The 60 second version
Pull devices
KBS HQ pulls your fleet from Google Admin (ChromeOS) or Jamf Pro (iPads and Macs). Matched by serial.
Run the program
Parents enroll. Claims get filed. Repairs ship and return. All inside KBS HQ.
Push back (optional)
When write back is on, claim notes land in the Jamf record and Lost Mode can flip on a lost iPad.
The data flow, in pictures
┌──────────────────┐ pull devices ┌──────────────────┐
│ Google Admin │ ───────────────────▶ │ │
│ (ChromeOS) │ │ │
└──────────────────┘ │ │
│ KBS HQ │
┌──────────────────┐ pull devices │ │
│ Jamf Pro │ ───────────────────▶ │ Parents enroll │
│ (iPad, Mac) │ │ Claims filed │
└──────────────────┘ │ Repairs shipped │
▲ │ │
│ write back (opt in): │ │
│ claim note, Lost Mode │ │
└───────────────────────────────── └──────────────────┘
Read is always on. Write back is per district, off by default, and limited to the actions tied to a real claim event.
What we read and what we write
Google Admin
We read
- ChromeOS device list for your Workspace customer
- Serial number, model, OU path, assigned user, status
We write (only if enabled)
- Disable or re-enable a Chromebook tied to a specific claim
- Nothing else. No OU moves, no policy edits, no user changes.
Scope: admin.directory.device.chromeos.readonly (plus the write scope only when write back is on).
Google Admin integration pageJamf Pro
We read
- Computers (Macs) and Mobile Devices (iPads)
- Serial number, model, assigned username, asset tag
We write (only if enabled)
- A note on the device record when a claim opens or closes
- Enable Lost Mode on iPad for a lost or stolen claim
API role: read Computers and Mobile Devices, plus update notes and Lost Mode only when write back is on.
Jamf Pro integration pageSecurity and isolation
Encrypted at rest
Every credential is sealed with AES 256 GCM using a server side key. Never returned to the browser. Never written to logs.
Minimum scopes
Read only by default. Write scopes only requested when you turn write back on. You can rotate or revoke credentials in your MDM at any time.
Per district
Connections are scoped per school or district and gated to school admin, district admin, and KBS super admin roles. One school never sees another school's data.
What your IT team actually sees
- 1
Open Integrations in KBS HQ. Two cards: Google Admin and Jamf Pro.
- 2
Paste service account JSON (Google) or API client credentials (Jamf). We verify the connection live before saving.
- 3
Click Sync devices. Your fleet appears in the Devices tab, matched by serial. Re-sync any time.
- 4
Optionally flip Write back on. When a parent files a claim, KBS posts a note to the matching MDM record.
- 5
Disconnect any time. Credentials are wiped. Device records stay in KBS HQ.
Frequently asked questions
Do KBS claims show up inside Jamf or Google Admin?+
Claims live in KBS HQ. Jamf and Google Admin are MDMs, not ticketing systems. With write back enabled, KBS posts a note to the Jamf device record when a claim opens, and can flip Lost Mode for an iPad on a lost or stolen claim. Google Admin write back is conservative and limited to disable or re-enable for a Chromebook tied to a claim. Nothing else.
Do my devices populate from Jamf and Google Admin?+
Yes. That is the main job of the integration. Click Sync devices in KBS HQ and we pull your full ChromeOS fleet from Google or your Computers and Mobile Devices from Jamf Pro. We match by serial number, so existing HQ devices update in place. No duplicates.
Which direction is the source of truth?+
The MDM is the source of truth for the device itself. KBS HQ is the source of truth for the coverage, the parent, the claim, the payment, and the repair workflow. The integration keeps both views pointing at the same hardware.
How are credentials stored?+
Service account JSON and Jamf API credentials are encrypted at rest with AES 256 GCM using a key held only on the server. They are never written to logs and never returned to the browser. You can disconnect any time and the credentials are wiped.
What permissions do you need?+
Google Admin uses a service account with domain wide delegation for admin.directory.device.chromeos.readonly. Jamf Pro uses an API client with read access to Computers and Mobile Devices, plus optional update permission on notes and Lost Mode for write back. Everything is the minimum we can ask for.
How often does the sync run?+
Manual on demand from the Integrations page in KBS HQ today. Scheduled hourly sync is on the roadmap. Most districts run a sync after their summer refresh and after any large rollout.
Can write back be turned off?+
Write back is off by default. It is a per district toggle on the Integrations page. Read only mode requires no extra MDM permissions and gives you the device sync, parent enrollment, and full claim workflow without ever touching the MDM record.