This document explains how to create a policy in Jamf Pro. The policy distributes the proxy configuration and the root certificate authority (CA) certificate. It doesn't cover other parts of Jamf, such as initial Jamf configuration or device enrollment.

The files are on the configuration page for the Proxy connector in the F5 Workforce AI Security admin interface.

The downloaded ZIP file contains deployment files for both Windows and Apple platforms. For Jamf Pro deployments, these Apple configuration profiles are available:

Workforce AI Security distributes its proxy information in a proxy auto-configuration (PAC) file. The PAC file sends generative AI traffic to the Workforce AI Security proxy service. The device sends other traffic by its typical route.

Workforce AI Security uses the PAC file to update the list of generative AI domains. Most operating systems and browsers request the PAC file every 1 through 2 hours. If a device can't get a new file, the device keeps using the current file.

Workforce AI Security needs certificate trust to intercept connections and apply policy. Other network security and secure access service edge (SASE) vendors work the same way. This policy applies to connections to generative AI websites. Devices that Workforce AI Security governs must trust the Workforce AI Security root CA certificate.

You can deploy Workforce AI Security proxy configurations through standard Apple configuration profiles. A basic profile sets a PAC URL with no user identifier. All traffic from a device is then associated only with the Proxy connector. This approach is known as Connector authentication.

Workforce AI Security can identify which connector the traffic came from. It can't tell individual users apart on shared devices. It also can't associate native application traffic with specific users.

The JAMF-specific profiles add unique identifiers to the PAC URL. They use JAMF payload variables for user email addresses or unique device identifiers (UDIDs). If you deploy through JAMF, use one of these JAMF-specific profiles instead of the basic profile.

When the PAC URL includes email addresses, Workforce AI Security identifies users and attributes their traffic immediately. When the PAC URL uses UDIDs, the user must first log in to a generative AI service. Workforce AI Security then associates the traffic with that user. From then on, it identifies traffic from that UDID.

When Workforce AI Security identifies users, Connector authentication appears less often in User Activity logs. This makes it easier for you to audit and report on individual user behavior. You can also apply policy by user, not only by device or connector. If you use different policies for different users or groups, Workforce AI Security can enforce them. This applies even to traffic that you could otherwise identify only by connector.

Workforce AI Security provides mobileconfig files. These are Apple configuration profiles. You can deploy them through Jamf Pro to set up proxy settings and certificate trust. They are available on the configuration page for the Proxy connector in the Workforce AI Security Admin UI.

For Jamf Pro, Workforce AI Security provides configuration profiles that use JAMF payload variables. These variables add a user identifier to the PAC URL. Workforce AI Security can then attribute traffic to users. Users don't need to authenticate.

These JAMF-specific profiles are available for macOS devices:

When JAMF deploys these profiles, it replaces the payload variables with actual values:

Use one of these JAMF-specific profiles instead of the basic profile without variables. Choose between email and UDID based on your requirements. If security is your main focus, use UDID. UDID requires users to log in before their traffic is linked to them. With email, Workforce AI Security recognizes users and applies policy immediately. If JAMF reliably holds user email addresses, use email.

For iOS and iPadOS devices, use the standard surepath.ios.mobileconfig profile. It configures proxy settings but doesn't identify users.

After you complete the deployment, verify that the endpoint is integrated correctly. Use the Workforce AI Security Ready tool.