Checkpoint
One list of serial numbers. Both sides of the story.
What it does
Checkpoint is a macOS app for Mac admins that cross-references devices between Apple Business or Apple School Manager and Jamf Pro, Jamf School or Microsoft Intune. Instead of switching between two consoles to establish where a device actually stands, you get both perspectives side by side in one table, and the tools to act on what you find.
Enter serial numbers — typed, pasted, imported from a text or CSV file, or taken from a Jamf group or an Apple order — and Checkpoint reports, per device:
| Apple Business / Apple School Manager | Jamf Pro | Jamf School | Intune |
|---|
| Assignment status and assigned MDM server | Record and device name | Record and device name | Record and device name |
| Activation Lock state, and whether it is an MDM or a user lock | Managed and supervised state | Managed and supervised state | Managed and supervised state |
| Migration status and deadline | PreStage scope and site | Location and Apple ADE profile | Compliance state |
| Warranty and AppleCare coverage | Enrollment, inventory and contact dates | Last check-in | Enrollment date and last sync |
| Model, order number, purchase source | MDM profile expiration | Passcode state | Management certificate expiration |
| Hardware identifiers | FileVault and passcode state | Installed OS version | Encryption and passcode state |
| Device history (Apple Business) | Installed OS version and build | Asset tag | Installed OS version |
| Apple Device Management state (Apple Business) | Department, building and room; asset tag | | |
| Device compliance, relayed from its compliance vendor | | |
| Software update state, as the device reports it | | |
| Declaration status and enforced update target | | |
With several Apple organizations configured, one lookup can search all of them at once and report which organization each device belongs to. With several MDM connections, All Connections reads every one of them and reports a finding per device: a record on another connection than the one Apple assigns the device to (a mismatch), or records left behind on other connections (stale records). A record is called stale only on evidence of activity or managed state, and Remove Stale Records removes exactly the records the findings name, each through its own connection.
Every discrepancy can be resolved from the same window: MDM assignments and migrations, PreStage scope, sites and locations, asset tags, record deletion, and MDM commands. Demo Mode shows all of it with sample organizations and connections, without a tenant: turn it on from either toolbar picker or the Connection menu, or with Try Demo Mode while nothing is configured. See Features.
Right-click the column headers to choose what shows — more columns are available than appear by default, including model, order number, site, department and FileVault state. Columns and actions the connected product has no source for are left out rather than shown empty. Apple School Manager with Jamf School, showing location and ADE profile in place of site and PreStage:
An Intune tenant, showing compliance and a single sync time in place of Jamf’s four dates:
Documentation
- Features — actions, MDM commands, lookups across several organizations and connections, findings, filtering and sorting, migration, software updates and declarations, device compliance, device history, Apple Device Management, recovery secrets, activity log, Demo Mode
- Permissions — the Apple role, the Jamf Pro privileges and the Jamf School API-key methods each feature needs
- Platform API — optional: connecting Jamf Pro through the Jamf Platform API gateway, and the one command it can’t carry
- Intune — connecting an Intune tenant, what Microsoft Graph does and doesn’t expose, and the app registration it needs
Requirements
- macOS 15 or later
- An Apple Business API account per organization, with the Device Enrollment Manager role or higher; Apple School Manager asks for no role
- One of: a Jamf Pro server, connected by API client, username and password, or the Platform API gateway; a Jamf School instance, connected by Network ID and API key; or a Microsoft Intune tenant, connected by a Microsoft Entra ID app registration
- Jamf Pro 11.30+ for the Last Contact attribute
Security
Credentials are stored only on your Mac: secrets in the keychain, under the service DeviceStatus.secrets, and non-secret configuration in user defaults. The app is sandboxed, so both live in its own container. Nothing else is written to disk: lookups, Apple snapshots and the activity log are kept in memory for the session.
The app talks exclusively to the services you configure — Apple’s API endpoints, your Jamf servers or the Jamf Platform API gateway (<region>.api.jamfcloud.com), and Microsoft’s sign-in (login.microsoftonline.com) and Microsoft Graph — plus one daily request to GitHub asking whether a newer release exists, which sends nothing else and can be turned off in Settings › Updates. Download fetches a release from GitHub only when you choose it.
Recovery keys, Recovery Lock passwords, device lock PINs and local administrator passwords are never stored. They are requested one device at a time, held only while the sheet showing them is open, and discarded when it closes.
The activity log is kept in memory, never written to disk, and never records a secret or a device owner’s personal details. See Activity log.
Building
Open the project in Xcode 27 or later and build the Checkpoint scheme (⌘R). The app’s only package dependency is JTKit, the shared package of these apps. Resolving it also downloads Microsoft’s MSAL, which JTKit uses for Intune sign-in and which this app doesn’t link or ship.
Acknowledgements
Inspired by asbmutil and AxMJamfSync, among many others.
Support
If Checkpoint saves you time, you can buy me a coffee. ☕️
Disclaimer
This tool is provided as-is, without warranty of any kind. Use it at your own risk. This is a personal project. It is not affiliated with or endorsed by my employer, Jamf, Apple or Microsoft. Issues and pull requests are appreciated. Support is best-effort.
License
MIT
