Deploy Contacts to iPhone with Jamf Pro

Introduction

If you manage iPhones through mobile device management platforms like Jamf Pro, you’ve probably faced this challenge: Getting company contacts into the native Contacts app across your entire fleet. Not in Outlook mobile app, or a 3rd party app but In the native Contacts app where users actually look.

In this post, we’ll walk you through real-world deployment scenarios and show you how Contactzilla and Jamf Pro work together to deploy address books at scale.

Why Contact Deployment Has Been Difficult

Nearly all organizations have some form of Microsoft ecosystem in place, which naturally leads IT teams to explore native Microsoft solutions first. Others work within Google Workspace or attempt manual methods. We’ve covered the various contact mangagement approaches in detail in our enterprise contact management guide but here is a quick overview of common approaches and issues involved:

Approach	Common Issues
Exchange ActiveSync / GAL	Contacts are search-only, not synced to native Contacts app. No caller ID integration.
Outlook Mobile Contact Sync	Only syncs personal mailbox, not the company directory or GAL. Contacts stay isolated in Outlook app.
Google Workspace Shared Contacts	Don’t sync to mobile devices. No caller ID. Must search manually—can’t browse as a list.
Shared Exchange Mailboxes	All users receive unwanted email notifications. No granular permission controls. Full edit access for everyone.
Manual CSV/vCard Distribution	No ongoing sync. Requires manual re-import for every update. Doesn’t scale. Can create duplicates
LDAP / Active Directory	Requires on-premises infrastructure. Most MDM policies block third-party LDAP apps. Reliability issues at scale.
PowerShell / Power Automate Scripts	Overly complex to build and maintain. Requires dedicated expertise. Breaks when APIs change.

Native solutions either don’t sync to the Contacts app at all, require regular manual intervention, or introduce complexity that doesn’t scale across a fleet.

The Read-Only Contact Permission Problem

One issue that affects multiple approaches is the inability to enforce read-only permissions. Google CardDAV doesn’t support read-only access natively. When IT teams deploy company contacts via Google CardDAV through Jamf Pro, users can add, modify, and delete entries—and those changes sync back to everyone else.

Exchange shared mailboxes have the same limitation. All users get full edit access with no granular controls.

When deploying through Contactzilla and Jamf Pro, you have complete control over permissions. You can enforce read-only access at the server level, preventing users from modifying or deleting shared contacts. And if your team needs flexibility, read-write mode lets users add and edit contacts with a handy option to block deletions from the master directory.

Contactzilla interface showing a read only device connection being setup with the option to append a lock emoji next to each contact ticked. — Here a read only deployment is being set up in Contactzilla with a handy option to append a lock emoji to each contact selected. – This signals to the end user that the contacts are read only.

Real-World Contact Deployment Scenarios for Jamf Pro MDM

Scenario 1: Company-Wide Directory Deployment

Deploy your entire company directory to all iPhones enrolled in Jamf Pro. Every employee gets access to all company contacts in the native phone app. Read only deployment is a popular choice. Without it, personal contact entries—family members, friends, random numbers can end up in the company contact list and sync to everyone else’s devices.

Scenario 2: Department-Specific Contact Lists

Diagram showing how Contactzilla syncs filtered contact lists to different device groups using labels like department:er, rank:responder, team:dispatch, and unit:maintenance. The interface applies selected labels to push read-only contact views to the right phones or tablets. — Contactzilla’s selective read-only sync filters your master contact list using one or more labels — such as department, role, or team — and pushes only the relevant contacts to each group of devices. For example, a medic’s phone might receive contacts tagged rank:responder, while dispatch tablets get contacts under team:dispatch, and field maintenance crews receive only those tagged unit:maintenance.

Different teams need different contacts. Users see only what’s relevant to their role.
Use Contactzilla labels to tag contacts, then deploy only specific labels to specific device groups via Jamf Pro. Contacts can be categorized but anythign that works for you e.g. REgion, event, department or team.

Scenario 3: BYOD and Contact Deployment with Jamf Pro

Employees using personal devices enrolled in Jamf Pro through Jamf’s User Enrollment still receive deployed address book/s. CardDAV sync works identically on company-owned and BYOD devices. Read-only deployment aligns well with BYOD policy constraints—the contact list deploys automatically without requiring personal contact data management.

Why CardDAV contact deployment works with iPhone and Jamf Pro

CardDAV is a standards-based protocol that iOS recognizes natively. When you deploy a CardDAV account to an iPhone via a Jamf Pro config profile, the Contacts app automatically syncs with that account in the background and updates sync silently without user action.

Contactzilla provides the CardDAV server infrastructure that Jamf Pro connects to. You configure permissions, organize contacts by label, and generate the mobile configuration file in Contactzilla. Jamf Pro deploys that configuration to your iPhone fleet.

Tip 💡: For a deeper dive into CardDAV, see our detailed guide here.

Getting Your Contact list Ready: Import Options

Contactzilla import options page displaying standard importers CSV and vCard plus premium importers for Salesforce, Microsoft Entra ID, and Google Workspace Directory.

Before deploying your contacts through Jamf Pro, you need to get them into Contactzilla. Multiple import paths exist depending on where they currently live.

CSV or vCard Import

Upload CSV or vCard files directly. Best for one-time migrations from legacy systems, spreadsheet-based directories, or when you need precise control over contact data before import. CSV imports are manual, which means you re-import when contacts change, but many organizations prefer this approach for its simplicity and control. You have precise control over how duplicates are handled and how you map your spreadsheet columns to the Contactzilla system.

Contactzilla CSV import duplicates handling options showing Skip duplicates, Replace duplicates, and Merge duplicates settings

Microsoft 365 Sync (Premium Importer)

Contactzilla Microsoft Entra ID import setup showing OIDC connector selection for Microsoft Default Connector to sync Microsoft enterprise contacts.

Automatically syncs contacts from Microsoft 365 to Contactzilla on a scheduled basis. Changes in your Microsoft 365 directory flow to Contactzilla, then deploy to devices via Jamf Pro without manual exports. Keeps contact lists current as your organization changes.

Google Workspace Directory Sync (Premium Importer)

Contactzilla Google Workspace directory import setup showing OIDC connector configuration for syncing Google Workspace Directory Users.

Syncs Google Workspace directory users to Contactzilla automatically. Maintains alignment between your Google Workspace directory and deployed contact lists. New hires appear in Contactzilla and deploy to iPhones without manual intervention.

Salesforce Sync (Premium Importer)

Syncs Salesforce contacts directly to Contactzilla. Useful for customer-facing teams that need CRM contacts deployed to mobile devices.

Deploying Contacts to iPhones Through Jamf Pro

Note: These steps are written for Jamf Pro (Cloud or on-prem).
Jamf School and Jamf Now can also deploy Contactzilla via a custom .mobileconfig upload.
Per Jamf’s current documentation, Jamf Now no longer requires the ‘Plus’ plan for custom profiles.

The deployment process flows through four key steps: creating a device connection and generating your configuration profile in Contactzilla, uploading the profile to Jamf Pro into a new configuration profile, selecting your target devices, and deploying.

Tip 💡: For complete step-by-step instructions with troubleshooting, see our detailed deployment guide.

If you’d like a visual walk through click the video below:

Here’s how each step works.

Step 1: Create Device Connection and Generate Configuration Profile

Contactzilla Device Connections page showing Create New Device Connection form with iOS iPhone iPad connection type, access type, and label sync method settings.

Step 2: Upload the Profile to Jamf Pro

Step 3: Select Your Target Device Group

Step 4: Deploy and Verify

iPhone Screenshots showing CardDAV account setup process with Contactzilla contacts appearing in native iOS Contacts app with read-only access lock emoji.

Frequently Asked Questions

How do I push contacts to iPhones using Jamf Pro?

You push contacts to iPhones using Jamf Pro by deploying a CardDAV configuration profile. First, create a device connection and generate a .mobileconfig file from your CardDAV server (like Contactzilla). Then upload that configuration profile to Jamf Pro, scope it to your target devices or device groups, and deploy. Contacts sync automatically to the native Contacts app within minutes of deployment.

How often do contacts sync to iPhones through Jamf Pro?

Contacts sync in near real-time through CardDAV, typically within 2 minutes of changes being made on the server. The sync happens automatically in the background without user intervention. This is separate from Jamf Pro’s device check-in frequency, which defaults to every 15 minutes for configuration profile updates.

Can I make deployed contacts read-only on iPhones?

Yes, but read-only enforcement requires a CardDAV server that supports permission controls at the server level. Native Google CardDAV does not support read-only permissions—users can add, modify, and delete contacts, and those changes sync back to all devices. Third-party CardDAV platforms like Contactzilla, sync.blue, and similar services provide true read-only deployment by enforcing permissions server-side

Are there security considerations when deploying contacts to iPhones via Jamf Pro?

Yes. Contact data transmits over HTTPS encryption via CardDAV, protecting information in transit. Choose a CardDAV provider with SOC 2 Type II certification for enterprise security standards. Jamf Pro deploys configuration profiles using standard MDM security protocols. Contact data stores locally on devices and syncs over encrypted connections. For sensitive environments, verify your CardDAV server supports OAuth 2.0 authentication and maintains HIPAA or GDPR compliance certifications

What happens if a user deletes a contact deployed through CardDAV?

If the CardDAV server enforces read-only permissions, deleted contacts restore automatically on the next sync (typically within 2 minutes). If the CardDAV account allows editing, the deletion syncs to the server and removes the contact from all other devices connected to that account.

Do I need Apple Business Manager to deploy contacts through Jamf Pro?

No, you don’t need Apple Business Manager to deploy contacts through Jamf Pro. CardDAV configuration profiles work on any iOS device enrolled in Jamf Pro, whether through device enrollment, user enrollment, or BYOD enrollment. Apple Business Manager is not required for contact deployment.

Why aren’t my contacts appearing in the native Contacts app after deployment?

1) Verify the configuration profile installed successfully on the iPhone under Settings > General > VPN & Device Management.
2) Confirm the CardDAV account appears under Settings > Contacts > Accounts and is toggled on.
3) Send a “Blank Push” from Jamf Pro to force immediate profile delivery instead of waiting for the next check-in.
4) Verify the CardDAV server credentials in the configuration profile are correct.

Deploy Contacts to iPhone with Jamf Pro

Introduction