What's new in Jamf Pro 11.26 (and what actually matters)

Jamf Pro 11.26 shipped on 24 March 2026, with a point release (11.26.1) landing shortly after. It's a meaningful release — not because any single feature is headline-grabbing, but because several of the changes close long-standing gaps around session handling, compliance integration, and API-driven administration. Here's a field guide to what's in the box, and the handful of items we think are worth moving on this quarter.

The short version

• AI Assistant is now generally available for eligible tenants.
• Session timeouts configured in Jamf Account are now actually enforced by Jamf Pro for OIDC SSO environments.
• Microsoft Entra device compliance gains automatic device registration for macOS 26+ using Simplified Setup for Platform SSO.
• Jamf Pro user accounts can now be managed programmatically via the Jamf Pro API.
• A third-party library CVE (CVE-2026-1605) is fixed in this release.

Session timeouts from Jamf Account are now enforced

This one is quietly the most important change in 11.26 for any organisation that's been through an audit recently. Jamf Pro now respects the "Inactivity timeout" and "Session duration" values set in Jamf Account for environments that authenticate through OIDC-based single sign-on. Until this release, those settings lived in Jamf Account but weren't actually applied by Jamf Pro — you could set a 30-minute inactivity window in Jamf Account and the admin console would happily keep a session alive for hours.

If you have a SOC 2 or ISO 27001 control that mandates an administrative session timeout, this closes that gap without a workaround. Check your Jamf Account session settings before you upgrade — whatever's configured there will start being enforced the moment 11.26 lands.

Automatic Entra device registration for macOS 26

For anyone using Jamf Pro's device compliance integration with Microsoft Entra ID (formerly Azure AD), this is the feature worth testing next. Previously, end users had to manually register their Mac with Entra after enrollment — a step that many of them skip or get wrong, breaking conditional access. In 11.26, computers running macOS 26 or later that use Simplified Setup for Platform Single Sign-On are automatically registered with Entra during enrollment. No end-user action, no broken conditional access, no helpdesk ticket. (Platform SSO also underpins Apple's new Managed Apple Accounts — see our Apple Business overview for how these pieces fit together.)

Caveats to know before you celebrate: this only applies to macOS 26 and later, and only when you're using Simplified Setup for Platform SSO. Existing enrolled devices won't retroactively register — this is an enrollment-time feature.

Jamf Pro user accounts via API

You can now create, update, and delete Jamf Pro administrator accounts through the Jamf Pro API. This sounds minor until you realise it's the missing piece for properly automating onboarding and offboarding of your Mac admin team. Combined with SCIM from your identity provider or a simple HR-triggered workflow, you can now drive Jamf Pro access the same way you drive everything else — no more hand-curating accounts in the web UI. (If you're wiring this into a broader Apple automation story, Apple Business ships with its own Admin API that slots in alongside.)

Worth noting: the usual caveats around API-driven privilege escalation still apply. Scope whichever service account you use for this as tightly as you can, and audit its use.

AI Assistant, now GA

Jamf's AI Assistant — a conversational interface for querying and operating on your Jamf Pro data — is now generally available for tenants that support it. Jamf enabled this on 31 March 2026 regardless of server version, so you may already have it even if you're still on 11.25.

Our honest take: genuinely useful for reporting-style questions ("how many devices are missing FileVault?") and for triaging unfamiliar environments. Less useful — and we'd say not yet safe — for anything that mutates state. Treat it as a faster way to read, not a faster way to act.

Earlier in the 11.24 / 11.25 cycle, if you missed them

A lot of teams upgrade every other release, so here's a quick recap of the items from the two releases before 11.26 that we think are worth going back for:

• 11.25 — Self Service+ rebranding. You can now change the Self Service+ application name and icon from Jamf Pro. Small, but long-requested by organisations that didn't want "Self Service" showing up in their Dock.
• 11.24 — Jamf Protect auto-registration. Jamf Protect tenants are now automatically registered with Jamf Pro, removing a manual setup step that was easy to forget.
• 11.24 — Camera restriction exemption list. You can now exempt specific applications from camera restrictions, which is the difference between blanket-blocking video conferencing and actually being able to restrict camera use where it matters.
• 11.24 — Federated user account type. A new user account type for federated scenarios, useful if you've been working around this with LDAP-based hacks.

Should you upgrade?

For most environments: yes, but plan the window. The session-timeout enforcement is the one thing that can surprise you if you haven't checked your Jamf Account settings, so do that first. The Entra auto-registration and API-driven user management are both opt-in in practice — they won't change anything until you start using them.

As always, we recommend upgrading your test instance first, letting it soak for a few days, and then rolling production in a maintenance window. 11.26.1 is out already, so if you're not in a rush there's no harm in waiting for a 11.26.2 if Jamf follows their usual cadence.