Prune listing policies that are enabled and scoped to static user groups

[gtdragon980]

When using Prune to scan policies in the JSS, it will not consider policies that are using static user scopes as being "In Use". I saw several enabled and scoped policies in the "Unused" list of policies when testing this.

[BIG-RAT]

Nice catch, and unfortunately this looks to be an issue with the API as scoped users, smart user groups, and static user groups information is missing when you view a policy through the API. For example here is a policy and configuration policy scoped exactly the same. policy (scope) xml:

<scope>
  <all_computers>false</all_computers>
  <computers/>
  <computer_groups>
	<computer_group>
	  <id>172</id>
	  <name>laptops</name>
	</computer_group>
  </computer_groups>
  <buildings/>
  <departments/>
  <limit_to_users>
	<user_groups/>
  </limit_to_users>
  <limitations>
	<users/>
	<user_groups/>
	<network_segments/>
	<ibeacons/>
  </limitations>
  <exclusions>
	<computers/>
	<computer_groups/>
	<buildings/>
	<departments/>
	<users/>
	<user_groups/>
	<network_segments/>
	<ibeacons/>
  </exclusions>
</scope>

Configuration Profile (scope) xml:

<scope>
  <all_computers>false</all_computers>
  <all_jss_users>false</all_jss_users>
  <computers/>
  <buildings/>
  <departments/>
  <computer_groups>
	<computer_group>
	  <id>172</id>
	  <name>laptops</name>
	</computer_group>
  </computer_groups>
  <jss_users/>
  <jss_user_groups>
	<user_group>
	  <id>2</id>
	  <name>Group 1</name>
	</user_group>
	<user_group>
	  <id>27</id>
	  <name>Test Smart Grp</name>
	</user_group>
  </jss_user_groups>
  <limitations>
	<users/>
	<user_groups/>
	<network_segments/>
	<ibeacons/>
  </limitations>
  <exclusions>
	<computers/>
	<buildings/>
	<departments/>
	<computer_groups/>
	<users/>
	<user_groups/>
	<network_segments/>
	<ibeacons/>
	<jss_users/>
	<jss_user_groups/>
  </exclusions>
</scope>

Notice the policy is missing the jss_users and jss_user_groups keys. I might suggest openning a ticket with Jamf Support to get the issue addressed.

[gtdragon980]

Thanks for the quick response. I will reach out to Jamf support and let them know about this finding.

[BIG-RAT]

Thank you. I'd encourage others encountering this issue to do the same as I discovered I'd mentioned this years ago. The more people it impacts the more likely it is to get addressed.