Guides

What is Device Helper?

Device Helper is part of the Jamf Mobile Assist native iOS and iPadOS application that empowers "frontline managers" to perform limited management and security tasks on target mobile devices. These groups of frontline managers often fall between IT teams and device end-users, and are sometimes responsible for the business outcomes of mobile technology.

Retail store managers, field service techs, nurse unit coordinators - these are just a few examples of individuals who are responsible for the mobile fleet's outcomes, and often are in proximity to end users in a time of need. Rather than bog these crucial team members down - collecting and tracking a group of devices for their department - and submitting IT tickets when devices are lost, stolen, found, or misconfigured - what if there was another way to prevent issues in the first place? What if these frontline managers could resolve issues in an instant, right at the time and place at which they occur?

Device Helper provides basic device management capabilities to a non-IT user who does not have access to Jamf Pro in the form of an app. The actions that are provided within Device Helper can be performed on authorized, managed devices within the environment, which the user targets in real time.

Benefits

Jamf Mobile Assist offers the following capabilities:

Frontline manager tasks... simplified Automatically clear device passcodes, set unique wallpapers, or restart or erase a device on the fly. Ensure the health of your mobile fleet, on the go.

Secure actions... in a simple scan Equip frontline managers with a familiar and easy workflow. Simply scan a target device's wallpaper, which contains a special QR for Device Helper, to take action.

Fleet maintenance… without help from IT Gone are the typical IT processes for basic device maintenance. Ensure that devices aren't out of service while an IT ticket resolves, and rather are returned and ready for immediate use.

Customizable capabilities for each role Deploy unique versions of Device Helper with limited functionality, appropriate for each team member's need.

Use Cases & Workflows

Device Helper can be deployed for a number of different scenarios. Depending on your specific use-case, you may configure one or more of the actions for specific groups of users.

Use-Cases: Customizable by User Persona

Functionality of Actions on Target Devices

User Experience

Depending on the configuration of the app, the user experience will automatically change.

End to End Workflow:

1. Device Helper — Remote action selected from list
2. Action — Scan QR code of target device; MDM actions / workflows triggered
3. Result — Target device is ready for use

Customized Wallpaper Deployment Models

For Device Helper to function, the mobile fleet must be prepared with customized wallpapers. These wallpapers contain a QR code which can be scanned by Device Helper to initiate remote actions.

There are two methods to prepare devices:

1. On device configuration: A "Set Wallpaper" webclip is deployed to the home screen of the device from Jamf Pro. The webclip opens the Jamf Mobile Assist app, and automatically generates and deploys a unique wallpaper on the device in a simple "1 tap" step.

2. Automatic configuration: A webhook automation service (e.g. JAWA) is configured, which can deploy wallpapers to devices on enrollment or other Jamf Pro event triggers. This allows data within customized wallpapers to change independently of Jamf Mobile Assist app, while still providing the QR code needed for the app to take remote actions.

Environmental Prep for Assign Location Workflows

For the "assign location" workflow, a user is prompted to scan a QR code of a target device, and then subsequently scan a location that the device should be assigned to.

To prepare this workflow, your organization must create "Room/Location QR codes" associated to physical spaces in your environment. The naming convention for these QR code values should match your existing inventory information in Jamf Pro exactly.

Example: If a room number stored in device inventory in Jamf Pro appears as "ACME-ICU-5-WEST" - this is the matching location QR code.

Use a free online QR code generator or other tools to create these location codes.

Setup and Configuration

To access Device Helper from the Mobile Assist app, you must first complete the following steps.

Install Jamf Mobile Assist App Via Jamf Pro

1. Distribute app to Jamf Pro using Volume Purchasing workflow
2. Add Jamf Mobile Assist to Jamf Pro app catalog if not created automatically
   • Check Assign Content Purchased in Volume in the Managed Distribution tab
   • Do not scope and leave App Configuration blank at this time
3. Take note of the app record ID in the URL displayed in the browser address bar for future reference: https://yourinstance.jamfcloud.com/mobileDeviceApps.html?id=18&o=r In this example, the ID is 18.

Authorized Target Devices

1. Create or use an existing Smart Group to determine which target devices are authorized to receive workflows from Device Helper. Criteria of the Smart Group can be changed at any time but do not delete the Smart Group.

Create Jamf Pro User Account for Wallpaper & Return to Service (optional)

2. In Settings > System > User Accounts and Groups, add a user which is required for set wallpaper and return to service actions with the following custom privilege set:

   • Jamf Pro Server Objects: Mobile Device Configuration Profiles (Read)
   • Jamf Pro Server Objects: Mobile Devices (Create)
   • Jamf Pro Server Objects: Mobile Devices (Read)
   • Jamf Pro Server Actions: Send Mobile Device Remote Wipe Command
   • Jamf Pro Server Actions: Send Mobile Device Set Wallpaper Command
   • Jamf Pro Server Actions: View MDM command information in Jamf Pro API

Enable Device Helper with Built-In Tool (Jamf App Wizard)

Next, configure some things in Jamf Pro to enable Device Helper. The Mobile Assist app contains a tool called Jamf App Wizard. This tool will automatically set up the required API Role and Client, as well as create the Device Helper Linked App Integration.

1. Scope Jamf Mobile Assist app to a device you have access to. Do not add any App Configurations.

2. Launch Mobile Assist on this device. When no App Config is present, the Jamf App Wizard will automatically open. You can also use the following App Config keys to open the Wizard at any point after deployment:

   <key>wizard-mode</key>
   <string>yes</string>
   

3. Using an account with Administrator privileges, log into your Jamf Pro instance.

4. After loading completes, all mobile device apps in your instance will display. Find the entry for Jamf Mobile Assist. Note: if you have multiple entries, use the ID from Step 5 above as a reference.

5. Tap on the app to view detail. In the app description, select Begin App Integration.

6. Complete each step in the Assigner Integration workflow:

   1. Confirm the Mobile Assist tab is selected
   2. Enter a name for the API Role then click Create API Role. Note: an error will return if you enter a name that already exists.
   3. Enter a name for the API Client then click Create API Client
   4. Select Target Group from the pulldown. This group should match the smart group created in the Authorized Target Devices step.
   5. Confirm App Link Request: review the names and object IDs that have been created for this integration
   6. If everything looks good, click Complete App Link
   7. If successful, you can return to the previous section by going to the Navigation tab and tapping the Return button
   8. Now, you can view the integration in the Current Integrations tab

Customize Managed App Config and Deploy

• Edit the Managed App Config template in Appendix A using the Key/Value Pair table as a reference.
• Copy the app config and navigate to the Mobile Assist app (Devices > Mobile Device Apps > Jamf Mobile Assist > App Configuration)
• Scope the app to manager/control devices authorized to perform Device Helper on target devices.
• Save
• With the above steps complete, you should now be able to open Jamf Mobile Assist on an authorized manager/control device and Device Helper will automatically launch. The menu of workflows displayed is based on app config settings.

Create Web Clips (optional)

Create another Jamf Mobile Assist app record following the steps above. Customize the Managed App Config to not enable any of the remote workflows and scope to the Authorized Target Group.

1. Create new or use an existing configuration profile
2. Add 2 web clip payloads each with one of the following based on your workflow requirements:

   jamf-mobile-assist://action?workflow=selfwallpaper
   jamf-mobile-assist://action?workflow=returntoservice
   

3. Check use fullscreen
4. Scope to target devices such as the smart group created above for the Authorized Target Devices based on your workflow requirements
5. Save

FAQ / Troubleshooting

FAQ

If I don't want to manually generate the wallpaper with a web clip, is there a way to automate this?

An automation server can deploy wallpapers in real time. These wallpapers can update based on Jamf Pro events, independently of Jamf Mobile Assist. This brings additional flexibility to end user experiences, but requires additional configuration, time, support, etc. via a paid services engagement. Contact your Jamf sales rep for more information.

Do I need the Jamf Mobile Assist app and/or web clip on both the "target" and "manager/control" device?

Depends on your use cases. The App is required on the "manager/control" device. If setting the wallpaper and/or initiating Return to Service from the app, then the app needs to be installed on the devices along with the appropriate web clip.

What if I want to deploy the "assigner" and the "device helper" modes in one Jamf Pro instance?

Create a separate app record for each mode with the appropriate mode-specific app config.

Can I have multiple configurations for different teams? (e.g. IT, Field Services, Manager)

Yes, you can create multiple app records in Jamf Pro with different app configurations and scope them appropriately.

How do you gate off access? (e.g. a manager scanning the QR code on an IT device)

Different app records are utilized based upon role for authorization app access, and authorization target group controls access to target devices.

What are the network requirements to use Return to Service?

• Activation Lock needs to be disabled
• Enrollment Customization is not supported; Require Credentials for Enrollment is not supported
• 802.1x and certificate-based networks are not supported for enrollment
• Networks with captive portals (Guest Networks) are not recommended

Troubleshooting

App config management command errors in Pro console, app failing to install, or app white screen

Steps to remediate:

• Copy app config
• Clear app config and save
• Paste app config and save

Likely root cause: App record was scoped and/or app config inputted before running Jamf App Wizard.

After attempting workflow on target device, dialog prompt "Not Authorized" presented in Jamf Mobile Assist

Steps to remediate:

• Confirm that target device is a current member of the authorized target group and retry

Likely root cause: Device was not originally a member, or membership changed based on smart group recalculation during workflow.

Appendix A - Managed App Config Reference

Template

<dict>
  <!-- Required keys (do not edit) -->
  <key>JPS_URL</key>
  <string>$JPS_URL</string>
  <key>JSSID</key>
  <string>$JSSID</string>
  <key>MANAGEMENTID</key>
  <string>$MANAGEMENTID</string>
  <key>OAUTH_AUTH_CODE</key>
  <string>$OAUTH_AUTH_CODE</string>
  <key>APP_CONFIG_REINSTALL_CODE</key>
  <string>$APP_CONFIG_REINSTALL_CODE</string>

  <!-- Authorized remote workflows (5 or less recommended) -->
  <key>1-remote-reset-enabled</key>
  <string>no</string>
  <key>2-device-transfer-enabled</key>
  <string>no</string>
  <key>3-update-location-enabled</key>
  <string>no</string>
  <key>4-restart-device-enabled</key>
  <string>no</string>
  <key>5-erase-device-enabled</key>
  <string>no</string>
  <key>6-clear-passcode-enabled</key>
  <string>no</string>
  <key>7-set-wallpaper-enabled</key>
  <string>no</string>
  <key>8-return-to-service</key>
  <string>no</string>

  <!-- Required for set wallpaper and return to service -->
  <key>api-username</key>
  <string>ENTER_USERNAME_HERE</string>
  <key>api-password</key>
  <string>ENTER_PASSWORD_HERE</string>

  <!-- Optional -->
  <key>wallpaper-workflows-enabled</key>
  <string>yes</string>
  <key>device-role-ea</key>
  <string>ENTER_YOUR_NAME_OF_EA_HERE</string>
  <key>rts-wifi-config-profile-id</key>
  <string>0</string>
</dict>

Example 1: School Principals

A school district has purchased iPads and assigned one to each of its elementary-school students. The schools are small and do not have on-site IT staff. There is an IT coordinator working at the district's central office, but they may not always be immediately available. The district's administration, in consultation with their legal counsel, has established a policy under which a school principal can clear the passcode and access the content on a student iPad in the case of an emergency involving student safety. The Mobile Assist app is deployed to the Principals' iPads with the following app config. The only capability will be Reset Passcode.

<dict>
  <key>JPS_URL</key>
  <string>$JPS_URL</string>
  <key>JSSID</key>
  <string>$JSSID</string>
  <key>MANAGEMENTID</key>
  <string>$MANAGEMENTID</string>
  <key>OAUTH_AUTH_CODE</key>
  <string>$OAUTH_AUTH_CODE</string>
  <key>APP_CONFIG_REINSTALL_CODE</key>
  <string>$APP_CONFIG_REINSTALL_CODE</string>
  <key>6-clear-passcode-enabled</key>
  <string>yes</string>
</dict>

Key/Value Pairs

Note: All values are of type string

Legal

• Use Agreement: Application End User License Agreement
• Privacy Policy: Jamf Privacy Policy