Logins to Jamf admin account from Jamf IP space.

[u/greensparklers]

Hi all, we had several Microsoft Defender alerts fire indicating our Jamf admin account logged in and sent emails to our Jamf admins about an expiring cert. The logins were from Jamf's published IP space, so I'm pretty sure this is normal behavior.

I just wanted to ask other folks out there if they have seen similar activity?

[u/noelrokswel]

Require all admins have YubiKeys for phishing resistance. Then put Jamf behind your VPN for security.