Hi,Pretty new to Jamf and Mac MDM but seem to have the handle on the majority of stuff. I’m having a single issue with the users enrolling the devices into PSSO during the simplified set-up. I am pretty certain it’s a Conditional access policy we have set within our tenant that blocks access to any cloud resources from Uncompliant devices. The guidelines suggest - “The User Registration app for Device Compliance created when you connected Jamf Pro to Intune must be added as an exclusion in any policy that may prevent users from registering their devices.”And from the logs I can see this is the exact application that is getting blocked on the policy.The problem, even if I add the exception for this application into this conditional access policy it will still get blocked.If I add the user to an Exception group, the device enrols perfectly fine. Not sure if anyone else has had a similar issue? 

After wiping and re-enrolling lab machines, approximately 23 out of 29 are showing the native macOS username/password login window instead of the Jamf Connect Login OAuth window. The remaining 6 machines show the correct College branded Jamf Connect login screen. What I've confirmed on the broken machines:JamfConnectLogin.bundle is present in /Library/Security/SecurityAgentPlugins/ Jamf Connect Login is fully registered in the authorization database (security authorizationdb read system.login.console shows all JamfConnectLogin entries) Jamf Connect Login v3.10 and Jamf Connect v3.10 configuration profiles are both installed A StagedPlugins folder appears in /Library/Security/SecurityAgentPlugins/ after every restart but is always empty No autologin configured A conflicting LAB: Login Window Settings profile (com.apple.loginwindow payload) was previously scoped to these machines and has since been removed but this did not resolve the issueHas anyone experienced Jamf Connect Login silent

So It seems Apple has removed some MDM control of macOS updates in macOS 27 and they are only allowing using DDM commands to do this.Wanting to know if the Defer Major macOS updates MDM profile setting will work in macOS 27 or is this gone too? (I would assume that deferring upgrading to 27 will still work since older versions of the OS still support MDM update control. This is more about the future) I see with Jamf 11.29 that the download & schedule install is now DDM and works on prem but what we are really looking for is a way to continue Defer Major macOS updates for 90 days. We are not in Jamf cloud and not really looking to move.

Currently the main Apple/JAMF SME at Qualtrics in Seattle. Been here for 4.5 years and looking for the next challenge! If you have any leads, please let me know either here or via LinkedIn: https://www.linkedin.com/in/alexhassit/

We are currently in the process of implementing Jamf Pro in our company environment. So far, we have successfully integrated several scripts, SMB shares, and other configurations, and everything was running smoothly.As the next step, we attempted to set up Jamf Connect in order to integrate a SAML authentication flow via our Entra environment. The goal was to allow users to log in with their Entra credentials during a fresh macOS installation.However, after configuring Jamf Connect, we started encountering a critical issue. The Microsoft 365 login window appears as expected, but after a few seconds, the entire Mac screen goes black and becomes completely unresponsive. The only way to recover from this state is by manually restarting the device.Additionally, since this issue started occurring, our previously working scripts and configurations are no longer functioning as expected.Has anyone experienced a similar issue or has any suggestions on how to troubleshoot or resolve this problem

Has anyone been getting unsuccessful GSX warranty lookups this week?  I have been getting them since yesterday.

Download the MATLAB DMG Installer:Visit MathWorks and log in with your MathWorks account.Download the MATLAB DMG installer for macOS.Mount the DMG and Run the Installer:Double-click the downloaded DMG file to mount it.Open the mounted DMG and run the InstallForMacOSX.app.Log In with Your Company Account:When prompted, log in using your company MathWorks account.Choose your license from the available options.Select Advanced Options:Before proceeding with the installation, click on "Advanced Options."Choose the option "I want to download without installing."Download the Installation Files:The installer will download the necessary installation files to a folder and then move to /private/tmp/MatlabR2024aCreate the Installer Input File:Navigate to the folder '/private/tmp/MatlabR2024a' and locate the installer_input.txt file. Edit this file to include the following parameters:destinationFolder=/ApplicationsagreeToLicense=yesoutputFile=/tmp/mathworks_install.logenableLNU=yesIf depl

An upcoming recruitment and networking event is taking place for the Enterprise IT Professional for Apple Technology program.Date: Thursday, September 10, 2026 Details: The event brings together representatives from Apple, Jamf, local industry partners, faculty, and students. Attendance: All members of the Phoenix Apple Admin group are welcome to attend!

So we have Apple TVs that are set up with a config profile to automatically go into Conference Room mode, which locks out the ability to use an Apple TV remote. Somehow, some of the Apple TVs got unenrolled from Jamf but are still stuck in Conference Room mode. There’s no way to get into Settings to reset them because the remote doesn’t work.I’ve tried the old method of resetting them by rebooting them 4-5 times until the Recovery menu comes up. That used to work, however, at some point they stopped going to that menu, and now only give the option to connect an iPhone or iPad to reset them. No problem, I thought, I can use my iPad. The problem is that now the ONLY option it gives is to upgrade the OS, and when choosing that option, it doesn’t actually go through the Apple TV setup again…. meaning it doesn’t re-enroll in Jamf. The Apple TV downloads and applies the OS upgrade… then puts me right back into Conferenced Room Mode, locked with no ability to use a remote.Is there anything I

Dear Team,Anyone can address which domains or settings need to bypass in DNS settings to login cloudflare warp client successfully? My Jamf Web Protection only enable Internet Content Filtering, therefore MAC OS machine no need Jamf Trust, it only needs profile configuration , UEM connect settings in place.I have the issue that  When the DNS settings disable I am able to login CloudFlare WARP client If the the DNS settings enable, i can not login the CloudFlare WARP client with the error message "CF_DNS_LOOKUP_FAILURE." and here is the solution Verify that the network the user is on has DNS connectivity.Verify that DNS resolution works when WARP is disabled.Ensure that no third-party tools are interfering with WARP for control of DNS.Ensure that no third-party tools are performing TLS decryption 5 on traffic to the WARP IP addresses 4.I already tried to bypass these domains without help in configuration proflie<string>*.cloudflareclien

Hi,i ran into a deadend, where i need your help =) We are currently trying to setup the content cache with parent-child config.A simple ping and netcat are succeeding.I have declared the settings as followed for example:parent: 172.10.10.1child: 20.20.20.1 While reloadSettings it is showing my parent as reloaded. But with “AssetCacheManagerUtil status”i get the output:Parent: (none)i actually cannot get it running.  

Some users in my organization experience high CPU usage by Jamf Protect after updates to new macOS Tahoe 26.6.2.Does anybody experience the same? Is it a know issue?

Hey folks! Just wanted to drop by with another bit of info that may be helpful when using the new Self Service+ application on your managed computers.  The app leverages macOS unified logging, so to grab logs you'll want to parse the log stream to get app activity.  One way to grab these files programmatically (as of version 1.2.0 of the app) is to use the Collect Troubleshooting Info option in the Help menu (or use the hotkeys ⇧ ⌘ L /Shift + Command + L) and the app will generate a zip file and save it wherever you specify.   For folks familiar with parsing the unified log on macOS, you can use Terminal to filter the log and look for Self Service+ events. To see events from the last hour would look something like this: log show --info --predicate 'subsystem BEGINSWITH "com.jamf.selfserviceplus"' --last 1h --style compact To stream activity from the app as it's running in real time you'd want to use an elevated log stream command, something like this: sudo lo

I often have different research groups that need to have admin access on their computers due to the type of work and research they are doing, but currently I don’t have a method to give them this access in the way they would like. Additionally, these research computers are shared between the primary researcher that can have admin access, and additional researches that cannot be given admin access.I use Jamf Connect with Entra SSO. Pre-stage enrollment creates all new users as standard users. When we use a command or trigger to elevate someone to Admin, this reverts to standard at their next login. Using Self-Service+, users can select temp admin access when they need it, but applying this to device means all users on the device have access, even those that shouldn’t, and applying it to a user makes it available to that user on any device, not just the device they need it on.I don’t know if there’s any other setting, configuration, or options I could use that would make this function t

Hello  Just wanted to understand how you’re using JSM for UIE. I noticed there’s a slight delay when triggering the Enrollment Complete policy for JSM. Self Service launches before the JSM policy is triggered/completed. Is this expected behavior, or is there a way to ensure the JSM policy runs first before Self Service launches?

In macOS Tahoe, the command to get the current AirPort network is not working as expected, and the SSID value is showing as <redacted>.Could you please suggest any alternative script or method to retrieve the currently connected Wi-Fi SSID name?This is required to help us deploy the Network Configuration Profile only when the Mac is connected to an out-of-office network.Thank you.

Hi All,Has anyone seen Jamf Self Service fail to run an otherwise-valid policy? Been looking at this for a whileWe use Alectrona Patch to install 99% of our Self Service apps with the below script. Whenever i run one of these policies through JSS i get an “Item Failed.” notification.  The symlink sudo patch install <id> works perfectly when run manually as root, so i think this is a Jamf error rather than a patch error, though i am speaking to them about it.#!/bin/zsh# Variablespatch="/Library/Application Support/Alectrona/Patch/patch"appName=$4# Check script parameter valuesif [[ -z "$4" ]]; then    echo "Missing Application parameter"    exit 1fi# Install App${patch} install ${appName} --silentif [[ $? == 0 ]]; then    echo "$appName installed successfully"    exitelse    echo "Install failed - error $?"    exit 1fiThe Jamf policy itself looks completely normal: enabled, no exclusions, no site restriction, ongoing frequency,  Running jamf policy -id X -verbose from terminal thr

Happy Monday, y'all! We're adding an Austin Mac Admins social to the calendar for 8/18 @ 2:30-5 at the WeWork Domain. Come and join us for drinks, pizza, and connection with your fellow Mac Admins. Feel free to come and go as needed. Event page linked here with more info - https://luma.com/kzhtzojcI believe a good number of folx will already be in the area for the Infrastructure as Code and GitOps event hosted by the incredible @derrad and @stevewood_tx and we'll be hosting both events in the same space, so please feel free to stay and enjoy a treat before you commute.

We have been testing 27 beta with every version and I'm not sure why so late in the beta cycle during beta 5 apple decided to add new pop ups. Currently I do not see a way to manage these.  

Hi, I want to ask something about this issue. I’ll describe the test I’m performing.I have a macBook Pro enrolled with in Jamf Pro with Jamf connect. Authentication is done through MS Entra/Azure.The first user, user A, that logins gets a prompt to enable Filevault. User A is now a filevault enabled user.When restarting user A has to unlock the disk as expected.User A is logging out and user B logs in. Now this user is also able to unlock the filevault encrypted disk.User B is logging out and user A logs in again. User A shuts downs the macBook.And now comes the issue I’m facing. When restarting the macBook user B needs to unlock the disk. The name of user B is pre-filled and you have to enter B’s password. When pressing ‘option + enter’ you can choose for another user.So I thought, maybe because user B is the last user that was enabled for Filevault this user shows up. Still strange but let’s give it a try with user C. So after user A or B logs in and logs out again I log in with user

Running RSA MFA Agent on macOS Tahoe in a Jamf-managed fleet. At the screensaver unlock, a legacy `SFAuthenticationController` "macOS wants to make changes" dialog appears before RSA's own OTP prompt. RSA has pointed us at Apple and Jamf, with no clear next step yet.While isolating it, one test stood out. Writing a stock right to `system.login.screensaver`:```sudo security authorizationdb write system.login.screensaver authenticate-session-owner-or-admin```gives the modern unlock UI (wallpaper + password) on a managed Mac, but the legacy black-screen unlock prompt on an unmanaged one — same right, same OS, only variable is management. So the legacy unlock path still exists in Tahoe; something on the managed side is suppressing it.Anyone seen this, or know what MDM-side setting (profile, restriction, DDM) would cause it? Trying to work out whether this is an Apple thing or a Jamf thing before going back to either vendor.

It would be a useful feature in ‘Classes’ if, when adding members by specifying a group, that user group were synchronised.Currently, if you add teachers and enter a complete group at the top of the selection window (‘Member of group’), only the current status of that user group is recorded. Annoyingly, it is not updated or synchronised when new teachers are added.

Happy Monday! So I just came across this issue.  When a user tries to change their password using Jamf Connect, they get this Kereberos error 4.So they go into Okta and change it there.  Later Jamf prompts them that the Local Password and Network password don’t match.  They are able to enter the old and new passwords and get the local mac password changed to match.  But Jamf still shows “password expires in 0 days”.I didn’t do the Jamf Connect setup, it was here when I joined the company, so I’m not sure exactly how to start fixing this.  I’m hoping you have some tips, maybe someone has seen this before, really anything.  I’ll keep doing my research, but It’s always nice to get some expert advice.-Pat

JNUC Attendees volunteer to pack STEAM kits that will be donated to students of Kansas City Elementary Public Schools.  Give back and connect for a great purpose! When: Tuesday, September 22  (Day before JNUC Keynote), 7am-7pmWhere:  Near Registration in Kansas City Convention Center301 W 13th St. Kansas City, Missouri 64105How: Assembly line style, “packing with a purpose” provided by the Happy Hope Foundation. About the school: This school was identified with a community impact profile outreach and is part of the local, Kansas City Public School District.  The Elementary school has 100% students with free and reduced lunch.