Jamf Protect

Connect Jamf Protect to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Jamf Protect:

   1. In Jamf Protect, go to Administrative › API Clients.
   2. Click Create API Client.
   3. Enter a name for the API client, such as Safeguard.
   4. Assign the minimum required permissions role: a read-only role.
   5. Save, then copy the API client password. Jamf Protect will not display it again.

   Where to find the other values:

   • Client ID: The API Client Configuration pane shown after the client is created.
   • Tenant: The Token and API Endpoints pane shows the Jamf Protect API URL; the tenant is the part before .protect.jamfcloud.com.

   Jamf Protect shows the secret only once, so copy it before you leave the page.

   Jamf Protect allows up to five API clients; delete one to add another. The fetched page says to assign the minimum required permissions role but does not name a read-only role.

   Source: learn.jamf.com, checked 2026-10-07.

   The permissions Safeguard needs: read-only role.

2. On Compliance › Connectors, open Jamf Protect, click Connect, choose API token and fill in:

   Field	What to enter
   Tenant	Required. The part before .protect.jamfcloud.com in your address.
   Client ID	Required.
   Password	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Jamf Protect and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Endpoint Detection & Response connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks