For a decade, running Apple at scale meant a console, a library of scripts and a lot of knowledge held in a few people’s heads. JNUC 2026 in Kansas City made it clear that model has a shelf life.
Jamf shared the conference with Apple, Anthropic and AWS, and CEO Beth Tschida summed up the bet in one line: “AI runs better on Apple, and Apple runs better on Jamf.” Taken one at a time, this year’s announcements look like a feature list. Taken together, they describe a different architecture: configuration that lives in code, devices that report their own health, and changes that move through rings only when the signals say it is safe. Here is how we read the direction, and what we would prepare now.
Blueprints is now the configuration plane
Release: Blueprints improvements rolling out now · App Store apps and App Lifecycle Management targeted Q4 2026
Declarative Device Management became mandatory for software updates on the 27 OSes, and that forced the move to Blueprints (our WWDC notes cover the detail). This year Jamf closed most of the gaps that kept larger estates on legacy profiles. Blueprints gains device exclusions, per-device deployment status, a full change history, reusable variables that adjust by location, and Divisions, which let regional or business-unit teams manage only their own sites.
App distribution moves in too. A new App component deploys App Store apps to Mac, iPhone and iPad on Apple’s current licensing model, across multiple licence pools assigned by department or location. App Lifecycle Management adds a curated catalogue of non App Store Mac apps: add an app once and it installs and stays current on the right devices, with users able to request it through Self Service+.
The signal for admins is simple. New capability lands in Blueprints first. Every estate still built on policies, custom profiles and packaging scripts is carrying debt that grows with each release.
The platform is API first, and it now speaks Terraform
Release: Platform API Gateway, Blueprints API and Terraform provider available now
The Platform API Gateway gives every Jamf API, classic, product and Platform, one endpoint and one authentication model, with credentials created and monitored centrally in Jamf Account. The new Blueprints API exposes full create, read, update, deploy and delete through code, across both Jamf Pro and Jamf School.
On top of that sits a first-party Terraform provider, built and maintained by Jamf against the Platform APIs. Policies, profiles and smart groups become code. Changes go through pull requests, roll back from version history, and replicate exactly across tenants or business units.
The console is not going anywhere, and most teams will keep using it daily. For organisations with a platform engineering function, though, the practical model becomes Git as the place changes are made and the console as the place they are observed. That removes configuration drift between tenants and gives auditors a change history they can actually read.
The management loop is closing
Release: Routines on the new engine, general availability targeted Q1 2027 · Device Health and Ring Deployments, public beta targeted Q1 2027
Three announcements only make full sense together.
Device Health continuously reads memory, battery, crashes, storage and top processes natively from macOS, then builds a fleet view, a per-device score that explains itself, and a ranked list of the machines most at risk. Every issue links to its fix in Jamf Pro.
Ring Deployments brings staged rollout into Blueprints. A change soaks on a pilot ring, health signals decide whether it promotes or rolls back, delivery is rate-limited, and each ring keeps its own change window. An admin approves each promotion by default.
Routines moves onto an automation engine Jamf hosts itself, running in your Jamf Cloud region. It adds a visual builder with branching, loops, sub-workflows and approval steps, step-by-step run history for debugging, more than 1,500 integrations, and a migration assistant for existing workflows. Teams can opt low-risk promotions into Routines and let them run without a human click.
Observe, decide, act, verify. That is the loop Jamf calls autonomous endpoint management. Our view: the approval-by-default design is right, and the real work for IT teams sits upstream of the tooling. Someone has to define what healthy looks like for your estate, and which devices belong in which ring, before anything should promote itself. In environments with constrained branch links, rate-limited delivery and per-ring windows also matter more than the headline features.
AI moves onto the device, and governance follows it
Release: AI Governance for Mac available now · Activity, cost and browser insights and on-device model deployment targeted Q4 2026 · Self Service+ diagnostics, public beta targeted Q1 2027 (macOS 27 or later)
Self Service+ gains an AI diagnostics assistant. An employee describes the problem in plain language, the assistant explains it from a scan of their own Mac, proposes a safe fix the user approves, and rechecks afterwards. It runs on Apple’s on-device models, needs macOS 27 or later, and nothing leaves the Mac. When IT is needed, the ticket arrives with findings, actions tried and the recheck result attached. Blueprints will also deploy local inference engines and models, so prompts and company data stay on managed hardware.
AI Governance, generally available on Mac since June, goes deeper. Activity Insights drills from a flagged command to the exact command line, device and person, while raw events keep streaming to your SIEM. Usage and cost insights estimate token spend by user, device, tool, model and provider for tools such as Claude Code, Claude Desktop and Codex CLI, without capturing prompts or responses. Browser governance extends into Safari, Chrome, Edge and Firefox, shows who is signed into personal AI accounts, and blocks out-of-policy actions such as a file upload, with the reason shown to the user. For POPIA-bound organisations, the permission model matters: device identity shows by default, and richer user detail loads only for admins you grant it to.
What we would do this quarter
- Finish the move to DDM and Blueprints. Inventory every legacy profile and policy that Blueprints can now replace, and retire them on a schedule.
- Consolidate API access. Reissue integration credentials through the Platform API Gateway and retire scattered classic API accounts.
- Pilot Terraform on a non-production tenant. Export your baseline, put it under version control, and prove the review and rollback workflow before it touches production.
- Define health and rings now. Agree what healthy means for your Macs and which devices form your pilot ring, so the Q1 2027 betas have something real to gate on.
- Audit existing Routines ahead of the migration to the hosted engine.
- Plan macOS 27 adoption with the on-device features in mind, since several depend on it.
The direction is consistent: Apple-native signals, declarative state, code as the interface, and people approving the decisions that matter. The estates that get there first will spend far less time keeping Macs current, and far more time on the work those Macs were bought for.
Watch every demo in context on our Jamf for Mac, Jamf for Mobile and AI Governance pages.
We run Apple environments for 400+ organisations across 33 countries, and we are working through each of these changes with our customers now. If you want a second set of eyes on a Blueprints migration or a Terraform pilot, book an Apple Review.
Release dates are the targets Jamf stated at JNUC 2026 and can move. Last checked 5 October 2026.