Jamf Protect Agent Overview
- Last UpdatedOct 16, 2025
- 2 minute read
The agent runs on your macOS computers and performs the following tasks:
Audits your security settings against an industry standard benchmark (CIS).
Monitors real-time event-driven activity generated on macOS.
Syncs with a plan configuration created in the web application to analyze and respond to events for a specific computer.
Performs an analysis for events using the highly optimized built-in game engine on the Mac.
Agent updates are regularly available from Jamf and can be installed on computers automatically or manually.
Jamf Protect installs and runs as a macOS system extension by default. This improves the performance, stability, and security of Jamf Protect on computers while continuing to run in the user space.
The Jamf Protect system extension is protected by Apple's native System Integrity Protection (SIP). This reduces Jamf Protect's exposure to tampering on computers.
If the system extension cannot run or is not safelisted on managed computers, the Jamf Protect alternatively runs as a launch daemon. The launch daemon has the identifier of com.jamf.protect.daemon and launches a root daemon process named JamfProtect. You can execute any of the following commands to manage the launch daemon:
-
sudo launchctl list com.jamf.protect.daemon - Validates if the launch daemon is running correctly
-
sudo launchctl stop com.jamf.protect.daemon -
Stops the Jamf Protect launch daemon (and process)
Note:The Jamf Protect launch daemon will automatically restart after stopping.
-
sudo launchctl start com.jamf.protect.daemon -
Starts the Jamf Protect launch daemon (and process)
-
sudo launchctl unload /Library/LaunchDaemons/com.jamf.protect.daemon.plist - Completely stops the Jamf Protect launch daemon
-
sudo launchctl load /Library/LaunchDaemons/com.jamf.protect.daemon.plist -
Restarts the Jamf Protect launch daemon after a complete stop
- Jamf Protect application
/Applications/JamfProtect.app
- System Extension
Contents/Library/SystemExtensions/com.jamf.protect.security-extension.systemextension in the JamfProtect.app folder.
The Jamf Protect system extension must be safelisted via a configuration profile.
- Launch Daemon
/Library/LaunchDaemons/com.jamf.protect.daemon.plist
The launch daemon is only installed on computers that have not safelisted and enabled the system extension.