This article describes the network ports used for connections with Jamf Pro, the Jamf Pro server, and Jamf Pro apps. In addition, this article describes network ports that are commonly used when connecting or integrating Jamf Pro with third-party products.
All port numbers listed are TCP unless UDP is specifically indicated. Many of the ports listed in this document are determined by the configuration of other services running in your environment or by a third party. Many connections are listed with encrypted and non-encrypted options. Jamf strongly recommends using encrypted connections.
This information is made available by Jamf: https://docs.jamf.com/technical-articles/Network_Ports_Used_by_Jamf_Pro.html
Network Connections to the Jamf Pro Server
A Jamf Pro server can be hosted on-premise (customer hosted) or hosted on Jamf Cloud. The following connections may be made inbound to the Jamf Pro server:
| Port | Protocol | Description | Connections Initiated |
| 8443 or 443 | HTTPS | Connections to the Jamf Pro web app use HTTPS. When default settings are used, on-premise Jamf Pro servers use port 8443, and Jamf Cloud-hosted servers use port 443. Note: HTTPS Interception (SSL Inspection) is not supported for connections to Jamf Pro. If client HTTPS traffic traverses a web proxy, you must disable HTTPS Interception for connections to Jamf Pro. | Managed computers or mobile devices, administrator workstations, and other services to the Jamf Pro server |
| 80/8080/443 | HTTP or HTTPS | Some advanced installations may include a load balancer or reverse proxy. In this case, the Jamf Pro server URL’s host name will resolve to the IP address of the proxy. If SSL is terminated at the proxy, traffic is forwarded to the Jamf Pro server over HTTP (typical ports are 80/8080). Or, traffic may be re-encrypted or passed using HTTPS (often over port 443. | Load balancer or proxy to the Jamf Pro server |
Connections from the Jamf Pro Server
The following outbound connections may be initiated by the Jamf Pro server:
| Port | Protocol | Description | Connections Initiated |
| 3306 | MySQL | The Jamf Pro server connects to a MySQL database. | Jamf Pro server to MySQL database |
| 443/2197 | HTTPS | The Jamf Pro server uses Apple Push Notification service (APNs) to prompt managed devices to check in for mobile device management (MDM). Port 443 is used by default for the HTTP/2 connections. Port 2197 can be used only in on-premise environments. Note: Allow outbound connections to and redirects from Apple's 17.0.0.0/8 block over TCP port 5223 / 443 from all client networks and on port 2197, where applicable, from Jamf Pro servers to ensure APNs will function correctly on your network. | Jamf Pro server to Apple APNs 17/8 IP range |
| 2195/2196 | HTTPS | Ports 2195/2196 are used only for legacy binary Apple Push Notification (APNs) service protocol until Jamf Pro deprecates the binary protocol or Apple no longer supports it. Notifications are sent to Apple on port 2195 and delivery feedback is solicited on port 2196. | Jamf Pro server to Apple APNs 17/8 IP range |
| 80 | HTTP | App Store app information can be retrieved from the App Store. | Jamf Pro server to Apple |
| 443 | HTTPS | The Jamf Pro server can integrate with Apple-hosted services such as Device Enrollment (formerly Device Enrollment Program), Volume Purchasing (formerly Volume Purchase Program), and Global Service Exchange (GSX). | Jamf Pro server to Apple |
| 443 | HTTPS | The Jamf Pro server can access hosted schema to populate Application & Custom Settings options. | Jamf Pro server to prod-custom-setting-schemas.s3.amazonaws.com |
| 443 | HTTPS | The Jamf Pro server can connect to Jamf-hosted utilities and services including:
| Jamf Pro server to *.jamfcloud.com and *.jamf.com |
| 80/443 | HTTP or HTTPS | The Jamf Pro server connects to Pendo if Engage is enabled in Jamf Pro. Jamf Engage data is compressed to approximately 100KB and loads asynchronously. Data is securely transmitted via SSL and each transmission is less than 2KB. | Jamf Pro server to *.jamfcloud.com |
| 443 | HTTPS | The Jamf Pro server connects to Jamf-hosted services via the Cloud Services Connection. | Jamf Pro server to the following domains: |
| 80/443 | HTTP or HTTPS | The Jamf Pro server connects to Microsoft via the Microsoft Graph API if the connection between Jamf Pro and Microsoft Intune is configured. For more information, see the following documentation from Microsoft: Network endpoints for Microsoft Intune | Jamf Pro server to the following domains:
|
| 80/443 | HTTP or HTTPS | If you are deploying SCEP certificate configuration profiles with a dynamic challenge, or using Jamf Pro's SCEP proxy services, the Jamf Pro server connects to your SCEP Enrollment server to obtain an enrollment challenge password and/or retrieve generated certificates on behalf of managed devices. | Jamf Pro server to SCEP Enrollment server |
| 389/636 | LDAP, Start TLS, LDAPS | Directory service integration via LDAP (389), LDAP over TLS (Start TLS/389) or LDAP over SSL (LDAPS/636) can be used for user authentication, device assignment, and user information and group membership lookups. Note: All Jamf Pro server LDAP connections will originate from the Jamf Pro server. For information about LDAP Proxy connections, see the "Jamf Infrastructure Manager – LDAP Proxy Connections" section in this document. | Jamf Pro server to LDAP/Domain controller |
| 25/465/587 | SMTP | Email integration via an SMTP gateway can be used for administrative notifications, user messaging, and enrollment invitations. The SMTP port depends on the service provider and type of encryption supported. Note: To help keep data and communications as secure as possible, port 25 is blocked in Jamf Cloud. It is recommended to use port 587 with TLS. | Jamf Pro server to SMTP gateway host |
| 514 | Syslog | Change Management logs can be written to log files and to a Syslog server. | Jamf Pro server to Syslog server |
| 443 | HTTPS | A cloud distribution point (Amazon S3 or CloudFront, Akamai, RackSpace, or Jamf Cloud Distribution Service) can be used to host your software packages for distribution to managed clients. The Jamf Pro server connects to these services to perform initial configuration, to upload packages added via the Jamf Pro web app or Jamf Admin, and as needed to request content access tokens and URL signatures. | Jamf Pro server to cloud hosting provider |
| 443 | HTTPS | Jamf Pro can be configured to send webhook notifications for a variety of events (device enrollment, inventory updates, etc.) to support workflow automation and data integrations. | Jamf Pro server to event listener application server |
| 11211 | memcashed | Memcached data access acceleration services can help reduce database load in multi-server Jamf Pro configurations. | Jamf Pro servers to Memcached servers |
| 443 | HTTPS | The Jamf Pro server connects to TeamViewer via TeamViewer API if connection between Jamf Pro and TeamViewer is configured. For more information, see https://docs.jamf.com/jamf-pro/documentation/TeamViewer_Integration.html |
Note: Be sure to allow outbound connections to and redirects from Apple's 17.0.0.0/8 block over TCP port 5223 / 443 from all client networks and on ports 2195 and 2196 from Jamf Pro servers to make sure APNs will function correctly on your network.
Managed macOS and iOS Connections
The following connections may be initiated from managed Mac computers and iOS devices:
| Port | Protocol | Description | Connections Initiated |
| 8443/443 | HTTPS | Mac computers and iOS devices connect to the Jamf Pro server when:
When the default settings are used, on-premise Jamf Pro servers use port 8443 and the Jamf Cloud managed-hosting option uses port 443. | Managed devices to the Jamf Pro server |
| 5223/443 | APNs | The Jamf Pro server will send a message to the Apple Push Notification service when it has an MDM profile or command awaiting delivery to an enrolled device. Mac computers and iOS devices maintain a persistent connection to APNs when connected to a network so they will receive new notifications quickly. End user devices connect to APNs using port 5223 by default, but will fail over to port 443 when connecting via Wi-Fi. | Managed devices to APNs |
| 443 | HTTPS | Mac computers can download software packages from a cloud distribution point (Amazon S3 or CloudFront, Akamai, RackSpace, or Jamf Cloud Distribution Service). | Managed computers to a cloud distribution point |
| 443 | HTTPS | iOS devices can download in-house apps and ebooks from the Jamf Cloud Distribution Service. | Managed mobile devices to JCDS |
| 80/443 | HTTP and HTTPS | Mac computers can download software packages from an HTTP and HTTPS server such as Apple macOS Server, Apache, and Microsoft IIS. | Managed computers to HTTP/HTTPS distribution point |
| 548 | AFP | Software packages can be downloaded by Mac computers from an Apple File Protocol (AFP) server. | Mac computers to AFP servers |
| 445/137-139 | SMB | Software packages can be distributed to Mac computers using a Windows SMB (CIFS) distribution point. | Managed computers to SMB servers |
| 80/443 | HTTP and HTTPS | The Apple ecosystem relies on many Internet-based systems maintained by Apple and their content distribution network (CDN). Examples include Apple Software Update, the App Store, Device Enrollment (formerly Device Enrollment Program), Volume Purchasing (formerly Volume Purchase Program). | Managed devices to Apple/CDN |
| 22 | SSH | The Jamf Remote and Recon applications use the standard SSH port to connect to Mac computers. This port cannot be changed. | Administrator workstations to Mac computers |
| 443 | HTTPS | Managed computers send crash logging and some anonymized usage statistics to Jamf's Sentry server. For more information, see the Sentry Crash Logging and Usage Analytics Integrations article. | Managed computers to sentry.pub.jamf.build |
Administrator Workstation Connections
The following connections may be initiated from administrator workstations:
| Port | Protocol | Description | Connections Initiated |
| 8443/443 | HTTPS | Administrators perform management tasks by logging in to the Jamf Pro server using a web browser and the Jamf Pro apps (Recon and Jamf Admin). When the default settings are used, on-premise Jamf Pro servers use port 8443, and Jamf Cloud-hosted servers use port 443. | Administrator workstations to the Jamf Pro Server |
| 548/445 | AFP/SMB | The Jamf Admin application can upload new software packages to AFP or SMB distribution points. | Jamf Admin to distribution points |
| 22 | SSH | The Recon application uses the standard SSH port to connect to Mac computers. This port cannot be changed. | Administrator workstations to Mac computers |
Jamf Infrastructure Manager - LDAP Proxy Connections
The Jamf Infrastructure Manager is a managed environment that runs on your network to host utilities that facilitate the integration of the Jamf Pro server with your IT environment. One of these utilities, the LDAP Proxy, may be used to create an extra layer of separation between a Jamf Pro server and an LDAP directory service. Communication between the Infrastructure Manager and the LDAP server is encrypted when the Use SSL checkbox is selected in the Connection settings of your LDAP server in Jamf Pro. Communication between Jamf Pro 10.27.0 or later and Infrastructure Manager 2.2.0 or later is encrypted with mutual TLS (mTLS).
| Port | Protocol | Description | Connections Initiated |
| 8443/443 | HTTPS | Jamf Infrastructure Manager instances connect to the Jamf Pro server when they are enrolled and periodically thereafter to confirm their operating status and retrieve updated settings. When the default settings are used, on-premise Jamf Pro servers use port 8443, and Jamf Cloud-hosted servers use port 443. | Jamf Infrastructure Manager host to the Jamf Pro server |
| 8389/8636 | LDAP or LDAPS | All Jamf Pro LDAP lookups are sent via the Jamf Pro server. Jamf Pro can be configured to send LDAP queries to a Jamf Infrastructure Manager LDAP Proxy instance rather than directly to an LDAP host. The port on which the LDAP Proxy will listen for these incoming requests is configured when enrolling with the Jamf Pro server. On Linux, the port chosen should be at least 1024 because lower-numbered ports are reserved for more privileged services and users. Port 8389 might be chosen if running on LDAP, or port 8636 if running on LDAPS. | Jamf Pro server to the Jamf Infrastructure Manager host |
| 389/636 | LDAP or LDAPS | The LDAP Proxy service will receive lookup requests from the Jamf Pro server and forward them to a directory service. LDAP usually runs on port 389. If you encrypt your LDAP communications (LDAP over SSL/LDAPS), port 636 is commonly used. Your directory services administrator can tell you which of these ports are used in your environment. | Jamf Pro server to LDAP server/domain controller |
| 8081 | HTTP | The LDAP Proxy service can expose this port to enable Healthcheck endpoint for verification of LDAP Proxy Server status. The default port is 8081 but can be changed by your administrator. | External service to Jamf Infrastructure Manager host |
Note: If your Jamf Pro server is hosted on Jamf Cloud, you will need to permit inbound access to the Jamf Infrastructure Manager host from Jamf Cloud. A list of the source IP addresses for these connections is provided in the following article: Permitting Inbound/Outbound Traffic with Jamf Cloud.
Jamf Infrastructure Manager - Heathcare Listener connections
The Healthcare Listener is a service that receives Admission/Discharge/Transfer (ADT) messages from a healthcare management system and sends a notification to the Jamf Pro server to trigger a remote command to the iOS device assigned to a patient room.
The Healthcare Listener is hosted by the Jamf Infrastructure Manager.
| Port | Protocol | Description | Connections Initiated |
| 2575 | HL7 | 2575 is an assigned port that can be used for HL7 communications, but the Healthcare Listener can be configured to use any preferred port 1024 or greater. | HL7 interface to Jamf Infrastructure Manager host |
| 8443/443 | HTTPS | The Healthcare Listener informs the Jamf Pro Management Server when an action is needed on a device. When the default settings are used, on-premise Jamf Pro servers use port 8443, and Jamf Cloud-hosted servers use port 443. | Jamf Infrastructure Manager host to the Jamf Pro server |
Jamf AD CS Connector Connections
Jamf Pro uses the Jamf AD CS Connector to communicate with AD CS to obtain certificates. This service securely transfers all communication between Jamf Pro and AD CS. For more information, see Integrating with Active Directory Certificate Services (AD CS) Using Jamf Pro.
| Port | Protocol | Description | Connections Initiated |
| 443 | HTTPS | Jamf Pro sends certificate signing requests and retrieves completed certificates by opening a connection to the Jamf AD CS Connector, typically on TCP port 443. | Jamf Pro to Jamf AD CS Connector |
| 135 and 49152-65535 | DCOM | The Jamf AD CS Connector uses Microsoft Distributed Component Object Model (DCOM) to communicate with AD CS. | Jamf AD CS Connector to AD CS |
| 8443/443 | HTTPS | If your organization uses in-house apps developed with the Jamf Certificate SDK, connections to the Jamf Pro server will be via HTTPS. When default settings are used, on-premise Jamf Pro servers use port 8443, and Jamf Cloud-hosted servers use port 443. | Mobile device apps to the Jamf Pro server |
SCCM Plug-In connections
The SCCM Plug-In automatically copies the inventory collected by Jamf Pro to your SCCM server so that you can add data about your Jamf-managed devices to SCCM reports.
| Port | Protocol | Description | Connections Initiated |
| 80/443 | HTTP/HTTPS | The SCCM Proxy Service will transmit updated device inventory information to the Microsoft Configuration Manager API. | SCCM Plug-In host to SCCM server |
| 8443/443 | HTTPS | The SCCM Proxy Service queries the Jamf Pro server via a REST API to obtain information about your managed devices. When the default settings are used, on-premise Jamf Pro servers use port 8443, and the Jamf Cloud-hosted servers use port 443. | SCCM Plug-In host to the Jamf Pro server |