> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Protect Jamf Administration
> Model Jamf administration and sensitive managed Mac boundaries as Privilege Zones for focused analysis.
Endpoint management platforms can create powerful control relationships. In Jamf Pro environments, users, groups, scripts, API integrations, sites, and computers may influence managed macOS endpoints. Some endpoints may also be more sensitive than others because of who uses them, what data they access, or what administrative roles they support.
Privilege Zones can help teams organize Jamf-related risk around high-impact administrators, scripts, integrations, sites, or managed device groups.
## Scenario
An organization uses Jamf Pro to manage macOS endpoints across executive users, engineers, administrators, and general employees. The security team wants to understand whether lower-privileged Jamf users, groups, scripts, or integrations can influence sensitive endpoints or administrative workflows.
The team creates a Privilege Zone around the most important Jamf objects. Depending on the organization, that zone may include:
* Jamf administrators
* High-impact Jamf groups
* Scripts with privileged execution
* API integrations
* Executive or administrator device groups
* Sites or policies tied to sensitive endpoints
* Managed devices used by privileged users
The objective is to understand which Jamf identities and relationships can influence sensitive managed endpoints.
## What this can reveal
* Jamf users or groups with broader administrative reach than expected
* Scripts or policies that can influence sensitive devices
* API integrations with powerful permissions
* Delegated administration paths that cross intended boundaries
* Exposure from endpoint management into identity or application administration
## Why this works
As organizations add Jamf data to BloodHound Enterprise, endpoint management becomes part of the attack path picture. Privilege may exist in the ability to manage devices, run scripts, modify policies, or influence endpoints used by privileged users.
Privilege Zones can help security, endpoint, and infrastructure teams define which Jamf objects deserve closer analysis and ongoing monitoring.
## Suggested workflow
1. Identify the Jamf users, groups, scripts, integrations, and sites that matter most.
2. Identify sensitive managed device groups, such as administrator, developer, or executive endpoints.
3. Create a [zone](/analyze-data/privilege-zones/zones) around the high-impact Jamf objects.
4. Review [attack path](/analyze-data/findings/attack-paths) into the zone.
5. Validate findings with endpoint management and security teams.
6. Reduce unnecessary administrative reach.
7. Use the zone to support ongoing endpoint management governance.
## Starter Cypher queries
These example Cypher queries help you identify candidate objects for zones and labels during discovery, trials, and early implementation.
Review and tune these queries before using them as production Privilege Zone rules.
### Jamf tenant
```cypher theme={null}
MATCH (n:jamf_Tenant)
RETURN n
LIMIT 1000
```
### Jamf Tier Zero principals
```cypher theme={null}
MATCH (n)
WHERE n.tier = 0
AND n.primarykind STARTS WITH 'jamf'
RETURN n
LIMIT 1000
```
### All Jamf computers
```cypher theme={null}
MATCH (n:jamf_Computer)
RETURN n
LIMIT 1000
```
### All Jamf groups
```cypher theme={null}
MATCH (n:jamf_Group)
RETURN n
LIMIT 1000
```
### Jamf API client immediate edges
```cypher theme={null}
MATCH p=(s:jamf_ApiClient)-[]->(t)
RETURN p
LIMIT 1000
```
### Jamf account paths
```cypher theme={null}
MATCH p=(s:jamf_Account)-[*1..4]->(t)
RETURN p
LIMIT 1000
```
### Jamf account to tenant edges
```cypher theme={null}
MATCH p=(s:jamf_Account)-[]->(t:jamf_Tenant)
RETURN p
LIMIT 1000
```
### Jamf group edges to accounts
```cypher theme={null}
MATCH p=(s:jamf_Group)-[]->(t:jamf_Account)
RETURN p
LIMIT 1000
```
### Tier One to Tier Zero Jamf paths
```cypher theme={null}
MATCH p=(s:jamf)-[r*1..5]->(t:jamf)
WHERE s.tier = 1
AND t.tier = 0
AND s.primarykind <> 'jamf_Tenant'
AND s.primarykind <> 'jamf_Site'
RETURN p
LIMIT 1000
```
### Direct Tier One to Tier Zero Jamf edges
```cypher theme={null}
MATCH p=(s)-[]->(t)
WHERE s.tier = 1
AND t.tier = 0
AND s.primarykind STARTS WITH 'jamf'
AND t.primarykind STARTS WITH 'jamf'
RETURN p
LIMIT 1000
```
### Jamf sensitive endpoint discovery
```cypher theme={null}
MATCH (n:jamf_Computer)
WHERE toUpper(coalesce(n.name, '')) CONTAINS 'EXEC'
OR toUpper(coalesce(n.name, '')) CONTAINS 'ADMIN'
OR toUpper(coalesce(n.name, '')) CONTAINS 'ENG'
OR toUpper(coalesce(n.name, '')) CONTAINS 'DEVELOPER'
OR toUpper(coalesce(n.name, '')) CONTAINS 'SECURITY'
RETURN n
LIMIT 1000
```
## Guidance
Jamf zones should be developed with the endpoint management team. The security team may understand the risk, but the endpoint team usually understands which scripts, policies, integrations, and sites are operationally sensitive.
## Key takeaway
Privilege Zones can extend Attack Path Management into endpoint administration by helping teams define and monitor the Jamf objects that create control over sensitive devices.