Cloudflare and Jamf team up to close the Apple device data gap

Cloudflare has announced a partnership with Jamf that extends its Zero Trust suite to Jamf-managed Apple fleets. The integration gives organizations using Jamf’s device management platform access to Cloudflare’s Data Loss Prevention (DLP), Remote Browser Isolation (RBI), and SaaS Tenancy Controls, with traffic steered through Cloudflare’s network via Magic WAN.

Jamf currently manages roughly 30 million Apple devices across more than 71,000 businesses, schools, and hospitals. The company’s Apple-first ZTNA agent, Jamf Trust, deploys through Jamf Pro and works with the broader Jamf Security Cloud platform to handle identity, endpoint security, and networking for laptops and mobile devices. With this partnership, Jamf customers can route selected traffic into Cloudflare’s network for deeper policy enforcement without changing the end-user experience.

Protecting data on Apple devices with Cloudflare and Jamf

How the integration works

Jamf Security Cloud administrators configure a Magic WAN interconnect to their Cloudflare account, then define access policies that determine which traffic gets forwarded for Cloudflare inspection. Traffic can be matched by hostname, domain, or IP address/CIDR block. To inspect everything, an access policy can use * for hostnames and 0.0.0.0/0 for IPs, which acts as a gateway of last resort behind any more specific policies. Administrators can also enable the “Restrict access when Jamf Trust is disabled” security option to prevent devices from bypassing inspection by disabling the agent.

A critical piece of the setup is handling encrypted traffic. With roughly 99.7% of web requests now using HTTPS, content inspection policies that only look at plaintext miss nearly everything. Cloudflare Gateway addresses this through SSL/TLS decryption: it intercepts HTTPS traffic, applies HTTP policies, then re-encrypts the request with a user-side certificate. Jamf Pro distributes the Cloudflare Gateway Root Certificate Authority to managed devices via a configuration profile, making this transparent to users.

Data Loss Prevention

Sensitive data — credit card numbers, Social Security numbers, API tokens, confidential documents — frequently leaves corporate networks through everyday file sharing, and attackers increasingly rely on tricking employees into sending that data themselves. Cloudflare DLP blocks this at the network level with predefined detection profiles for financial information, national identifiers, and cloud credentials (GCP, AWS, Azure, SSH), plus custom regex profiles for organization-specific keywords.

BLOG-1949 Embedded Image - 4sxxu4

The implementation follows a straightforward sequence:

  1. Configure a Magic WAN interconnect in Jamf Security Cloud.
  2. Create an access policy routing traffic for DLP inspection. Match by hostname, domain, IP/CIDR, or use * / 0.0.0.0/0 for blanket coverage.
  3. Build a DLP policy in Cloudflare One.
  4. Scope the Cloudflare Gateway Root CA configuration profile to target devices in Jamf Pro.
  5. Deploy Jamf Trust via Activation Profiles to enforce the policy across the fleet.

Remote Browser Isolation

Browser-based attacks are a persistent vector because the browser is ubiquitous and exposed to untrusted content. Remote Browser Isolation neutralizes the threat by loading web pages — including all their scripts and code — in a headless Chromium browser inside Cloudflare’s network. The user’s device receives only visual “draw” commands, so any exploit that executes stays isolated in the cloud. This protects against both known attacks and zero-days. RBI also enables granular, browser-specific DLP: downloads, uploads, copy-paste, keyboard input, and printing can be restricted per site or globally.

BLOG-1949 Embedded Image - 1jvptE

To deploy RBI through the Jamf integration:

  1. Configure a Magic WAN interconnect in Jamf Security Cloud.
  2. Set access policies for the domains to isolate, making sure to include *.browser.run as a hostname. A * hostname sends all unmatched traffic to RBI.
  3. Enable Non-identity on-ramps in Cloudflare One.
  4. Configure a Remote Browser Isolation policy in Cloudflare One.
  5. Distribute the Cloudflare Gateway Root CA via Jamf Pro.

SaaS Tenancy Control

Employees frequently use the same corporate device for both business and personal accounts on platforms like Google Workspace, Microsoft 365, Dropbox, and Slack. This creates an easy path for data exfiltration: sign into the corporate account, download sensitive files, then sign into a personal account on the same device and upload them.

The integration stops this through two layers. Jamf access policies first verify the user is authorized for the target cloud application and is connecting from a sanctioned device. Cloudflare Gateway HTTP policies then enforce SaaS Tenancy Control, restricting logins to only the admin-approved tenant for that provider — blocking personal accounts or other business tenants entirely.

  1. Configure a Magic WAN interconnect in Jamf Security Cloud.
  2. Create access policies for the SaaS providers to protect, using Jamf’s predefined templates: “Microsoft Authentication” for Microsoft 365, “Google Apps” for Google Workspace, “Dropbox,” and “Slack.”
  3. Enable “Restrict access when Jamf Trust is disabled” so controls hold on any network.
  4. Configure SaaS Tenant Control in Cloudflare One.
  5. Deploy the root CA profile and Jamf Trust activation profiles as with the other policies.

Getting started with the integration

Existing Cloudflare customers who want to explore this integration should contact their account team with questions and feedback. New users interested in combining Cloudflare Zero Trust with Jamf can submit the partner inquiry form, and a team member will follow up.