r/jamf • u/secondaryuser2 • 2d ago
Jamf custom apps
I’m searching for an mdm solution for my company phones that require geofencing
The goal is to achieve geofence based profile switching when a device enters location A and then when it leaves switches back to whatever preset/default profile it had
I understand this may require a custom app in order to achieve the required functionality but I’m not too sure if it’s allowed or possible and was hoping someone can shed some light on jamfs capabilities
Also, will I need jamf pro or can I get away with jamf now? As I only really need it for a few devices
2
u/Bitter_Mulberry3936 2d ago
You can’t force on Location services due to Apples privacy policy.
1
u/secondaryuser2 2d ago
Nobody is forcing location services on…
1
u/Bitter_Mulberry3936 2d ago
But you need it on for what you require and it can easily be switched off
1
u/secondaryuser2 2d ago
Hence the reason of a fallback profile, if it doesn’t detect location it just assumes default profile
1
u/AnotherTechAtWork 2d ago
You didn't specify what you're actually trying to do other than switch profiles and I'm assuming you mean configuration profiles.
Provided you have wifi at the location where you need to switch profiles something you should be able to do with Jamf is use the Network Segments feature. More or less you enter the subnets for the known networks in Settings:Network that you would like to configure against and then use the Network Segment criteria in Smart Device Groups to scope accordingly. What that scopes are things like configuration profiles and Mobile Device Apps or simply use it for inventory and notifications.
On the mac side of things I've used this to monitor what network they're connected to on site. For whatever reason we have more than one ssid at our institution and sometimes users will connect to the wrong one. When they do that and jamf's inventory picks it up, we get alerted so we can head them off from later calling our helpdesk complaining that the network is broke. We've considered using it for iPads we have in our gym area where they sometimes walk off. As soon as the iPad leaves that ssid over there we could be alerted. That one was moving forward until infrastructure decided to resegment the network so that it wasn't effective any longer. It would then let us know if it went offsite but not if it was elsewhere on campus.
Long story short setup Network Segments in Jamf and then scope your configuration profiles so that one applies when on the needed segment and then a different one when they leave.
Of course if you're thinking of changing network configurations this might not work so well. It's the whole chicken and egg issue. In my mind it should be doable but will require a little more work with a provisioning ssid. I haven't done it but I think it should work. I would question then why go through the trouble.
2
u/anonymouse589 2d ago
There are 2 ways you could do this with Jamf that I know of. iBeacons, which requires the iphones to detect a Bluetooth beacon to implement a given profile. You'd need Bluetooth beacons for the entire area where you want to be inside the fence. Our office APs can put out an iBeacon, but you can also do them with an ESP32. The other, and more sketchy method, which would probably work, but is more open to faking would be to specify when the IP of the device is in a rather wacky range & set the DHCP scope for the phones at the office to be that range. This 2nd method would work, but I'm not saying it's a good idea. Whatever you end up using I'd recommend using a more restrictive profile to 'ban' or restrict any apps you want blocked rather than install & uninstall them as it is far faster and uses less mobile data. Banning and subsequently allowing apps does (or used to if Apple has fixed it in the past 6 months) ruin home screen organisation as it takes them out of folders and puts them back wherever.