If you’ve spent enough time living inside Jamf Pro, you eventually run into the same problem: someone set a configuration somewhere, sometime, and nobody remembers where. It might be something obscure – a certificate payload, a conditional SSO predicate, or that one security preference quietly misbehaving on three machines in accounting. And when you have dozens of configuration profiles, each with multiple payloads, nested keys, and XML-wrapped values, finding that setting can feel like forensic archaeology.
We’ve all been there, scrolling through the Jamf UI, expanding payloads, repeatedly searching in the browser hoping to get lucky. Eventually you realize: I need a better way to search this stuff.
That’s why I built a Python script to search Jamf Pro’s configuration profiles directly via API. It pulls profile XML, looks for a search term, and tells you exactly which profiles match — whether they’re macOS or mobile, scoped or not, archived or active. It’s fast, it respects Jamf’s token-based auth model, and most importantly, it removes guesswork. I don’t like guesswork.
Why Create Another Jamf Profile Search Tool?
There are already ways to do this — but I wasn’t trying to reinvent the wheel. I was trying to build a reliable, script-driven tool for environments where automation, repeatability, and security matter.
I wanted three things specifically:
-
Modern authentication
Token-based auth instead of UI scraping or baking clear-text creds into scripts. -
Portability
Something that runs cleanly on macOS, Linux, inside CI, or as part of a security toolkit. -
Context-aware output
Not just “where is this key,” but whether the profile is enabled, scoped, or archived.
Sometimes you just need precision — and you want it fast.
Why Python?
Jamf admins love Bash, and for good reason — it’s everywhere, it’s powerful, and for quick hitters it’s great. But for API-heavy workflows, Python gives us:
- Reliable HTTP libraries
- Structured error handling
- Readable XML/JSON parsing
- Better automation support
- Stable environment for secrets handling
Python lets us use Jamf’s token model cleanly. No brittle parsing, no chained curl pipes, and no risking credentials in temp history.
It’s not just about speed — it’s about doing it right.
How It Works
You provide a search term, and the script:
- Authenticates to Jamf via token
- Retrieves all configuration profile XML
- Searches for the string case-insensitively
- Reports results with context
Usage example:
python3 jamf_profile_search.py \
--url https://yourorg.jamfcloud.com \
--user api_reader \
--pass "$JAMF_PASS" \
--term Kerberos
macOS-only:
python3 jamf_profile_search.py --term "FileVault" --which mac
See archived and unscoped configs:
python3 jamf_profile_search.py \
--term "SSO" \
--include-archived \
--include-unscoped-and-disabled
It’s a Jamf search engine without the click-scroll-repeat pain.
Featured Alternative: A GUI-Driven Profile Search
Not everyone wants to live in Terminal land — and that’s totally valid. One of the best community tools in this space is Scott Kendall’s Jamf Config Profile Search project.
Jamf Config Profile Search – GitHub Repository
Scott went the extra step and built a GUI, which makes it far more approachable for admins who prefer clicking to shell flags.
Download from his repo, launch the GUI, provide your Jamf URL and credentials, and you can search your profile XML without touching a command line. It’s friendly, fast for one-off inspections, and great for support staff or junior techs who just need visibility without needing to know regex or API internals.
Where Scott’s GUI Shines
- ✅ Easy to run with zero Python or pip installs
- ✅ No command flags to memorize
- ✅ Results visible in a window, not just stdout
- ✅ Fantastic for “find this setting right now” moments
- ✅ Lower barrier of entry for newer Jamf admins
Where Python Adds Value
My Python script shines when you need:
- CI/CD or automation support
- Token authentication workflows
- Audit logging / repeatable reporting
- Filtering (enabled, scoped, archived)
- Remote or containerized execution
GUI vs CLI isn’t a competition — it’s choice. Scott’s tool is approachable and visual. Mine leans into automation and scale. Use whichever aligns with your workflow. In fact, use both. I do.
Security Considerations
Security matters — especially when you start automating API access. This script:
- Uses short-lived token authentication
- Avoids printing credentials or tokens
- Supports environment-based secret injection
- Avoids local XML dumping by default
- Can run without placing credentials in history
You get transparency without tradeoffs — and that’s the goal.
Closing Thoughts
Visibility is the first step toward control — especially in tools like Jamf where config sprawl grows quietly over time. When things break, or worse, when they break silently, knowing exactly which profile holds which keys can save hours.
This script gives you clarity and confidence. Scott’s GUI gives you speed and accessibility. Both exist to make Jamf administration a little less mysterious, a little less tribal, and a lot more predictable.
If this helps you during a late-night “why is SSO breaking for only six machines?” debugging session, or before a large compliance audit, then it did its job.
And if it saves you from scrolling through XML at 5 PM on a Friday — you’re welcome.
Resources
-
Python Jamf Profile Search Script
https://github.com/jonbrown21/macOS-JAMF-Scripts/tree/main/Scripts/JAMF/Profile%20Search -
Scott Kendall’s Jamf Config Profile Search (GUI)
https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/JAMFConfigProfileSearch -
Jamf Classic API Authentication
https://developer.jamf.com/jamf-pro/docs/classic-api-authentication -
Python Requests Documentation
https://requests.readthedocs.io/en/latest/
Ready to take your Apple IT skills and consulting career to the next level?
I’m opening up free mentorship slots to help you navigate certifications, real-world challenges, and starting your own independent consulting business.
Let’s connect and grow together — Sign up here
AI Usage Transparency Report
AI Era · Written during widespread use of AI tools
AI Signal Composition
Score: 0.38 · Moderate AI Influence
Summary
A Python script for searching Jamf Pro's configuration profiles directly via API, providing a reliable and portable tool for environments where automation and security matter.
Related Posts
Automating JAMF Pro Email Notifications with SendGrid (Smart Group Driven Workflows)
Modern device management isn't just about enforcing policies—it's about communicating effectively with users at the right time. In JAMF Pro, Smart Groups give you powerful visibility into device state, but they don't natively solve the problem of proactive, automated user communication. Whether you're trying to prompt users to restart their machines, complete updates, or take action on compliance issues, bridging that gap requires a flexible and scalable notification system.
The Day I Unmanaged a Mac Into a Corner
There are a few kinds of mistakes you make as a Mac admin. There are the ones that cost you time, the ones that cost you sleep, and then there are the ones that leave you staring at a perfectly good laptop thinking, “How did I possibly make this *less* manageable by touching it?” These mistakes often stem from a lack of understanding or experience with macOS, but they can also be the result of rushing through tasks or not taking the time to properly plan and test.
Updating Safari on macOS with Jamf Pro: Three Practical Strategies
Keeping Safari updated is one of the simplest ways to harden a macOS fleet. Apple ships security fixes for Safari frequently, and those patches often land before a full macOS point release. This means that by keeping Safari up-to-date, you can ensure your users have access to the latest security protections without having to wait for a major operating system update. If Safari is lagging behind, your users are browsing the web with a larger attack surface than necessary.
Keeping Jamf Security Cloud Current for Microsoft 365: Updated Routing Policies
When I first wrote about troubleshooting Standard Routing Policies in Jamf Security Cloud, the goal was simple: help admins keep Microsoft Teams and Microsoft 365 traffic flowing smoothly through Jamf Trust + App-Based VPN. This straightforward objective remains unchanged, as the complexities of network configurations can often lead to frustrating issues that hinder productivity.
Cleaning House in Jamf Pro: A Friendly Auditor Script for Real-World Hygiene
There’s a tipping point in every Jamf Pro environment where the policy list begins to feel like a junk drawer. Everyone means well. Nobody deletes anything. And then, months later, you’re trying to answer simple questions like: *Which policies are actually scoped? What’s no longer referenced? Why are there five versions of the same script?* This post covers a small, practical script I wrote to help you **see** what’s stale, **explain** why it’s stale, and (optionally) **park** it safely out of the way—without deleting a thing.
Turn Jamf Compliance Output into Real Audit Evidence
Most teams use Apple’s macOS Security Compliance Project (mSCP) baselines because they scale and they’re repeatable. Jamf’s tooling makes deployment straightforward and the Extension Attribute (EA) output is a convenient place to capture drift. What you don’t automatically get is the artifact an auditor will accept on a specific date—an actual document you can file that shows which endpoints are failing which items, plus a concise roll-up of failure counts you can act on. Smart Groups answer scope; they don’t produce evidence.
The Power of Scripting App Updates Without Deploying Packages
Keeping macOS environments up-to-date in a seamless, efficient, and low-maintenance way has always been a challenge for IT admins. Traditional package deployment workflows can be time-consuming, prone to versioning issues, and require extensive testing and repackaging. This can lead to frustration and wasted resources as IT teams struggle to keep pace with the latest updates and patches. But there's another way—a more elegant, nimble approach: scripting.
Detecting Invalid Characters and Long Paths in OneDrive on macOS
Microsoft OneDrive is widely used for syncing documents across devices, but on macOS, it can silently fail to sync certain files if they violate Windows filesystem rules — like overly long paths or invalid characters. This creates frustrating experiences for end users who don’t know why files aren’t syncing.
Using a script to Enable FileVault via JAMF: A Word of Caution
Enabling FileVault is a critical step in securing macOS devices, particularly in managed environments like schools, enterprises, and remote teams. For administrators using **Jamf Pro**, automating this process can simplify device onboarding and ensure compliance with disk encryption policies. This automation also helps reduce the administrative burden associated with manually configuring each device, allowing IT staff to focus on other tasks while maintaining a secure environment.
