Skip to main content

Unanswered questions

75
DLippold
DLippoldVisitor
 General Discussions
User-Initiated Enrollment - LDAP/Managed AppleIDs necessary?

Hello, So I’m curious about whether we need to have either an LDAP server setup or issue managed AppleIDs in order to utilize user-initiated enrollment.I made a user and user group in JAMF Pro thinking it would allow for enrolling a device and that I could give my end users a single set of credentials to then get the MDM profile and configuration to everyone. However during the enrollment, I get stuck on a page which mentions “Assign to User” with a blue magnifying glass and Enroll button which don’t seem to react, no matter what I enter. Perhaps this is not possible, but it’s what I’m hoping to find out here. Can I use a single JAMF Pro user to log in all my end users for user-initiated device enrollment? Or must we set up an LDAP server/get managed IDs?Context: We are doing a big push for new devices soon, and currently we have no self-enrollment, meaning our IT department would have to manually enroll every phone. We are looking for an alternative solution to avoid that. We do not u

30
DLippold
BCPeteo
BCPeteoContributor
 General Discussions
What happens on macOS when you update a configuration profile

We need to add a new allowance to our VPN profile that is required for the newest version of our VPN client .I am trying to figure out what exactly happens on macOS when a profile gets updated. Does it remove all the settings the profile sets and reapply, or does it only add/remove changes. I would like it so people do not get kicked off VPN when the profile is updated (The addition to the profile only deals with login items.  

192
sdagley
stutz
stutzContributor
 General Discussions
Self Service+ Issues (Keychain and Onboarding)

Anyone having a keychain issue and the onboarding window not opening automatically upon first login (newly imaged machine that hasn’t been logged into before)?  Tried 3 times and get the same result.Self Service+ Version: 2.4.0Jamf Connect Version: 3.4.1Jamf Connect Preference Domain Version: 3.2.0macOS Version: 15.5 (24F74)  

40
stutz
dreynolds1118
dreynolds1118New Contributor
 General Discussions
Sophos [HIGH] Alert for Sophos Central

Does anyone receive these emails, [HIGH] Alert for Sophos Central, when their computer is updated from one operating system to another, or at other random times? I was informed by Sophos that I would need to manage using static groups instead of smart groups, but that seems inefficient and not ideal.

193
brandonharshe
SSLC
SSLCVisitor
 General Discussions
ZTNA network routing not actively used

Hi,I’m trying to use Network Access in Jamf Cloud to route traffic to M365 apps via the ZTNA network for IOS devices. I’ve added this as a separate Activation Profile on top of the Default Profile that covers different services. The users already had the Jamf Trust app on their phones for the previously enabled services. Those services didn’t require a login, since Jamf Pro is distributing Jamf Trust. With the additional profile I assumed that logging in was somehow made possible in the App, but there’s no option anywhere. Also, I don’t see that traffic is routed through the ZTNA network either (since I would expect traffic to come from a different IP). Last, if I look in device management in Jamf Cloud, the Network Access services is not active for the devices, so I wonder if the Activation Profile is even deployed, despite I’ve done that (I even tried to open the link on a phone manually).Any suggestions on what I might be missing or doing wrong? The documentation isn’t really giving

80
SSLC
rfakes12
rfakes12New Contributor
 General Discussions
Jamf School and strong certificate mapping with AD

Hi everyone,We’re currently using Jamf School to manage our Apple devices and are running into issues with Microsoft’s enforcement of strong certificate mapping as outlined in KB5014754.Our environment relies on certificate-based authentication with Active Directory. While we’ve configured UPN mapping using the RFC 822 SAN field, our domain controllers (now in Full Enforcement mode) are rejecting certificates that don’t meet the new strong mapping requirements.Unfortunately, Jamf School doesn’t appear to support:Inclusion of SAN URIs with SID Custom certificate templates Scripting or automation for explicit mapping via altSecurityIdentitiesWe’ve temporarily enabled Compatibility Mode on our domain controllers, but this is only viable until 10 September 2025, when Microsoft will enforce Full Enforcement by default.Questions for the community and Jamf staff:Are there any confirmed plans for Jamf School to support strong certificate mapping before the enforcement deadline? Has anyone foun

223
mvu
vshulhin
vshulhinNew Contributor
 General Discussions
Jamf Remote Assist

Hello Jamf Community, I'm currently experiencing an issue with Jamf Remote Assist — I haven't been able to successfully connect to any Mac devices for the past two weeks. Each attempt either times out or fails with no clear error message. I've tried the following so far: Confirmed that Remote Assist is enabled in Settings. Restarted Jamf Daemon and the local Jamf app on the affected Mac. Verified network/firewall configurations (no changes recently). Tested on both Intel and Apple Silicon Macs with the same result. Has anyone else encountered similar issues recently?Is there any known workaround or reliable fix that could help restore functionality? Any suggestions or guidance would be much appreciated. Thanks in advance!

868
mvu
user-BqBTAgwquG
user-BqBTAgwquGContributor
 General Discussions
Platform SSO with MS Entra ID Advice

We’ve been testing Platform SSO with Microsoft Entra ID in a Password Authentication configuration, and found that we need to create a local account on the system first in System Settings > Users & Groups, before a user can log in with user@domain.com as their username, is that expected behavior? If that is what is required then we can work with that, but ideally once the system has the relevant configuration profiles installed I’d like anyone in Entra ID to be able to log in without any manual configuration. If I don’t manually create a local, standard account with the same username beforehand, the user just gets a dialogue box containing a yellow warning triangle with no other information and is then automatically logged out again. Or would I be better off with a Secure Enclave configuration? We have hundreds of staff 1:1 Macs (mostly MacBooks) and about 100 lab iMacs/Mac Studios. We are a big MS/Azure/Entra house, currently bind to AD (which we are desperate to come away from

725
mvu
BookMac
BookMacJamf Heroes
 General Discussions
Jamf Nation Forum

Hello jamf nation, If the goal of the new Jamf Nation Rewards program is to generate more content, user numbers and traffic, then it would be cool if jamf also considered redesigning the forum page. There are no specific topic areas. I can only search or scroll down. If I have then scrolled down so far that I have to click on "load more", then open a post and click back again, I am back at the top of the homepage and have to go back to the bottom and click on "load more". The only way to avoid this is to open a post in a new tab. Are there any thoughts on this?l @Mitchell_Gordon  Cheers

929
Mitchell_Gordon
dlondon
dlondonHonored Contributor
 General Discussions
Restricting Office Macros

Hi,We are working on implementing Managed Blocking of Macros in Office365.  My task was to to have every user (not computer) have the Macro Security locked to "Disable all macros without notification" There was also to be an exclusion group for users who would not be controlled by the above lock.  For the exclusion group, we wanted if possible for them to be locked instead to "Disable all macros with notification" as that setting allows a user to enable macros on a document by document useI also had to make this work with Entra or our On Premises Active Directory (to which the Mac's are bound).  As there's no linkage yet with Entra I've focused on Active Directory (AD)I found that the settings for this in the Configuration Profile only work on a "Computer Level" even though they seem to be User settingsMy Configuration Profile looks like this:This works but generally takes a few minutes for the machine to pick up a change in the group from ADIf I try and make a second Config Profile an

342
sdagley
shrisivakumaran
shrisivakumaranJamf Heroes
 General Discussions
Okta LDAP attribute changed for City

Does anyone noticed LDAP attributes for Okta is changed from city to l or o?From today morning, I saw this changes on my environment. With city key word, its not pulled data from Okta to Jamf.

20
shrisivakumaran
mvu
mvuJamf Heroes
 General Discussions
WWDC25: What’s new in Apple device management and identity

In case you missed it ... What’s new in Apple device management and identity https://developer.apple.com/videos/play/wwdc2025/258/?utm_campaign=MacAdmins.news&utm_medium=email&utm_source=MacAdmins.news_365

182
D
J
jamesonContributor
 General Discussions
Best way to collect log files

When Mac users rapport issues, you always have to remove/walk to the user and typically the first you do is check log files As far I remember during Jamf training, there is an option to get log files uploaded into the jamf backend in attachement ?. But cannot remember the details on this - but is there a way to do this?

260
markopolo
mattjerome
mattjeromeJamf Heroes
 General Discussions
Unified Logging

I'm new to Jamf Protect. At some point I thought I heard it can house logs, but everything I'm reading says it needs a SIEM. Can anyone clarify?

40
AJPinto
shrisivakumaran
shrisivakumaranJamf Heroes
 General Discussions
About Google Chrome updates

I have enabled path management notification for Google Chrome update, Today I received below notification from Jamf Pro but when I checked in Google there is no information about the mentioned version. Is this is false alert from Jamf Pro?   Updates for Google Chrome are available.Title: Google ChromeVersion: 137.0.7151.121Publisher: Google

110
mattjerome
J
jasonmNew Contributor
 General Discussions
Out of Box Private Wi-Fi Address Disabling

An org’s network requires non-personal devices (think digital signage, inventory scanners, etc...) to be bound to a set network using MAC address.  That then requires “Private Wi-Fi Address” to be disabled on all the iOS devices otherwise the device MAC does not match up to the registered MAC.For these type devices, I have a config set to disable “Private Wi-Fi Address” but that only comes through AFTER the device is enrolled (and gets internet access of course).  With a random MAC, the device cannot do the initial out of box activation and eventually times out.  I can get around all of that with a USB ethernet dongle, which allows the device to get online, enroll, get wifi config settings etc... but that is time consuming.Does anyone know of a way to disable the private wi-fi address setting when you first connect a device to wifi out of the box?I have tried backing out on the setup screen and holding the wifi name in question to try and bring up options, but so far no

80
Q
J
jackrum1New Contributor
 General Discussions
Trying to Add a Video to Custom Enrollment

I'm trying to add a video to a customize enrollment. It's a video we are storing in a S3 bucket on AWS. When I try to embed it the video doesn't show. Everything I look about this is about Youtube videos but we don't particularly want to host a video on Youtube.

50
R
M
msnowdonContributor
 General Discussions
Is it possible to set ClassLink to open to the correct school using the App Configuration option?

We use ClassLink Single Sign On to manage certain apps on our iOS devices. At first launch, you need to choose the correct school district which can get a little confusing. I was wondering if there was a way using the App Configuration setting to specify the exact URL to open upon launching ClassLink.

20
DanTaylor
red_beard
red_beardContributor
 General Discussions
Transition from Jamf Pro to Jamf School - Content Tokens (Parallel Worlds?)

I'm transitioning us from Jamf Pro to Jamf School. It can't happen like a flipping a light switch so I have to deal with small amount of lingering devices still in use in Jamf Pro into the coming school year (I have all our student devices but not teacher devices). In Jamf Pro we currently have 8 different Sites each setup with their own content tokens that match our locations in Apple School Manager. As we make the transition I can't completely remove every single license from Jamf Pro's tokens, so in setting up Jamf School I'm wondering.... Should I create this same structure with new locations and new content tokens to transfer the bulk of the licenses to in Apple School Manager for the new Jamf School instance, since I can't clean house and use the existing token? Downsides? Is that what Jamf School expects or is it more tuned to one large pool of apps from one content token even when using multiple locations with Jamf School ("sites"). I suspect creating this parallel world is t

20
red_beard
Q
QwheelValued Contributor
 General Discussions
JAMF 'Wipe Computer' command put 12/20 M4 Mac Mini's into DFU mode

Hello all,Just come to reimage my first computer lab of the year.Figured 'this lab now has M4 Mac mini's in it... that means I can use the Wipe Computer MDM command', as this is essentially doing an 'Erase all content and settings' - something I have previously done manually.8 of the devices wiped, reactivated, then started up just fine.The other 12 have SOS orange blinking lights on the front - apparently in DFU mode because something broke.I don't normally have to do this DFU business, so I'm connecting a USBC, loading Apple Configurator 2... and I'm going through the motions.After downloading and attempting to install, it failed presumably because my Macbook is on Sonoma, and it wants to be on Sequioa - now waiting for macOS to update.What a hassle! Is this a known bug?Hard to imagine I messed something up here. Ya press a button, enter a code... device wipes itself.Anyone been in this situation care to mutually vent frustration with me on the forums?

90
Q
YanW
YanWContributor
 General Discussions
ERB Secure Browser Screen Time Permission

This ERB Secure Browser app require Screen Time permission. Our students are standard account. Is there a way to allow Screen Time or any ways to solve it?

00
AJPinto
T
TeaKNew Contributor
 General Discussions
auto-attempt SSO sign-in

Historically, after your jamf pro sign-in timed out, when you returned to the login page, it would sign you in automatically. With the new jamf admin sso integration, every login attempt requires you to type your full email. it only takes a few seconds, but when I have to do it 6 or 7 times a day, it starts to add up. 

40
T
C
claudio_proviniContributor
 General Discussions
Set account o365 on outlook 16.94 and office apps activation

Hi to all i've followed instruction on this link https://www.jamf.com/blog/help-users-activate-microsoft-office-365-and-configure-outlook-in-one-click/ to activate office 365 versione 16.94 on mac but office apps are not signed and when i open outlook the account has not be setted. In profile setting on the mac the parameter $email has been setted correctly with the email address settted on jamf inventory. There is something wrong? Thanks for your help

20
W
C
camilloNew Contributor
 General Discussions
Set Outlook 365 to default mail app

Does anyone has a way to setup MS Outlook 365 as default mail app? If you want to setup it manually you have to do it in the Mac mail app, although you never used it. I have to send out something to the organization with an mailto: link and I do not want all people calling me to ask why Mail is opening instead of Outlook. Additionally it would be nice to set default programs via config profile in Jamf pro. Thank you for your help.

30
T
T
tcandelaContributor
 General Discussions
configuration profile order of precedence

say i have 10 configuration profiles and 2 of them happen to have ENERGY SAVER settings. Names of the 2  config profiles with energy saver settings are below.  Which one of them gets their settings applied to the mac laptop? Gaming Energy Saver. (Battery: sleep 30, display sleep 30)                                      (Adapter: sleep 30, display sleep 1 hour)                                        Action Energy Saver. (Battery: sleep 15, display sleep 10)                                   (Adapter: sleep 15, display sleep 10)

50
mvu

Have an Idea?

Submit and vote on product ideas.

Submit Feature Request
Terms & ConditionsCookie settings