Jamf-Concepts/terraform-provider-jamfplatform v0.29.0

v0.29.0: the Jamf Platform API GA release

on GitHub

The Jamf Platform API reached general availability on 3 September 2026, and this release targets it.

Every configuration written against the public beta needs work before it will plan. The beta gateway has been retired and beta credentials revoked, so v0.28.1 and earlier can no longer reach the Platform API at all.

What you must do

For full details, see: Upgrading to the Platform API GA.

1. Register a replacement API integration in Jamf Account and take its credentials. You cannot migrate a beta client. (how)
2. Register it environment-scoped, and replace tenant_id with environment_id.
3. Set base_url to https://{region}.api.jamfcloud.com.
4. Back up state, then terraform state rm jamfplatform_pro_api_client and jamfplatform_pro_api_role. Until you do, every operation in the workspace fails.
5. Delete the configuration blocks for the removed data sources, list resources and MDM command actions, listed under Breaking changes.

terraform {
  required_providers {
    jamfplatform = {
      source  = "Jamf-Concepts/jamfplatform"
      version = ">= 0.29.0"
    }
  }
}

provider "jamfplatform" {
  base_url       = "https://eu.api.jamfcloud.com" # or us., or apac.
  environment_id = var.jamf_environment_id
}

Track the latest release rather than pinning a version. The platform services behind this provider are updated on a schedule of their own, so a pinned provider drifts away from the API it talks to. A workspace pinned to a 0.29.0-rc.* candidate should move to 0.29.0.
Thank you to everyone who ran the provider during the public beta. Bug reports and feedback from beta participants shaped a substantial part of this release, including environment scope, proxy support and a range of resource behaviour.

Breaking changes

Several endpoints were unpublished at GA, so the constructs built on them have been removed: the jamfplatform_pro_api_client and jamfplatform_pro_api_role resources, with their data sources and list resources, and the jamfplatform_pro_api_role_privileges data source. Jamf Pro API roles and clients remain available through the Jamf Pro UI and API.

Fourteen MDM command actions have been removed: device_lock, enable_lost_mode, disable_lost_mode, play_lost_mode_sound, enable_remote_desktop, disable_remote_desktop, clear_restrictions_password, clear_passcode, delete_user, log_out_user, unlock_user_account, set_auto_admin_password, trigger_enhanced_log_collection and cancel_enhanced_log_collection.

environment_id joins tenant_id, and you set one or the other. Prefer environment_id: one integration covers a group of tenants across products, and it is the only scope that can hold the blueprint and compliance-benchmark permissions. Set neither to reach the new jamfplatform_account_* family, which nothing else reaches.

Four attribute changes, each covered in the guide:

• jamfplatform_cbengine_benchmark resource and data source: target_device_group removed. Use target_device_groups.
• jamfplatform_pro_patch_software_title resource and data source: category_name and site_name removed. On the resource, category_id and site_id no longer accept "0"; use -1 to clear.
• jamfplatform_security_cloud_uem_connect resource: unmanaged_sync_threshold is now read-only. Delete the line from your configuration.
• jamfplatform_pro_app_installer_titles data source: titles[*] drops thirteen attributes. Read them from the jamfplatform_pro_app_installer_title data source instead.

Two App Installer schema descriptions were corrected. quit_delay is in minutes, not seconds, so quit_delay = 300 is five hours. selected_version holds the version you pinned when update_behavior is MANUAL, and sits empty when it is AUTOMATIC.

New construct families

Jamf Security Cloud, jamfplatform_security_cloud_*: custom DNS zones, search domains and hostname mappings; ZTNA gateways, grouped gateways and access policy apps; device groups; UEM Connect; activation profiles; content categories. Read Jamf Security Cloud.

Jamf Account, jamfplatform_account_*: SSO domains and the identity provider connections that sign users in for them. The provider's first organization-scoped family, served only from the US gateway. Several behaviours come from Jamf Account rather than from the provider, including replacement on any connection change. Read Jamf Account single sign-on.

Jamf AI Governance, jamfplatform_ai_governance_*: the settings a blueprint delivers to Claude Code, Claude Desktop or OpenAI Codex, plus the product catalogue. Environment scope only. Read AI Governance policies.

Also in this release

• Reverse proxy support: custom_headers and authorization_header_name. See Reverse proxies and custom headers.
• A jamfplatform_pro_tenant_id data source, resolving the Jamf Pro tenant identifier from the configured scope.
• jamfplatform_pro_patch_software_title now uses Jamf Pro's current patch configuration endpoints. App Installer gains retry and version-update actions, and a version argument for reading a historical version of a title.
• The jamfplatform_pro_patch_policy list resource now warns about any policy it could not enumerate, instead of dropping it from the result.
• The provider reports an incorrect base_url appropriately, rather than surfacing a generic network failure.
• The required-permission tables on every construct page follow the GA capability model.
• This release rewrites every schema description and example comment in a plainer voice. No attribute, value, default or behaviour changed with it.
• The provider targets Jamf Pro 11.31.0 and builds on jamfplatform-go-sdk v0.21.0.

Full Changelog: v0.28.1...v0.29.0