Manage AI applications on Mac with Jamf’s AI Governance and Amazon Bedrock

As organizations expand AI adoption across their workforce, IT administrators need a scalable way to manage how AI applications are configured and used on employee devices. These applications include Claude Code, Claude Desktop, and OpenAI Codex. Users, meanwhile, can open approved applications and start working without manual setup.

Jamf, trusted by more than 78,000 organizations to manage and secure Apple devices at scale, now extends that management model to AI governance. With support for Amazon Bedrock, Jamf ‘s AI Governance helps organizations centrally configure and manage these applications on managed Macs.

In this post, we show how you can use Jamf’s AI Governance with Amazon Bedrock to configure, deploy, and validate managed settings for AI applications across a Mac fleet.

How Jamf’s AI Governance works with Amazon Bedrock

AI applications such as Claude Code, Claude Desktop, and OpenAI Codex run locally on your users’ devices. Each application uses local configuration files for settings such as inference provider authentication, Model Context Protocol (MCP) server connections, and observability configuration. To govern these applications at enterprise scale, you need to control both where inference runs and how each application is configured on the device.

Amazon Bedrock provides model inference for these applications through your AWS account, with inference running from the AWS Regions that you choose. With Jamf’s AI Governance, you can define the settings that connect each application to Amazon Bedrock and deliver them across your fleet through Declarative Device Management (DDM). Together, Amazon Bedrock and Jamf’s AI Governance give you a scalable way to govern AI applications while keeping inference within your AWS security boundary.

The following architecture illustrates how Jamf’s AI Governance, managed Mac endpoint, and Amazon Bedrock work together:

Figure 1: Jamf’s AI Governance delivers configuration to each Mac, and the applications use that configuration to connect to Amazon Bedrock for inference.

You can define the application configuration in Jamf’s AI Governance and deploy it through Jamf Blueprints. Jamf delivers it to each device operating system through DDM, helping keep managed settings resistant to local tampering. Users can then open the application without editing local configuration files, and you can review policy scope and deployment status in Jamf AI Governance.

Jamf’s AI Governance and Amazon Bedrock in practice

In this section, we walk through an example deployment for Claude Code with Amazon Bedrock. The workflow has three parts: creating a managed policy, deploying it to managed Macs, and validating that the policy is applied. The same pattern applies to other supported applications, including Claude Desktop and OpenAI Codex.

Before you begin, complete the Jamf’s AI Governance prerequisites.

Create a policy for Claude Code on Amazon Bedrock

You can create a policy in your Jamf account under AI Governance > AI Policies. In the policy builder, you configure Amazon Bedrock provider settings, including your authentication method, AWS Region, and model access.

The policy defines how Claude Code uses Amazon Bedrock for users across your organization. For example, you can enable Amazon Bedrock prompt caching in Claude Code. In iterative coding workflows, prompt caching can reduce costs by up to 90 percent and latency by up to 85 percent for supported models. You can also configure Claude Code behavior, including effort levels, MCP server access, local folder permissions, sandbox settings, and telemetry.

Figure 2: Setting up Claude Code on Amazon Bedrock

Deploy the policy with Jamf Blueprints

You can then deploy the policy through Jamf Blueprints to the target Mac groups. Jamf delivers the configuration through DDM as managed configuration. Jamf places the configuration on users’ devices before they open Claude Code. Users can start working with Claude Code without manual setup.

Figure 3: Opening Claude Code with managed configuration applied

Validate and monitor the deployment

After deployment, you can use Jamf’s AI Governance to review the policy scope and deployment status. You can also use AI Visibility to see AI applications and activity across your fleet and generate reports for governance evidence.

Figure 4: AI Visibility and governance reporting in Jamf’s AI Governance

Clean up

Delete all created resources to avoid ongoing charges.

Conclusion

With Jamf’s AI Governance and Amazon Bedrock, you can give users managed access to AI applications while keeping inference in your AWS environment. Jamf delivers application configuration through DDM, so IT teams can deploy provider settings and application controls across a Mac fleet, then validate policy coverage without relying on manual setup.

To learn more, read Jamf’s AI governance for Mac blog post, watch the AI governance on Mac webinar, or get started from AWS Marketplace.

About the authors