself. Supported platforms: * Microsoft Intune * Jamf Pro * JumpCloud * Iru (formerly Kandji) Each connector refreshes device data on a configurable sync interval. ## Configure an MDM Integration 1. Go to **Settings → Integrations → Mobile Device Management**.\

2. Select the provider you want to connect. 3. Enter the provider-specific connection details and credentials. 4. Test the connection. 5. Save the integration. ## **Provider-Specific Configuration** ### **Microsoft Intune** **Part A: Create the App Registration (Entra admin center)** **Step 1 — Open the right portal**\ Go to [`https://entra.microsoft.com`](https://entra.microsoft.com/) and sign in with an account that has **Global Administrator** or **Application Administrator** role. **Step 2 — Navigate to App registrations** * Left sidebar → **Entra ID** → **App registrations**

* Click **+ New registration** (top left, if you don't have one).

**Step 3 — Fill out the registration form**

Field	Value
Name	`Netmaker MDM Sync`
Supported account types	Accounts in this organizational directory only (Single tenant only - Default Directory)
Platform	Web
Redirect URI	https://api.{NM_BASE_DOMAIN}/api/oauth/callback

Click **Register**. **Step 4 — Copy your identifiers**\ On the app's **Overview** page, copy and store safely: * **Application (client) ID** * **Directory (tenant) ID** *** **Part B: Create a Client Secret** **Step 5 — Go to Certificates & secrets** * In the left sidebar of your app registration → **Certificates & secrets**

* Click **+ New client secret**

**Step 6 — Configure the secret**

Field	Value
Description	`Netmaker sync secret`
Expires	6–12 months (Microsoft recommends ≤12 months)

Click **Add**. **Step 7 — Copy the secret VALUE immediately** * A new row appears with **Value** and **Secret ID** columns * Copy the **Value** column now — it's only shown once and disappears on refresh * Store it securely (password manager / secrets vault) *** **Part C: Add API Permissions** **Step 8 — Go to API permissions** * Left sidebar → **API permissions**

* Click **+ Add a permission** **Step 9 — Select Microsoft Graph** * Click **Microsoft Graph**

* Click **Application permissions**

**Step 10 — Search and add these permissions** | Permission | Purpose | | ----------------------------------------- | ---------------------------- | | `DeviceManagementManagedDevices.Read.All` | Read device compliance/state | | `Device.Read.All` | Read device metadata | Check both boxes, then click **Add permissions**. **Step 11 — Grant admin consent** * Back on the API permissions page, click **Grant admin consent for \[Your Directory]** * Click **Yes** to confirm * Both permissions should now show a green checkmark under **Status** *(If this button is greyed out, your account lacks consent-granting rights — a Global Admin will need to do this step.)* *** **Part D: Connect in Netmaker** **Step 12 — Open the integration**\ **Settings**→ **Integrations → Mobile Device Management → Microsoft Intune → Connect**

**Step 13 — Enter credentials** | Field | Value | | ----------------------- | ----------------------------------- | | Tenant ID | Directory (tenant) ID from Step 4 | | Application (client) ID | Application (client) ID from Step 4 | | Client Secret | Value from Step 7 | **Step 14 — Test and connect** * Click **Test connection** — should return success if credentials + permissions are correct * If it fails, check: secret not expired, permissions have green checkmarks, correct tenant ID * Click **Connect** *** ### **Jamf Pro** **Part A: Create an API Role (Jamf Pro)** **Step 1 — Open the right settings**\ Log in to Jamf Pro as an admin → **Settings** (gear icon) → **System** → **API Roles and Clients** **Step 2 — Create the API Role** * Click the **API Roles** tab * Click **New** * **Display Name:** `Netmaker MDM Role` **Step 3 — Assign read-only privileges**\ Check these (read-only) privileges: | Privilege | Purpose | | ---------------------------------- | --------------------------------------- | | Read Computers | Read computer inventory | | Read Mobile Devices | Read mobile device inventory | | Read Computer Inventory Collection | Read detailed inventory/compliance data | Click **Save**. *** **Part B: Create an API Client** **Step 4 — Create the client** * Switch to the **API Clients** tab * Click **New** * **Display Name:** `Netmaker MDM Sync` * Under **API Roles**, attach the role you just created (`Netmaker MDM Role`) **Step 5 — Set token lifetime** * Set **Access Token Lifetime** (e.g. 30 minutes — Netmaker will re-authenticate automatically as needed) * Toggle **Enable API Client** on * Click **Save** **Step 6 — Generate the client secret** * On the client's detail page, click **Create secret** * Copy the **Client Secret** immediately — it's shown once and can't be retrieved again * Copy the **Client ID** shown on the same page *** **Part C: Connect in Netmaker** **Step 7 — Open the integration**\ Netmaker → **Integrations → Mobile Device Management → Jamf Pro → Connect**

**Step 8 — Enter credentials** | Field | Value | | ------------- | ------------------------------------ | | Jamf Pro URL | e.g. `https://yourorg.jamfcloud.com` | | Client ID | From Step 6 | | Client Secret | From Step 6 | **Step 9 — Test and connect** * Click **Test connection** * If it fails, check: client is enabled, role has the right read privileges, URL has no trailing slash * Click **Connect**

### **JumpCloud** **Part A: Generate an API Key (JumpCloud Admin Portal)** **Step 1 — Open the right settings**\ Log in to the **JumpCloud Admin Portal** **Step 2 — Navigate to Settings** * Click on **Settings**

* Open the **Service Accounts** tab

* Click **+ New** * Enter a name and assign the appropriate read-only role and permissions.

* **Click Configure to set the duration** **Step 3** * Copy the **Client ID** and **Client Secret**

*** **Part B: Connect in Netmaker** **Step 5 — Open the integration**\ **Settings**→ **Integrations → Mobile Device Management → JumpCloud → Connect**

**Step 6 — Enter credentials** | Field | Value | | ----------------- | ----------- | | **Client ID** | From Step 3 | | **Client Secret** | From Step 3 | **Step 7 — Test and connect** * Click **Test connection** * Click **Connect** *** ### **Iru (formerly Kandji)** #### **Part A: Create the API Token (Iru admin console)** **Step 1 — Open the right portal**\ Log in to Iru at your org's console URL (e.g. `https://acme.iru.com`) with an **Admin or Owner** account. **Step 2 — Navigate to API Tokens Tab** * Left sidebar → **Access**

* Click on the **API Token** tab **→ Add Token**

**Step 3 — Fill out the token form**

Click **Create**. **Step 4 — Copy the token immediately** * The token value is shown once, right after creation * Copy it and check the confirmation box acknowledging you've saved it

* Store it securely (password manager / secrets vault) — it cannot be retrieved again *** #### **Part B: Configure Token Permissions** **Step 5 — Go to permission configuration** * After creating the token, click **Next** → **Configure**

**Step 6 — Grant read-only scopes** | Permission | Purpose | | -------------------------- | ----------------------------------------------- | | Device List | Enumerate enrolled devices | | Device Details / Device ID | Per-device metadata (OS, serial, last check-in) | | Device Library Items | Compliance/policy pass-fail status |

**Step 7 — Save**\ Click **Save** to apply the permissions to the token. *** #### **Part C: Get Your API URL** **Step 8 — Copy the API URL** * Still under **Settings → Access → API tokens tab** , locate your organization's **API URL**

* Format depends on region: | Region | Format | | ------ | --------------------------------------------------------------------------------- | | US | `https://SubDomain.api.iru.com` (legacy: `https://SubDomain.api.kandji.io`) | | EU | `https://SubDomain.api.eu.iru.com` (legacy: `https://SubDomain.api.eu.kandji.io`) | Copy the full URL. *** #### **Part D: Connect in Netmaker** **Step 9 — Open the integration**\ **Settings** → **Integrations → Mobile Device Management → Iru → Connect**

**Step 10 — Enter credentials** | Field | Value | | ---------------------------------------- | ------------------------------------------------------------ | | API URL | URL from Step 8 | | API Token | Token from Step 4 | | Compliance library item IDs *(optional)* | Comma-separated IDs to limit synced checks; blank = sync all | | Enable periodic sync | Toggle on for scheduled refresh | | Sync interval (minutes) | Default 60 | **Step 11 — Test and connect** * Click **Test connection** — should return success if the URL and token are valid * If it fails, check: token not revoked, permissions include Device List, correct region in URL * Click **Connect** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://learn.netmaker.io/integrations/mobile-device-management.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.