We’re using Return to Service to wipe a group of iPads with the Return to Service option enabled under ‘PreStage enrollments’.  Now seeing iPads that have Software Update blocked with this message.   Unable to Check for Update   These settings are not available while this device is configured for Return to ServiceThis message shows on iPads even after an erase using Apple Configurator.Two questions. This now the default for all devices that support Return to Service even if not used on all iPads? How do we install any Software Updates if blocked? Jamf’s AI answers are telling me the fix is to unmanage these devices.

Does anyone know how to get rid of this option? I'm not very techy, but my daughter keeps bypassing onto bad websites by using this option. I'm using an image off the Internet as an example but this is exactly what it looks like. Thank you 😊  

Enrolling new laptops and Self Service+ is installing.  However at login we are seeing a pop up for intel based apps with the old Self Service logo stating this version of “Jamf” will not work with at future release of MacOS 

Im testing Jamf/Entra Device Compliance. Everything is working as expected (Smart Groups, compliant/non-compliant criteria, Entra/Intune connector, etc). Now its time to focus on the actual registration workflow and policy logic to make it as painless as possible for my users.Does anyone have a customize workflow that improves the registration user experience? Popping up the Company Portal auth UI is not an elegant way to register our employees.🙏🏻

Hello,New to jamf school, I followed this page to install adobe with our shared device licence https://support.jamf.com/en/articles/12335537-deploying-adobe-applications-with-a-shared-device-license-with-jamf-schoolEverything runs perfectly but there is one major problem : The apps from the jamf “Apps installer” are only in english even if the creative cloud app from the package made with adobe console is in another language (as there is no link between them, except for licence I guess, cause Creative Cloud doesn’t detect the installations made from “Apps installer”) Is there any way to correct this ?

Hello, We are currently working on configuring Jamf Connect to get away from local AD binding. I have the initial login to macOS working (Google SSO Prompt and Duo MFA is working well.) After initial account creation when you’re prompted by Self Service + to sync your Google Account password to your local account, that is where it fails. The error is: “invalid password.”  In testing... any account outside or bypassed from Duo can query LDAP successfully. Accounts encompassed by Duo receive the same “invalid password” message via Self Service + or when running the LDAP query manually via terminal.  I’ve already spoken with Jamf support. They did some minor config changes, log searching, asked me to speak with Duo and then resolved the ticket. I have a support request into Duo at the moment but haven’t heard back. I’ve looked through both Duo’s policies and in Google Admin and haven’t come up with anything.  What am I missing? 

Hello everybody !I’ve been looking around, but without finding any real solution. Add to this changes from Apple / Jamf so what worked before may not work anymore, and of course what didn’t worked before may now be fine.I would like what’s the best practice to install minor or major updates of macOS on Apple silicon computers. Actually, I’m working on 2 scripts: one that will download the updates and another one that will install them later. The problem is: users have standard user account and of course, admin credentiales are needed.I’ve read that mdm commands aren’t very reliable, but as the posts are now from months ago, maybe that it’s working as expected now. And about those mdm commands, I don’t know if it downloads / installs only minor updates, or if it will install major ones if available.I was thinking of having the credentials as parameters for the scripts, but is is secure enough ?A last thing to ask: is there a way to install updates at the computer’s boot ? My main goal i

I have 2 questions with my Mac management with my on premise Jamf Pro instance.Before news MacOS is launch we would like to block the update while we made a couple of tests with our applications used in my university.What is the best way to block MacOS upgrade and for how long can we block the update? Second questions, After the pre stage enrollement i execute Jamf Setup Manager to install few applications and apply some configurations, i try to execute a script to reboot the computer but after reboot JSM runs again, how could i execute a reboot action after JSM properly?Thank you very much.

Hi,  we would like to add a watermark text in the background to all our prints. The solution should be distributable over Jamf Pro to our workers. Since now I tried to create this watermark with cupsfilter and ghostscript. Unfortanely both ways didn’t get the watermark in the backgrounds.  Have anyone another idea?  Best regards  Korbinian Eigner 

Cisco Secure Client (CSC): Version 5.1.12.146MacOS: Tahoe 26.5Current issue we are facing is that when enrolling new MacBooks into our environment we are seeing that Cisco Secure Client is no longer passing through deviceID to azure to pass through conditional access policies. Previously our environment was running JAMF conditional access, and our devices were enrolling without a problem. All applications were passing deviceID and going through conditional access policies (CAPs) without any blockers. Recently we have shifted over to platform SSO as per many people’s recommendation as the old method was being deprecated. Since then, we have noticed that most applications are still working without issues, but unfortunately Cisco Secure Client is failing to pass deviceID and is now being blocked by our Azure CAPs. The main difference that I'm seeing is that the previously enrolled devices also received a WJP certificate, while the new enrollment method no longer utilizes this check. We or

Happy Monday! So I just came across this issue.  When a user tries to change their password using Jamf Connect, they get this Kereberos error 4.So they go into Okta and change it there.  Later Jamf prompts them that the Local Password and Network password don’t match.  They are able to enter the old and new passwords and get the local mac password changed to match.  But Jamf still shows “password expires in 0 days”.I didn’t do the Jamf Connect setup, it was here when I joined the company, so I’m not sure exactly how to start fixing this.  I’m hoping you have some tips, maybe someone has seen this before, really anything.  I’ll keep doing my research, but It’s always nice to get some expert advice.-Pat

So It seems Apple has removed some MDM control of macOS updates in macOS 27 and they are only allowing using DDM commands to do this.Wanting to know if the Defer Major macOS updates MDM profile setting will work in macOS 27 or is this gone too? (I would assume that deferring upgrading to 27 will still work since older versions of the OS still support MDM update control. This is more about the future) I see with Jamf 11.29 that the download & schedule install is now DDM and works on prem but what we are really looking for is a way to continue Defer Major macOS updates for 90 days. We are not in Jamf cloud and not really looking to move.

Hi everyone,I've been working through a deployment of Platform SSO Simplified Setup on macOS 26 using Microsoft Company Portal 5.2604.1 (5.2604.0 or newer is required per documentation), and I've hit a wall with username/account name mapping that I wanted to share in case others are running into the same thing and could potentially provide some alternative options.---Our Setup- Jamf Pro 11.28.1- macOS 26- Microsoft Company Portal 5.2604.1 (deployed as a PreStage package)- Microsoft Entra ID- PSSO profile with Simplified Setup enabled (EnableCreateFirstUserDuringSetup + EnableCreateNewUserAtLogin both true)- Authentication method: Password- Associated Domains payload included in the same profile---The ProblemEverything works end-to-end — Simplified Setup fires during the Setup Assistant, the user signs in with their Entra credentials, and a local account gets created. However, the local account short name is being set to the full preferred_username value (e.g. John.Smith@company.com), w

Hi all, I'm trying to upload a specific DMG file to cache to Waiting Room and run a simple script that just installs a PKG that has to be in the same folder as a JSON file. I believe the silent install script I have should work fine, it's just the actual uploading of the DMG file that has me puzzled. I've done this exact same thing with other DMG files that contained items inside (a .app file that I successfully moved to the Applications folder) but this is a PKG file alongside a JSON file which I assume has some kind of configuration it needs. When i upload the DMG in the Packages section, it looks like it uploads, I run the Cached command in the Policy, and I get a corrupted error:    [STEP 1 of 5] Executing Policy FireEye Agent [STEP 2 of 5] Caching package Fire Eye Agent 32 30 13... Downloading https://use1-jcds.services.jamfcloud.com//download/012345etc/IMAGEHXAGENTOSX323013.dmg?token=012345etc... Verifying DMG... Error: Could not verify the down

We're in the process of getting ready to implement JAMF Connect for syncing local accounts with Entra. Our current Wi-Fi is 802.1x PEAP where users sign in with their username and password, which we were told is not compatible. We're looking into certificate based auth using machine certs, but haven't found a clear answer on how to make this work. Our PKI is Microsoft ADCS, so we run up against the strong mapping requirements. We don't have SCEP right now and we are hoping to not open anything for inbound communication as we don't host anything on site anymore and have no real dmz for hosting things. We also don't want to bind to AD as that's pretty terrible. Has anyone gotten this set up in a similar environment? Thanks!

We are trying to push out a profile to have our Mac's (in a primarily Microsoft environment) to auto join our 802.1x network. I have setup the Jamf ADCS and am able to push a device cert to the Mac's that I would like to use. I created a policy in NPS to use that cert for authentication that I would like to use but am getting auth failures. Any guidance for how to remediate this? 

Hello everyoneMy context: wi-fi authentication based on 802.1x through a Windows Server (NPS). Computer certificates are deployed by Jamf (Configuraton Profile) and through the Jamf ADCS connector.Macs are not bound to the Windows domain but a computer object is created for every laptop (it's mandatory with a NPS server).Everything is working as intended. As you may know, in may 2022 Microsoft published an important security update that changes the way certificates are validated by domain controlers.https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16  A new extension identified by the OID "1.3.6.1.4.1.311.25.2" is now included in certificate templates, but only for the ones that build the subject information from Active Directory.Unfortunately, certificates issued through the Jamf connector are "offline", meaning that the subject information (CN, DNS name) are supp

We use jamf school to reset laptops in classrooms, everything is installed in nl_NL but all Adobe apps stay in english. If we create a dutch package in Adobe admin console and try to upload it in jamf we get a parse xml error.  Tried all suggestions from AI but no succes.. 

Hello everyone, is there an API Call/Endpoint to disown Devices (ADE) in Jamf School?

Hey folks,We migrated from using policies onto using Jamf App Catalog to handle our standardize applications (Google Chrome, Mozilla Firefox, VLC, etc) for auto patching the latest builds and offering the software for workstations without the software to download from Self Service+.We’re looking into configuring Jamf Setup Manager, however since we do not have triggers from policies for software, I’m curious if anyone has found a workaround or best practice for this. I’m interested in hearing your thoughts, workarounds, and recommendations.Thank you,JG

Hey,I am just wondering if anyone else got the same expierence?After installing the latest DisplayLink Update, it turned out that the previous working configuration Profile is broken. Every time I open the Tool from the Apple Menu, the Splash Screen comes up again.This is the Profile in User Level (I tried also Computer Level) which worked fine on the previous version:PLIST file containing key value pairs for settings in the specified domain<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict> <key>AppAutostart</key> <string>1</string> <key>SilentSetup</key> <string>1</string></dict></plist> 

I am having an issue that I think is somehow related to Safari and our proxy. We have had several reports of users traveling off-network and having issues with captive portals. The Captive Network Assistant.app window appears but it's blank and says: "The webpage couldn't be loaded". If I open Chrome or Firefox, and go to https://captive.apple.com then the Captive Portal appears and I can do whatever I need to access the WiFi SSID. If open Safari, I am unable to get to https://captive.apple.com. Has anyone run across this issue? I'm assuming the Captive Network Assistant is using Safari to try to show the Captive Portal... 

The way JAMF displays my inventory requires me to scroll a lot to the right to find information on an asset. I would like to customize the order the columns are displayed. For example, Asset, serial number, building, and then room. Is it possible to change the order of the inventory display?

Hello all, I know there have been a couple of topics around this already but I can't seem to find a solid solution for this. We are a university and have both user assigned and public apple computers and laptops. I would like todo one of the following:1. Prevent users from login into their personal apple ID's and lock the devices to only use our ITS apple ID (make sure they can not log out of it).2. Simply block the ability to sign into any apple ID.3. Force sign out users already signed into their personal apple ID's. I have tried to set this up using a configuration profile under Restrictions > Preferences but this does not work (once the profile is applied the section is still visible). I also don't like the restrictions method as this includes many other options I don't want to use (in Applications, Widgets, Media, ect).We are using Jamf PRO and Apple School Manager. Thanks!

Does anyone have issues when using JRA with the users that have multiple displays?During a session it will swap between displays automatically, even thought I have auto switch monitor turned off.