I have written a long time ago and still use an Automator workflow which runs an AppleScript which front-ends the built-in ZIP command line tool. Its main purpose is to provide a means to generate password protected ZIP files. The built-in 'service' does not give this option even though I suspect it also frontends the same built-in ZIP command line tool.This workflow for me still works fine even in macOS Sonoma.It used to be (back in the good old days 😁) that installing an Automator workflow was literally a simple matter of copying it to either -/Library/Services/ (to make it available to all users)or~/Library/Services/ (for an individual user)These days it is a lot more complicated.You still need to copy it to /Library/Services/ but you then apparently need to open it in Automator, re-save it in the same /Library/Services/ location which appears to cause Automator to register it in the list of available services - this of course requires using an Administrator authen

I am having hard time deleting smart user groups, I get the spinning wheel when I click on delete. The groups are empt. So annoying! 

As I toy around with different app deployment ideas for our staff in Jamf School. I feel like I’ve hit an odd limitation.Can you only have a maximum of four App Installer apps appear in the Discover section? Can they be displayed in My Resources with the rest of the apps and packages? What do you do if you want to use more than four App Installer apps?This makes me think app installers while seemingly convenient are not the way. I was hoping to simplify our package management and updates form many things in trying to move from Jamf Pro to School maybe Appl Installer aren’t the way.I also thought I might use Installomator, but for apps I’d like to provide “on-demand” it seems I don’t have a good way to trigger their installation without policies being available. I’d be curious what others have settled on to address this or point out to me the obvious toggle I’ve missed somewhere!  

We have the policies to install the following Office 2024 components in order during our prestage deployment:2024 Volume SerializerMicrosoft Excel 2024Microsoft PowerPoint 2024Microsoft Word 2024For the past couple of years, this has worked exactly as intended. The volume serializer is installed to activate the license, then the individual apps are installed one by one. After deployment these have also opened and been activated. However, over the last week or so, the activation is no longer applying. I’ve tried everything I can to try and deactivate the license/reactivate it from self service etc, but the only fix appears to be completely removing all office components, and reinstalling them - only then does the volume serializer work. I thought this might be as a result of the latest Office apps, so I reverted to using older versions of the pkg files but the problem remains. I even tried using the whole Office suite pkg but the same thing is happening. Anyone else seen this before?  

Hoping someone can help as this has been making me pull my hair out.Running Jamf Pro with AD CS Connector delivering machine certs via SCEP. Macs are domain joined. Two SSIDs, one through Meraki APs with two NPS servers in the RADIUS config, another through a Cisco Z3 pointing to a separate NPS server. Same cert template, same Jamf profile structure across everything.The Z3 SSID works perfectly, Macs connect no problem. The Meraki SSID fails on every Mac. Windows machines on the same Meraki SSID and same NPS policy work fine.The CA is definitely issuing the cert, visible in certsrv. The Mac is also prompting to select a cert manually when it shouldn't be. NPS logs are completely silent, no 6273 events at all when the machine cert is used. The only time 6273 shows up in logs is when I manually pick a randomly assigned JAMF cert that belongs to a machine not in AD, and that's just "user account does not exist" shows up in my logs.eapolclient on the Mac shows the full TLS handshake comple

Hi, I have created a profile to only allow system settings and Pages apps. It worked as expected, but I keep getting the prompts below. Is there any way for me to disable them? Thank you.   

PI-1152 involves the MDM Device Identity Certificate not being trusted on new enrollments after updating to version 11.26.PI-1153 concerns Device Identity Certificates being marked as untrusted in Keychain Access during enrollment in version 11.26.1.

Hello there!I’m using Jamf School synced with ASM with shared iPads. I wanted to start using Jamf Teacher app on teacher’s shared iPads, so I’ve just configured Jamf Teacher following Jamf’s guidelines. It started working fine with all classes and students showing up correctly. But since I needed to rename all classes. I renamed in ASM, synced Jamf School, and reassigned teachers to their renamed classes. But now I get this error on Teacher’s iPads “You are not allowed to add students to manages classes. Contact your IT administrator for support” (I’m IT support). Any idea how to resolve this?Thanks! 

Apple Classroom on Teacher Macs in Jamf School - Possible without Managed Apple IDs?We're migrating from Jamf Pro to Jamf School. Previously had Apple Classroom working with Macs and iPads via ASM roster syncing from our SIS—no Managed Apple IDs needed.Current status in Jamf School:✅ Apple Classroom works on teacher iPads and student iPads ✅ Jamf Teacher app works on teacher Macs (shows rostered classes) ❌ Apple Classroom on teacher Macs won't load rostered classesTeacher Macs aren't receiving the Education Profile despite fresh enrollments. I suspect it's related to MDM-capable users, but can't confirm. Class data is clearly flowing (iPads get it, Jamf Teacher gets it), so it seems like a device-specific enrollment issue.Is Apple Classroom on teacher Macs possible in Jamf School without Managed Apple IDs?The solution seems tantalizing close based a on a checkbox still available in Jamf School - just that it only applied to pretty dated OS versions. Other 2 year old post   

Hi everyone,We’re currently using Jamf School to manage our Apple devices and are running into issues with Microsoft’s enforcement of strong certificate mapping as outlined in KB5014754.Our environment relies on certificate-based authentication with Active Directory. While we’ve configured UPN mapping using the RFC 822 SAN field, our domain controllers (now in Full Enforcement mode) are rejecting certificates that don’t meet the new strong mapping requirements.Unfortunately, Jamf School doesn’t appear to support:Inclusion of SAN URIs with SID Custom certificate templates Scripting or automation for explicit mapping via altSecurityIdentitiesWe’ve temporarily enabled Compatibility Mode on our domain controllers, but this is only viable until 10 September 2025, when Microsoft will enforce Full Enforcement by default.Questions for the community and Jamf staff:Are there any confirmed plans for Jamf School to support strong certificate mapping before the enforcement deadline? Has anyone foun

Hey everyone!It’s time to step away from the tickets and the terminal for a bit. We’re hosting an AZ Mac Admins Happy Hour at Dave & Buster’s Tempe, and you’re invited!Whether you’re a seasoned Jamf Pro or just getting started in the Apple ecosystem, come hang out, grab some drinks/sliders, and talk shop (or don't talk shop at all—your call).📍 The Details When: Thursday, April 23rd @ 6:00 PM – 8:00 PM Where: Dave & Buster’s Tempe (2000 E Rio Salado Pkwy) The Goods: Hosted by Rippling IT. We’re talking cheeseburger sliders, drinks, and some healthy competition in the arcade. 🎁 The Raffle (aka why you should definitely come)We are raffling off an Xbox Series S! 1 Entry: Just show up. +1 Entry: Bring an IT friend with you (you both get an extra ticket). Space is limited to 30 people so we can actually keep it social, so please RSVP here to grab your spot.Hope to see some familiar faces there! 🍻

JAMF Pro -  Running into something weird with newly prestaged Macs and not sure where to start.After PreStage enrollment, our internal CA cert. is getting installed, but it shows as not trusted in the System keychain. We can manually trust it and it’s fine after that.This wasn’t happening before — machines on 26.2 were fine. Started noticing it on 26.4.At the same time, GlobalProtect won’t connect on these machines. It just throws:“network connection is unreachable or portal is unresponsive”

Apple released the specs for a Migration Assistant Blueprint but you need to install at MDM enrolment to be able to use it. When will Jamf Pro support assigning Blueprints to PreStage enrollments?We need this for more than just Migration Assistant, it be a good to have for Passcode policies and a number of other settings as well.

Hi Guys,We are facing very weird issue at our Orgs, where none of the packages are getting installed during enrollment for some devices. The issue is not for all the devices, and usually for few devices but been having this issue once in a while.All the packages are signed, and works perfectly fine for most of the device. And for god sake, we cant replicate this issue whenever we do a testing.Those devices who have issue with package installation, usually works once wiped and re-run the enrolment process.Does anyone have idea on how to get this sorted?

One of my users cannot register for platform single sign-on. She can complete step 1, which is to authenticate with her Mac login password.  Next, she can enter her email address. That’s when the process goes awry. After entering her email address, the window goes blank white. Behind it, we can see that Company Portal is doing something in the background. There’s the spinning progress icon. After seeing this, I removed and reinstalled Company Portal and ensured that the latest version was installed. She’s running macOS 26.3.1 and will have 26.4.1 soon since I just started enforcing that update. Has anyone seen this behavior and solved it? The PSSO login type used is Secure Enclave. We can’t do anything but cancel the registration. 

We currently have over 600 inventory searches under Mobile Devices—many of them are duplicates or tied to old devices. Unfortunately, Jamf does not allow us to delete multiple searches at once, so each one has to be removed manually, one by one.It would be extremely helpful if Jamf could improve the interface by adding a filter option at the top of the page. For example, filters for date created (old/new), alphabetical order, or last used. In addition, having the ability to select multiple searches and delete them in bulk would make a huge difference.This would save time, reduce clutter, and help keep the system much more organized.

With the recent release of the M5, we’ve been trying to connect MacBook Pro’s to our 802.1x secured Wifi Network.We’re using the same configuration profile that has worked on the rest of our fleet.  Our network team have looked at the logs and have determined the issue is on the endpoint side “WLC keep sending EAP-TLS request and no response from client”.Wondering if anyone else has encountered this issue and what if anything was done to fix it.Thanks

We are currently in the process of implementing Jamf Pro in our company environment. So far, we have successfully integrated several scripts, SMB shares, and other configurations, and everything was running smoothly.As the next step, we attempted to set up Jamf Connect in order to integrate a SAML authentication flow via our Entra environment. The goal was to allow users to log in with their Entra credentials during a fresh macOS installation.However, after configuring Jamf Connect, we started encountering a critical issue. The Microsoft 365 login window appears as expected, but after a few seconds, the entire Mac screen goes black and becomes completely unresponsive. The only way to recover from this state is by manually restarting the device.Additionally, since this issue started occurring, our previously working scripts and configurations are no longer functioning as expected.Has anyone experienced a similar issue or has any suggestions on how to troubleshoot or resolve this problem

We’ve been using the jamf provided MakeMeAnAdmin shell script for temporary user account elevation without any issues for a while, but as of the last week or so it appears to have stopped working. jamf/MakeMeAnAdmin: Provides temporary admin access for a standard user via Jamf Self Service This has failed on two separate devices, one 26.2 and another on 26.4.  When reviewing logs, it mentions a group no longer being found.  I’ve looked around on Reddit and these forums and haven’t seen any other mentions of this issue recently, so figured it would not hurt to check in with the community. Typically we have been using the script via the Self Service app with no issues.  I know Self Service + is coming fast - could this be related?  Or is this just awkward timing on that front. We don’t use Jamf Connect, but putting a partial configuration for it and using the Self Service + app is successful in elevating the user temporarily to Admin permissions.  It is just the standard method of Self S

Hi Jamf Folks,I use nginx file distrubtion server. It works, but I have errors in the nginx log everytime I install something via Self Service +```2026/02/17 12:54:16 [error] 13387#0: *1 open() "/<pathToPkg>/Package.pkg/index.bom" failed (20: Not a directory), client: <ip-addresse>, server: webserver.de, request: "GET /<pathToPkg>/Package.pkg/index.bom HTTP/1.1", host: "webserver.de"```When I download it via webbrowser or wget, I do not get an error.here is my nginx.conf```worker_processes  1;events {    worker_connections  1024;}http {    include mime.types;    default_type application/octet-stream;    server {        listen 443 ssl;        http2 on;        server_name webserver.de;        ssl_certificate     fullchain.pem;        ssl_certificate_key privkey.pem;        location /Packages/ {            alias /<pathToPkg>/Packages/;            auth_basic "Downloads";            auth_basic_user_file /<pathto>/htpasswd;            types {                appl

Hi all,I’m looking for guidance on how to fully automate macOS updates across our company-managed Mac devices.We currently manage our Mac fleet using Jamf Pro version 11.24.1-t1769438062288. At present, macOS updates are being deployed manually through Self Service using packaged installers, but we would like to move to a more reliable and scalable automated process.So far, I have tried the following methods, but I have not been successful with either approach:Mass Action Command Managed Software UpdatesFor context, all company devices are:Enrolled via PreStage Enrollment Supervised Configured with Bootstrap Token allowed and escrowedIf anyone has successfully implemented a fully automated macOS update workflow in a similar Jamf environment, I would greatly appreciate your advice on the recommended process, prerequisites, or any known limitations.

Inherited a Jamf Pro deployment and looking to upgrade a piece of software that is being pushed out. This is what the policy looks like:GeneralEnabledTrigger: Recurring Check-InExecution Frequency: One per computerPackagePKG file, action InstallMaintenanceUpdate Inventory If I want to upgrade this with a new package, do I need a new policy with the same scope and disable this one? Or can I put a new PKG file in there?Thanks for any nudges in the right direction!

AI is changing how we work and it’s a huge area we’re all focused onOne of our engineers recently shared in an AMA some prompts customers are using with Ask Jamf right now:Help me identify OS versions in my fleet, highlight devices that can't be updated and need to be replaced. Can you explain how this policy and its script work? Survey our policies, profiles and groups and help write documentation. How do webhooks work in Jamf Pro? How do I get started with them? Do I have any configuration profiles that will conflict with this Blueprint?Now it's your turn, what prompts are actually working for you?Drop your best Ask Jamf prompts in the comments. I'll collect them and turn this into a community resource we can all learn from.Go 🚀 !

Getting around to trying to figure out this issue. We’ve been using Jamf Safe Internet for many months and it’s been working just fine. The iPads have the Trust App, the profile from Jamf Safe Internet, and the restrictions and blocks are working. Jamf Safe Internet shows over 3,000 devices are syncing.My questions is why might my Jamf School device records not indicate it’s installed on our iPads when everything seems to be working? No devices records indicate it correctly. Just wondering if this is a bug or somehow my configuration has small issue causing the reporting to be off.  

How do I block an URL with JAMF Teacher?