Hi,  Has anyone has sucess with the new OS 27, Golden Gate and being to select the wifi on lock screen. It was mentioned as a new feature but it’s not working for me at this time and would be a great help in higher ed for our labs and using platform SSO for new users logging in.  Any feedback would be greatly appreciated.  Thanks!

TL;DR: Okta Platform SSO enrollment with Jamf works on an existing account, but the Identity First (Simplified Setup) PreStage flow fails with "Registration failed" before any credentials are entered. Looking for the full list of PreStage requirements, plus best practices for recovery when the Okta and local passwords diverge.ENVIRONMENT- Jamf Pro (cloud), macOS Tahoe 26.x, Apple silicon, ADE through ABM- Okta Verify 9.59.0 (enrollment package), Okta Platform SSO with password authentication- Fleet currently uses Jamf Connect Login/AuthChanger; my test Macs are excluded from both- Local admin account created by Jamf's managed local administrator (LAPS-style) settingGOALZero-touch onboarding: ship a Mac, the user signs in with Okta during setup, the local account is created and linked to Okta, and IT has a dependable recovery path if the user gets locked out.TARGET WORKFLOW1. New Mac is added to ABM, auto-assigned to Jamf, and lands in a dedicated PreStage.2. During Setup Assistant, the

enterprise JAmf pro with the URL https://flexera.jamfcloud.com/.  package deployment is failing on the JAMF client machine. due to download issue.email: smallikarjunappa@flexera.com,hm.sushma@gmail.comClient logs: Downloading https://flexera.jamfcloud.com/jcds/v2/downloads/csia.dmg... Error: Package was not successfully downloaded. 403 The network connection was interrupted while downloading the package from https://flexera.jamfcloud.com/jcds/v2/downloads/csia.dmg. Attempting to reconnect... Downloading https://flexera.jamfcloud.com/jcds/v2/downloads/csia.dmg... Error: Package was not successfully downloaded. 403 Error: csia.dmg is not available on the HTTP server. [STEP 3 of 5] Running script dmgAgent... Script exit code: 1 Script result: Error running script: return code was 1. [STEP 4 of 5] [STEP 5 of 5]

Hi there,i have a strange issue with my Apple Configurator 2, its up to date on a macOS 27 Mac, and when i try to prepare an iPad, for exemple, i have an error telling: provisional enrollement failed without anymore explanations.I’ve read this issue might be caused by ntework but i don’t have any problem to access to internet.Is there something elese i can do? 

I had a ‘latest version’ enforcement not apply recently so I want to source the community to see if anyone else has a similar setup or came to the same conclusion. This may end in a Feature Request, but I want to understand some logistics and maybe crowd-source a solution if possible. Let’s say I want to defer my updates for a set period of time across multiple release rings (Early Adopters, GA1, GA) but I also wanted to enforce updates as well. This would create ‘update windows’ for each ring. EA opens up after 7 days and is enforced after 10 days. GA1 is a week later and GA a week after that. Blueprints - technically - provides this and its quite simple to deploy. However… I’m learning that the enforcement mechanism relies on the Apple GDMF feed which… is typically only a single version in a given OS family. Right now, it looks like this: A command-line view curling gdmf.apple.com. For Tahoe, only 26.7.1 is listed as of 6 October 2026This means the Blueprint checks against this feed

Using Jamf Pro. We have an extension attribute for App-Packs for grade levels (K-2, 3-5, 6-8). Is there an easy way to change this in bulk? I typically use MUT, but v6 doesn’t have Ext. Att as an option and Classic wont be compatible with MacOS for much longer. I even tried using the MUT on Jamf Extender but that didn’t work. Any help is appreciated. 

Hello,We are wanting to deploy software updates to our iPhones and iPads outside of business hours. However many of these devices use cellular when not onsite. A big concern is going over our data limit and being charged for overages. Is there a way to restrict OS updates to only occur if a device is connected over wi-fi?

Hello everyone,Anybody able to advice witch way to go to get Singel Sign-On for our Apple fleet? Is it with only Single Sign-On extension in Jamf, Kerberos SSO extension via Apples site or any other?

We would like to request an enhancement to Jamf Self Service / Self Service+ for macOS to provide more dynamic application status and lifecycle management.The requested functionality is: Self Service should automatically detect whether an application is already installed on the Mac. Once the application is detected as installed, the Self Service item should automatically change its status from Install to Installed. For installed applications, Self Service should also provide a native Remove/Uninstall option without requiring administrators to create a separate uninstall policy, Smart Group, or custom script for each application. If the application is removed, Self Service should automatically detect the change and return the application to an Install state. Ideally, this status should update dynamically without depending on a full inventory update or jamf recon. The expected user experience would be:Application not installed:[ Install ]Application detected as installed:[ Instal

Hi everyone,I’m trying to set a default font in Microsoft Outlook (macOS) using Jamf Pro, and I’m running into some trouble.By default, Outlook uses Aptos, but I’d like to change it to Book Antique, which is already available on the device.What I’ve tried: I attempted to use the 3rd-party tool OutlookFontPoke by Paul Bowden @ Microsoft. Here’s what I did:• Deployed the OutlookFontPoke script and TemplateRegDB.reg via a package (both located in /private/tmp/OutlookFontPoke-master).• Created a policy in Jamf that:• Extracts the current logged-in user• Fixes permissions• Run the command as that user: sudo -u "$loggedInUser" /private/tmp/OutlookFontPoke-master/OutlookFontPoke 'Book Antique' '11.0pt' 'black' Issue: Despite several variations of the above, I keep getting this error in the script logs:WARNING: Registry DOES NOT exist at path /Library/Group Containers/UBF8T346G9.Office/MicrosoftRegistrationDB.reg. Attempting to create...mkdir: USER/Library/Group Containers: No such file or dir

Our infrastructure team is complaining about bandwidth congestion over the two 10 GBPS E-Lans.Has anyone moved from the 10 GBPS E-Lan to Dedicated Internet Access (DIA) or Cloud Connect to and experienced less congestion?

 Hi all,I'm testing macOS 27 Golden Gate (26A428) before fleet deployment and I'm trying to hide the VPN section from System Settings using the com.apple.systempreferences payload with the DisabledSystemSettings key.Bundle ID used: com.apple.NetworkExtensionSettingsUI.VpnSettingsIntents (confirmed via pluginkit -m -A -v | grep -i vpn)What I've tried:Deploying a native com.apple.systempreferences payload via Jamf Pro (uploaded as a full .mobileconfig) Running sudo defaults write /Library/Preferences/com.apple.systempreferences DisabledSystemSettings -array "com.apple.NetworkExtensionSettingsUI.VpnSettingsIntents" manuallyIn both cases the profile installs successfully and the key is present, but the VPN section remains visible in System Settings.This worked correctly on macOS 26 Tahoe. Has anyone found a working bundle ID or alternative approach for macOS 27?Thanks

Dear Community,i stumble upon the Topic:  I am currently facing the notorious "Peak Storage Overhead" / Storage Bottleneck issue while trying to update our fleet of 700 iPads (8th Generation, 32GB models). Even after a factory wipe, the Over-the-Air (OTA) update fails due to the system data footprint taking up too much space on these 32GB devices.I stumbled upon the topic where @cr4sh0ver mentioned a solution:"We changed our 'PreStage Enrollment' to require the latest OS before enrollment is processed. iPads go through normal enrollment process after the iPad has been updated..."Since we are running Jamf School (not Jamf Pro), I am struggling to find this exact setting. I know that we don't have "PreStage Enrollments" by that name, but rather Automated Device Enrollment Profiles (DEP) and Blueprints.Could anyone give me a quick, detailed step-by-step walkthrough for Jamf School on how to replicate this fix for a single test device?Where exactly in the Jamf School DEP profile (or elsewh

I am trying to configure Content Caching with MacOS 27, and they deprecated the Content Caching through Configuration Profiles. The main goal is to automate ICS with iOS devices.I have a Blueprint setup, and I have enabled “Auto enable tethered caching” and set it to True. This will set the key “AutoEnableTetheredCaching” to 1. However, I don’t see a way to set “AllowTetheredCaching” to a 1 as well.Limited output from “defaults read /Library/Preferences/com.apple.AssetCache.plist”:    Activated = 1;    AllowCacheDelete = 1;    AllowPersonalCaching = 0;    AllowSharedCaching = 1;    AllowTetheredCaching = 0;    AutoActivation = 1;    AutoEnableTetheredCaching = 1;    CacheLimit = 0; 

I have a problem where some users are unable to enroll new devices in Jamf School. I use enrollment via Entra. After entering their email address and password, it just spins for a while and then returns to the Entra window saying, “You can’t sign in right now. Please try again.”When I check the sign-in logs in Entra, they show “successful” several times, but no failed attempts. However, this does not affect all users—some are able to sign in and enroll devices, which is what confuses me.Has anyone run into the same issue?

Environment:- Fleet of iPads enrolled as Shared iPad via Apple Business Manager- Managed via Microsoft Intune- Federated authentication with Microsoft Entra IDIssue:The "Recent Users" pre-sign-in screen (the screen shown before any user signs in, displaying recent user avatars) never times out or goes to sleep on its own, regardless of the Auto-Lock setting configured on the device. This causes the display to stay on indefinitely whenever the device is sitting at this screen, which is a significant battery drain concern for a shared-device fleet.Steps to reproduce:1. Enroll an iPad as Shared iPad via Apple Business Manager / Intune2. Sign out of any active user session so the device returns to the "Recent Users" screen3. Leave the device untouched at this screen4. Observe: the screen never dims or locks on its ownTesting done:- Tested with Auto-Lock set to 2 minutes on one device and 5 minutes on a second device- Both devices exhibited identical behavior: the Recent Users screen stayed

Hi All.Does anyone know if it is possible to restrict access to the hidden photo album or even the ability to hide photos in the first place?I’m surprised there isn’t a restriction setting within Jamf to disable access to this.Cheers

8th gen ipads have only 32GB of storage, 11GB are used for OS and 3GB for system data, so, if you want to upgrade from iPadOS 18 to 26 the update requires 20GB of storage available in order to update making it almost impossible to update. The only options I see is to “restore” iPad with mac device or configurator, but just imagine doing this for hundreds of iPads, so the other option is to NOT update.If you have\had this same issue let me know if you have found better options for this update and did you, your business or school district decided to stay in iPadOS 18 or not.

I work for a school county and all our iPads have some apps in single app mode and they are not auto-locking and the battery is draining fast.

Hi Jamf Community,I’m looking for guidance on implementing Recovery Lock password rotation for existing Apple Silicon Macs already enrolled in Jamf Pro.Current SetupFor newly enrolled Macs, we have enabled Recovery Lock through PreStage Enrollment.This works as expected:Recovery Lock password is automatically generated. The password can be viewed from the device inventory in Jamf Pro. After the password is viewed, Jamf automatically rotates it after approximately 1 hour.Challenge with Existing MacsWe also have a number of Apple Silicon Macs that were enrolled before Recovery Lock was enabled in our PreStage configuration.For these existing Macs, I created a script that uses the Jamf Pro API with Client ID and Client Secret authentication.The script successfully:Authenticates to Jamf Pro. Retrieves the Mac’s Management ID. Generates a random Recovery Lock password. Sends the SET_RECOVERY_LOCK MDM command. Successfully enables/updates Recovery Lock on the Mac.This part is working as expe

Hi,I’m using a extension attribute for the latest macOS suppported on managed Mac in my Jamf Pro instance.The extension attribute i use is update for macOS Tahoe, but i haven’t found an update to support latest Mac and macOS 27.Could you help me?Thanks

We are a University with Apple School Manager and Federated Apple ID setup, devices managed by Jamf Pro. Recently we've seen an issue with new users signing in to our shared iPads. They sign in with the federated account details fine, are prompted to create a passcode as normal:Then, when logged into the iPad, when the screen locks then the prompt to enter their passcode to unlock it is not the same as the normal federated one, its a numerical keyboard only, so they have no way of entering the alphanumeric passcode they just created:I've found that resetting the users passcode within School Manager resolves the issue. But its not a workable solution to have to do this for an entire class during a teaching session. Has anyone else experienced this issue?

Does Jamf Pro 11.32.1 support Apple’s LiquidGlass Setup Assistant SkipKey in Mobile Device PreStage Enrollment/ADE? If not, when will LiquidGlass be included when “All” Setup Assistant Options are selected?

Cannot update devices from iOS 27 to 27.0.1. All iOS 27 devices are still shown under iOS Update 27, even though they have already been updated to version 27. Only iOS 26.x devices can be updated to 27.0.1. 

can an admin PM please? i need some help with my account!thanks!