Scope Inspector

Given any device or group, see every policy, configuration profile, and app installer that targets it — without clicking through Jamf Pro one by one.

Inspecting a Device

To inspect what's scoped to a specific device:

1. Open Scope Inspector from the sidebar
2. Select Device from the inspection mode toggle
3. Type a device name or serial number — results appear as you type
4. Select the device from the dropdown
5. Nexus fetches and displays every Jamf object currently scoped to that device

Results are grouped by object type (Policies, Configuration Profiles, etc.) and show the reason the device is in scope — whether it's targeted directly, via a smart group, or because “All Computers” scope is applied.

Inspecting a Group

To see everything scoped to a smart group:

1. Open Scope Inspector from the sidebar
2. Select Group from the inspection mode toggle
3. Search for and select a computer smart group or mobile device smart group
4. Nexus returns every policy, profile, and app installer that lists this group in its scope

This is the fastest way to answer “if I change the membership of this group, what gets affected?” — especially before editing a group that's been in production for a long time.

What Gets Checked

Nexus checks all of the following Jamf object types when running a scope inspection:

• Computer Policies — all enabled and disabled policies, including those in prestage scope
• Configuration Profiles — macOS configuration profiles deployed via MDM
• Mobile Device Configuration Profiles — iOS/iPadOS profiles (when inspecting a mobile device or mobile group)
• macOS App Installers — apps deployed through Jamf Pro's App Installers feature
• Patch Titles — Jamf Patch Management titles that have the device or group in scope
• Restricted Software — restriction rules that target the device or group

Prestage enrollments are not included in scope inspection results — those are enrollment-time constructs that don't apply to already-enrolled devices.

Use Cases

Pre-wipe verification

Before wiping a device, run a Scope Inspector check to confirm exactly which policies and profiles will be re-pushed on re-enrollment. This is especially useful if the device is being reassigned to a different user or department — you can spot policies that shouldn't apply and fix scope before the wipe.

Troubleshooting missing software

If a user reports that an app or profile isn't installed, use Scope Inspector to confirm whether their device is actually in scope. A device can pass through Smart Group criteria changes without IT realizing the device was excluded — Scope Inspector makes this visible immediately.

Verifying scope changes took effect

After updating a smart group's criteria or adding a device directly to a policy scope, run Scope Inspector on that device to confirm the change is reflected. Because smart groups are evaluated by Jamf Pro server-side, Nexus fetches live data each time you inspect — so results are always current.

Identifying over-scoped devices

If a device is receiving more policies than expected — causing conflicts or unexpected software — Scope Inspector gives you the complete list to review. Cross-reference with Fleet Commander to compare against a peer device and find discrepancies.

Column Reference

The results table includes the following columns: