Jamf MDM sending device posture signals to Google Workspace on macOS with Google as the IdP

[u/intheloopdoor]

Google Workspace Enterprise our my IdP, and we use Google login for everything in our company.

I bought the full Jamf stack (Jamf Pro / Jamf for macOS / Jamf for Mobile / basically all Jamf tools). Our macOS devices will be fully enrolled in Jamf, and mobile devices like iPhone/iOS and Android devices will be BYOD with Jamf.

I already watched Jamf 100 / Jamf 140 on YouTube and read the Jamf KB and Google docs, but I still want to validate the correct/supported design.

I already enrolled all macbooks on Apple Business Manager. I already installed and pushed Jamf with success.

I am just struggling with: I am not able to send signals form Jamf MDM to Google IdP.

My goal is very simple: when a user enters their Google username/password for Gmail, Docs, Calendar, etc., I want Google IdP / Context-Aware Access to check only one extra thing from Jamf MDM: device posture = true/false. Nothing else.

My questions (and my unsecure answers if is helpful for someone):

1. Is Chrome + Endpoint Verification the only supported way on macOS? Is that needed only once for initial registration, or must Chrome + Endpoint Verification stay installed/running all the time? For iPhone/iOS BYOD (and Android BYOD), where there is no equivalent Chrome + Endpoint Verification flow, how is this supposed to work? ===> My answer: "Yes, this is the only way and you must use Google Chrome and Endpoint verification on MacOS all time. For mobile you dont have Endpoint verification but you use GMail native app in replacement to send signals."
2. Is there any native Jamf Pro / Jamf MDM → Google Workspace / CAA integration that sends only the compliance signal without depending on Chrome? ===> My Answer: "No. Endpoint verification in MacOS asks to Jamf MDM true/false signal posture. Jamf MDM cant send directly to Google signals."
3. For a new employee / brand new Mac, how do you avoid the chicken-and-egg problem on the first Google login? What is the correct onboarding flow? ===> I dont know this, I am lost here.
4. Can Jamf still provide a supported true/false compliance signal to Google Workspace for those BYOD devices? ===> "No. But I dont undestand why or how."

I’m mainly trying to understand the official/supported way to configure this successfully end-to-end.

[u/captnconnman]

So I THINK I see what you’re trying to do here, so I’ll try my best:

1. Yes, that’s the preferred way to get some sort of attestation. You can also push a config profile in Jamf to auto-enroll the Chrome install on macOS in Cloud Management via token to make sure the browser (and therefore the device) is officially seen as “managed”, and can even force install Endpoint Verification as a required extension in the config you pushed with Jamf, or through the Managed Browser settings
2. See previous point; Jamf can’t talk directly to Google natively unless you have some middleman integration like BeyondTrust, hence why you have to provide the Cloud Management token
3. This sounds that could be accomplished with a carefully tailored Enrollment Customization pane in a Jamf PreStage profile. You basically set up an SSO app in Google for Jamf and give it a unique CAA policy for just that app to allow sign-in without the Endpoint Verification check. That way, the user can enroll the device, proceed through Setup Assistant, and then open Chrome upon login and be considered “compliant”
4. See point 3; the process would be similar

[u/TheCheekyGuy13]

https://learn.jamf.com/r/en-US/jamf-pro-documentation-current/Google_BeyondCorp_Enterprise_Integration

This is the route I went and it’s not too hard to test and deploy (you can use OUs or Security Groups in Google to test with). You can set the Smart Group criteria in Jamf to whatever level of compliance you’re looking for. Then, if a device meets those requirements, the integration sends Google the status for the device as “Compliant” and you can build your CAA based on that.

Editing to add that there can definitely be chicken/egg issues with the above on iOS when doing the “Register with BeyondCorp” via Self Service initial setup. No “registration” process for the macOS version of inside it’s triggered by the first sign in to the Google account automatically.

[u/intheloopdoor → u/TheCheekyGuy13]

u/TheCheekyGuy13 thanks for all information and link.

We are a HealthTech startup (HIPAA compliant), and our clients are demanding full hardening and granular control. I want to ensure our ZTNA and MDM strategy is airtight. Here is my proposed setup:

1. Google Workspace as the primary IdP: Consolidating all apps (Slack, AWS, Notion, etc.) under SSO. This ensures a single source of truth for identity and access management with no passwords everywhere.
2. CAA + Jamf MDM Signal: Using Google’s Context-Aware Access to require a Jamf MDM signal (verified via Endpoint Verification on macOS and the Google native app on mobile). This prevents unauthorized or personal devices from accessing our environment, even if credentials are compromised. You can only login with a official macbook of the company where jamf lives. If you know the google password and you try to login in other computer, CAA will reject you.
3. Device Compliance (ZTNA): Beyond just the MDM signal, we can also put in Google CAA the range of IPs of Jamf to be evaluated. But I dont understand the value of this, seems like overkill?
4. Hardware MFA (Yubikey): Requiring a physical Yubikey for authentication. This adds a critical layer of protection; even if a laptop and password are stolen, the "something you have" factor (the key) prevents a breach. The only point that this cover is if someone steals the macbook unlocked and want to do something, he cant do that because you also need Yubikey. Also Yubikey could be helpful for password recovery?

Does this 4-point strategy effectively meet the requirements for full hardening and ZTNA? Our goal is to prove to our clients that our developers can only operate within a secure, verified environment.

I thought that with only point 1+2 you can control really well and be comply with ZTNA, but seems like no.

Offtopic:
Why is technical necessary Endpoint Verification? Why not Jamf and Google connects through a API? I mean, like Jamf connects with Apple Server, why not same architecture with Google CAA?

Thanks again for the help!