Built for Apple Admins. Powered by you.

TouchID Extension Attribute

Hi, Has anyone yet figured a way to write an extension attribute to report whether a device is TouchID capable or not? bioutil does not seem to give any indication of capability regardless whether it's run on a TouchID capable device or not. There doesn't seem to be anything returned by system_profiler to indicate. Struggling to find anything that could be leveraged... CheersDan

23018

D

dletkemanJamf Heroes

Failed to retrieve configuration on iPadOS v15.8.4

Heads up to my fellow Jamf community. We've been seeing iPadOS 15.8.4 iPads when reprovisioned can't be enrolled to Jamf School.  This may affect Jamf Pro too.  The exact error is "Failed to retrieve configuration".  I reached out to Jamf support and they said they have been getting reports of this from others and that this has been observed across different MDM providers.  Jamf reached out to Apple regarding this issue and this is exactly what they told me: Apple did get back to us just a bit ago, and they have identified the issue (they did not elaborate on what the issue was). The release is not ready yet though and at this time they couldn't give me an ETA on when that would release. For now I created an internal Jamf Product Issue so we can track customers and I have attached this case to that ticket (PI136109). Hopefully an update that fixes this issue will come out soon.  Jamf did say that they could reproduce my issue but had mixed results as one te

397431

stephaniemm77Contributor

Custom Login Screen Background

HelloI have had someone inquire about a custom longin screen, I know its not super easy to accomplish I guess I am wondering if anyone uses a 3rd party app or found another way besides disabling SIP.

130

Admin SSO in Account Outreach Sessions

ianhansenCommunity Manager

Jamf Announcements

Hey Jamf Nation!Do you have questions around Admin SSO in Account or are you running into issues configuring it? We are here to help!Starting next Wednesday October 29th at 2PM CST we’ll be hosting the first session of our Admin SSO in Account Outreach series. These sessions will occur twice monthly for an hour with an open format where Jamf experts will be online to help you through enabling Admin SSO in Account and answer any questions you may have!To sign up for an upcoming session please email beta@jamf.com. These sessions are capped at 10 customers and are first come first serve to best support a small group conversation and ensure you leave with answers or guidance towards setting up Admins SSO in Account.We’re excited to hear from you!

644

bar_is99Visitor

Repeated FileVault Key Activation Prompt on Mac Despite Successful Key Escrow

We have a configuration in place where all company MacBooks receive a push notification prompting users to activate FileVault.After entering the password, the FileVault recovery key is successfully escrowed and the process is completed as expected.However, one of our colleagues continues to receive the FileVault activation prompt several times a day — even though the recovery key has already been successfully stored in Jamf Pro.This behavior seems to affect only this specific device. How can we stop this behavior?

231

G

ghaskinsNew Contributor

BeyondTrust Remote Support - Sequoia - Remote Desktop

Hi! We finally upgraded Bomgar or BeyondTrust Remote Support to 24.3.2 to support Sequoia. The only issue I'm having is finding a way to allow standard users to toggle on, or allow applications in System Settings > Privacy & Security > Remote Desktop.I didn't see anything in the PPPC Utility tool and wasn't able to find anything in Jamf Pro under the Privacy Preferences Policy Control config settings.   Wasn't sure if it's possible to allow currently or not but thought I'd ask here.

2954

C

ChrisRupertValued Contributor

Remote Management Message On Lock Screen

Has anyone else encountered this yet and has a fix or work around? On the lock screen of an iOS 11 device (that is managed and supervised) a box appears at the bottom that says "This device is managed remotely. You can leave remote management in Settings." This message could be very bad if students see this. Has anyone figured out a way to remove the message or even modify it? I'd be happy leaving the first sentence and removing the second :)

23217

U

karmanNew Contributor

File Cannot be processed

Hello, I am trying to create a configuration profile on Jamf to deploy it to my mac laptop.The .mobileconfig is built using the template mentioned here (docker.mobileconfig): https://docs.docker.com/enterprise/security/enforce-sign-in/methods/#macos-configuration-profiles-method-recommended When I try to upload this in Jamf (we use Jamf Pro) using the “Upload” option shown below, it fails with the error “File Cannot be processed” I am able to create the profile using the “New” button where I copy and paste my profile in the Property List box.I don’t suspect anything wrong with the template structure as using “New” button I am able to upload it and also I am able to directly add my profile on my mac laptop.Any idea why I am getting “File Cannot be processed” error when I use “Upload” option ?I have reviewed few old posts reporting similar error, but they are slightly different than my issue.Appreciate any help.

798

dletkemanJamf Heroes

Single app mode locks to home screen in iPadOS 26.0.1

I’m unsure if this effects iPadOS 26.0 as I have just pushed out iPadOS 26.0.1 to devices this week. We have a Single App Mode profile for TD Snap (though app doesn’t really matter). After the device is rebooted it looks like on the home screen you can’t unlock the device.Swiping up just shows “No older notifications” but does not unlock the phone and take it to the Single App locked mode to TD Snap.Has anyone else experienced this?This iPad is on iPadOS 26.0.1. Didn’t have this issue prior to the update.

akehrenNew Contributor

Enable device notifications while using SharePlay or Screen Mirroring

I'm trying to setup the GoGuardian app for a small group of our iPads. I have everything working except that I can't find a way in Jamf Pro to turn on the setting for "Allow Notifications" in the Screen Sharing section. It's off by default but it needs to be enabled so that teachers can send notifications to the iPad requesting it to open a browser tab for the student.I'm guessing that's just not something Apple allows Jamf to set, but I wanted to check with group and make sure I'm not missing something obvious. Thanks!

251

D

dfarnworth_bContributor

TouchID Extension Attribute

Hi, Has anyone yet figured a way to write an extension attribute to report whether a device is TouchID capable or not? bioutil does not seem to give any indication of capability regardless whether it's run on a TouchID capable device or not. There doesn't seem to be anything returned by system_profiler to indicate. Struggling to find anything that could be leveraged... CheersDan

dletkemanJamf Heroes

Failed to retrieve configuration on iPadOS v15.8.4

Heads up to my fellow Jamf community. We've been seeing iPadOS 15.8.4 iPads when reprovisioned can't be enrolled to Jamf School.  This may affect Jamf Pro too.  The exact error is "Failed to retrieve configuration".  I reached out to Jamf support and they said they have been getting reports of this from others and that this has been observed across different MDM providers.  Jamf reached out to Apple regarding this issue and this is exactly what they told me: Apple did get back to us just a bit ago, and they have identified the issue (they did not elaborate on what the issue was). The release is not ready yet though and at this time they couldn't give me an ETA on when that would release. For now I created an internal Jamf Product Issue so we can track customers and I have attached this case to that ticket (PI136109). Hopefully an update that fixes this issue will come out soon.  Jamf did say that they could reproduce my issue but had mixed results as one te

397431

stephaniemm77Contributor

Custom Login Screen Background

HelloI have had someone inquire about a custom longin screen, I know its not super easy to accomplish I guess I am wondering if anyone uses a 3rd party app or found another way besides disabling SIP.

130

bar_is99Visitor

Repeated FileVault Key Activation Prompt on Mac Despite Successful Key Escrow

We have a configuration in place where all company MacBooks receive a push notification prompting users to activate FileVault.After entering the password, the FileVault recovery key is successfully escrowed and the process is completed as expected.However, one of our colleagues continues to receive the FileVault activation prompt several times a day — even though the recovery key has already been successfully stored in Jamf Pro.This behavior seems to affect only this specific device. How can we stop this behavior?

231

G

ghaskinsNew Contributor

BeyondTrust Remote Support - Sequoia - Remote Desktop

Hi! We finally upgraded Bomgar or BeyondTrust Remote Support to 24.3.2 to support Sequoia. The only issue I'm having is finding a way to allow standard users to toggle on, or allow applications in System Settings > Privacy & Security > Remote Desktop.I didn't see anything in the PPPC Utility tool and wasn't able to find anything in Jamf Pro under the Privacy Preferences Policy Control config settings.   Wasn't sure if it's possible to allow currently or not but thought I'd ask here.

2954

C

ChrisRupertValued Contributor

Remote Management Message On Lock Screen

Has anyone else encountered this yet and has a fix or work around? On the lock screen of an iOS 11 device (that is managed and supervised) a box appears at the bottom that says "This device is managed remotely. You can leave remote management in Settings." This message could be very bad if students see this. Has anyone figured out a way to remove the message or even modify it? I'd be happy leaving the first sentence and removing the second :)

dletkemanJamf Heroes

Single app mode locks to home screen in iPadOS 26.0.1

I’m unsure if this effects iPadOS 26.0 as I have just pushed out iPadOS 26.0.1 to devices this week. We have a Single App Mode profile for TD Snap (though app doesn’t really matter). After the device is rebooted it looks like on the home screen you can’t unlock the device.Swiping up just shows “No older notifications” but does not unlock the phone and take it to the Single App locked mode to TD Snap.Has anyone else experienced this?This iPad is on iPadOS 26.0.1. Didn’t have this issue prior to the update.

akehrenNew Contributor

Enable device notifications while using SharePlay or Screen Mirroring

I'm trying to setup the GoGuardian app for a small group of our iPads. I have everything working except that I can't find a way in Jamf Pro to turn on the setting for "Allow Notifications" in the Screen Sharing section. It's off by default but it needs to be enabled so that teachers can send notifications to the iPad requesting it to open a browser tab for the student.I'm guessing that's just not something Apple allows Jamf to set, but I wanted to check with group and make sure I'm not missing something obvious. Thanks!

Secure Disposal of Apple SSD units (NAND storage)

How is everyone securely disposing or destroying their own Apple SSD storage units?Considering that MacBooks from 2016 to 2022 have an SSD (NAND storage) that is not upgradeable,and it is not replaceable either, since it is soldered onto the main board:If a company has decommissioned a MacBook and the device reaches its end-of-life,the NAND storage cannot be extracted and re-used on a different device.Also:How can businesses assert that their data is securely wiped before device disposal?

547

userjamfNew Contributor

Converting AD Mobile to Local Accounts

Hi everyone, I’m looking for the best way to convert mobile accounts to local accounts without using Jamf Connect, and to do it cleanly. The goal is to improve compatibility with FileVault, since it generally works better with local accounts. I’ve tested version 3.0 of https://github.com/BIG-RAT/mobile_to_local.The script seems to correctly convert the mobile account into a standard local user and successfully removes the Mac from the domain.However, after that step, I wanted to test joining the domain again the rejoin works, but I can no longer log in with any AD accounts. No matter which account or password I use, authentication just fails. Has anyone else experienced this issue or found a more reliable method ?

421