Does anyone have any insight to when (or if) Jamf Security Cloud will be available on MacOS and Windows?I see the options as not yet supported, but wondering if there is a timeline on that.   

We’re about to sell roughly 600 of our old Macs, and I need to offboard them by removing the MDM profile before releasing them from ASM.Doing them one by one isn't practical, so I’m looking for the best way to handle this in bulk. I already have all the machines grouped into a Smart Group. I remember hearing that I need to completely strip this group out of the scope of all active Policies and Configuration Profiles first so nothing breaks or re-applies.I ran into some issues the last time I tried a mass offboarding a few years back, so I want to make sure I get it right this time. What is the safest, most seamless way to push the bulk "Unenroll" or profile removal command to a whole group at once?

We recently laid off 14 people and were going to gift them their M1 Laptops after they were off-boarded.  I issued Lock Computer commands from JAMF Pro to each machine and, to my surprise, found that only 3 of the 14 had actually locked out the user.   Luckily, these folks were all friends of the company (sad) and they did not do anything malicious, but I was able to use my TeamViewer link to the machine to go in and ‘removeFramework’ and re-enroll.   After that, I was able to wipe the machines normally.   Is there a way to get the rest of my machines back into compliance without removing the framework and re-enrolling them, one by one?  Will a ‘renewDeviceCert’ work?  Thanks. 

*Trying to get ahead of OS27 and the devices that can’t update*We have a requirement that all Apple mobile devices can support the latest OS update.  Based on early reports, we will have 100+ iPads that won’t support OS27.  I need to be able to block those devices completely.  We have departments that will attempt to keep them, but I need to make sure they can’t use them.Current setup is Jamf Pro for MDM and Entra for compliance.  We currently use Smart Device Groups and Entra Conditional Access to block Microsoft apps from devices that don’t meet criteria to be in our compliance smart group.  I wasn’t sure if there is a way to completely block in Entra Conditional Access or if there is a way to wipe and ban the device in Jamf Pro.  If not, is there a way to block all apps or put it into a kiosk mode if it isn’t eligible for OS27?Any suggestions will be greatly appreciated!

I am gradually learning how to work with blueprints. I have had success managing software updates with blueprints, so I decided to try out restricting external drives to read-only access. I want to stop controlling this using Proofpoint DLP (which I think is crapware) and start controlling it with blueprints.After configuring the blueprint, I deployed it to one of my Macs, then connected two USB drives. Neither drive appeared on my desktop. I opened Disk Utility and found both there. When I clicked to mount each of them, they would not mount. I saw no errors. They just won’t mount. As part of my testing, I uninstalled Proofpoint DLP, which is being used currently to make external drives mount as read-only. Before scoping the blueprint to my Mac, I confirmed that I could mount drives and write to them. I just recreated this on a second Mac. It’s the same issue. Proofpoint DLP is removed. The blueprint is installed. A PLIST was created at /private/var/db/ManagedConfigurationFiles/DiskMan

Hello,I'm trying to understand the recommended workflow for a school using both Microsoft Entra ID federation and Apple School Manager / Jamf School synchronization.Current setup:Apple School Manager is already federated with Microsoft Entra ID. All Managed Apple IDs have already been created successfully. We currently have only one ASM location (the original/default location). Jamf School is already connected to ASM and synchronized with that location. Our goal is simply to create and synchronize classes/rosters for Apple Classroom and Jamf School.The issue:If I manually create my classes in Apple School Manager and assign students and teachers to them, everything works correctly after the synchronization between Jamf School and ASM.However, how should this be handled when using a OneRoster/SFTP import into Apple School Manager?When I enable SFTP / OneRoster synchronization from Jamf School to Apple School Manager, ASM creates a new location instead of associating the imported classes

I’m currently rebuilding our enrollment process and testing everything in a Jamf sandbox. So far it mostly works as expected, but I’ve run into an issue that I can’t fully explain.This is how my flow looks right now.macOS 26.2In PreStage Enrollment I deploy: JamfConnectLogin-3.5.0.pkg dialog-2.5.6-4805.pkg (used for Setup Your Mac) icons.pkg (icons used by Setup Your Mac) When it comes to configuration profiles related to Jamf Connect, I’m using: Jamf Connect License Jamf Connect Login (login window configuration) Jamf Connect Menu Bar The flow itself:I start the Mac, choose Enroll, and no local account is created during enrollment. After configuration finishes, I get the Jamf Connect login window (which is exactly what I want and how it works in production). I log in with Okta credentials, the local account is created, and then the “enrollment completed” trigger fires Setup Your Mac. Apps and scripts install as expected.However, at the same time I get a keychain prompt saying:

We use Jamf Pro and have an integration with Conditional Access to register Macbooks within Microsoft Intune.We have recently started receiving this error message and have not been able to resolve it. Who can help me think about how we can tackle this issue?

In Jamf Pro, We have policies to install the 2024 Microsoft Office suite LTSC during our Provision policy which is a script that calls each policy to install individual pieces of software we want to install on a Mac.Here is the order for the Microsoft install we have 2 policies:1. Install 2024 Microsoft Office 16.106.26020821.pkg(This is the older version from February. Testing. I tried the lastest version too)2. Install Microsoft_Office_LTSC_2024_VL_Serializer.pkg(I have also tried swapping the order)Ever since I can remember this has worked exactly as intended. The Office suite is installed then the volume serializer is installed to activate the license. At first launch it opens to the templates/recent documents page.However, over the last couple weeks of testing, the activation is no longer applying. I’ve tried everything I can to try and deactivate the license/reactivate it, but the only fix appears to be completely removing all office components, and reinstalling them - only then

Hey,I am just wondering if anyone else got the same expierence?After installing the latest DisplayLink Update, it turned out that the previous working configuration Profile is broken. Every time I open the Tool from the Apple Menu, the Splash Screen comes up again.This is the Profile in User Level (I tried also Computer Level) which worked fine on the previous version:PLIST file containing key value pairs for settings in the specified domain<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict> <key>AppAutostart</key> <string>1</string> <key>SilentSetup</key> <string>1</string></dict></plist> 

Hey everyone, new jamf admin here who inherited a mess and is trying to clean it up. I was hoping someone knew how I would be able to find out why my Mac apps are not downloading/installing to any devices. We used the cloud DP to install these apps and for the most part they would install with no real issue but over the last 2 weeks all of them seem to be stuck on “In Progress” and nothing we do moves it along. Does anyone have any advice on how I can find where the bottleneck is or point me in the right direction? I believe it may have to do with an outdated version of jamf connect that the previous tech never updated but since I’m still pretty new I am not sure. We’ve already checked the APN as well as making sure we have enough licenses but for some reason no apps want to download or install on any of our managed macs. 

How to bulk lost mode a smart group of ipads in Jamf Pro?I have a smart group but lost mode is not one of the available remote commands?Suggestions?

I am currently looking for a Jamf / macOS Specialist or Apple MDM Engineer role and would love to hear about any openings within this community.I bring solid experience in:• Jamf Pro administration & device management• macOS / iOS MDM (Kandji/Iru, Mosyle)• Apple Business Manager• Bash scripting• Endpoint security & complianceOpen to full-time, contract, or remote opportunities worldwide.If you have any leads or openings, please feel free to reply or DM me. I appreciate any help!Thank you! 🙏

Hi, I’m looking how to automatically set TimeZone on Macs after the enrollement step.How can i do this?Thank you

Hello! We use Jamf School to manage our iPads. The last few months they have been dropping their wifi connection. They have been updated to the latest OS, have been erased and re-enrolled. I have looked through all the settings, and nothing has been changed. I am the only person who uses this system and I haven’t made any changes. Is anyone else having this issue?

Hello everyone,i wanted to roll out our new custom TeamViewer Host and everything works except that our custom design with the company logo is not displayed. I did it exactly as in the instructions: https://hcsonline.com/images/PDFs/Jamf_Teamviewer_Host.pdf After the custom logo didn't show up, I kept searching and came across these instructions: https://community.teamviewer.com/English/kb/articles/50739-mass-deployment-on-macos#perform-an-assignmentThe groups and the membership works but unfortunately our custom layout does not. Am I missing something or have I done something wrong?  

I uploaded our vpptoken for volume purchasing and Jamf p7m token from Apple School Manager to Jamf and now our fleet of iOS devices are stuck in pending. I realized too late that I downloaded the tokens from a different apple ID than in previous years and I suspect this is a big no no. I went back and renewed the tokens with the proper apple ID, uploading them to jamf, but I think the damage has been done. I wiped one device and reenrolled it and it took all the policies and is currently checking in fine after my mistake. I did use the right apple ID for our APN renewal and so all of our laptops are updating and checking in as normal. Long short of it - is there anyway to fix this other than manually reenrolling all our iOS devices. Thankfully, we have a small fleet and this isn’t the end of the world, but if there is a workaround I’d greatly appreciate knowing it. 

Hi, With my On Prem Jamf Pro Instance, i’ve made a policy to fix a particular wallpaper on all my classroom iMacs.it works well on mosts of my macs, but i’ve a brand new one, the policy run successfully, the wallpaper is in the folder /users/shared/Wallpaper/xxx.jpg but the wallpaper don’t change on any user accounts.Is there something new i miss?

Hi there,We have a Jamf-Pro on premise instance.i’m looking how to install our EDR, packaged, during the enrollement step, using same process to install SelfService.Is it possible to do this?Thanks

Happy Monday! So I just came across this issue.  When a user tries to change their password using Jamf Connect, they get this Kereberos error 4.So they go into Okta and change it there.  Later Jamf prompts them that the Local Password and Network password don’t match.  They are able to enter the old and new passwords and get the local mac password changed to match.  But Jamf still shows “password expires in 0 days”.I didn’t do the Jamf Connect setup, it was here when I joined the company, so I’m not sure exactly how to start fixing this.  I’m hoping you have some tips, maybe someone has seen this before, really anything.  I’ll keep doing my research, but It’s always nice to get some expert advice.-Pat

Our Device Inventory is no longer displaying Static Group Memberships. I can see the devices in the Static Group, just not in reverse on the Device Inventory. Anyone got similar problems? Kind Regards,Mathew

Edited 4SEPT2024: Updated information with the release of Jamf Pro 11.9 for PSSO and Device Compliance.  Also added link to Jamf Pro documentation. Jamf Learning Hub Instructions: https://learn.jamf.com/en-US/bundle/technical-articles/page/Platform_SSO_for_Microsoft_Entra_ID.html Current Public Preview Limitations What is Public Preview As of 15 JUL 2024, Microsoft Entra ID support for Platform Single Sign-On extension (PSSOe) is currently in Public Preview. As such, supported features and deployment information is subject to change without notice.  For more information, visit https://learn.microsoft.com/en-us/entra/fundamentals/licensing-preview-info.    Jamf Pro and Microsoft Entra Conditional Access Jamf Pro 11.9 and greater now includes logic to detects changes to PSSO registration.  When a new device ID is created in Entra ID as part of the registration, the gatherAADInfo command will report device compliance state to the new object.   For

Getting around to trying to figure out this issue. We’ve been using Jamf Safe Internet for many months and it’s been working just fine. The iPads have the Trust App, the profile from Jamf Safe Internet, and the restrictions and blocks are working. Jamf Safe Internet shows over 3,000 devices are syncing.My questions is why might my Jamf School device records not indicate it’s installed on our iPads when everything seems to be working? No devices records indicate it correctly. Just wondering if this is a bug or somehow my configuration has small issue causing the reporting to be off.  

We are building a Python application using the JAMF Pro REST API (OAuth2 client credentials) to send MDM restart commands to iPads. We are calling POST /api/v2/mdm/commands with a Bearer token and the following body: {"clientData": [{"managementId": "<device-management-uuid>"}], "commandData": {"commandType": "RESTART_DEVICE"}}. The API client has the following privileges assigned: Read Mobile Devices, Update Mobile Devices, Send Mobile Device Restart Device Command, Send MDM command information in Jamf Pro API, Send Blank Pushes to Mobile Devices, Update Mobile Device Inventory Collection, Update Sites, and Update Change Management. Despite all of these permissions being assigned, we are consistently receiving a 403 INVALID_PRIVILEGE: Forbidden response. The managementIdUUID is retrieved from the device detail endpoint /api/v2/mobile-devices/{id}/detail and confirmed correct. We have tried two separate API clients, both returning the same 403. Reading devices works perfectly wit

Hi all, we use Automated Device Enrollment with Apple Business Manager.Suddenly, device registration in Jamf stalls. After user login and MFA confirmation (Entra ID), a small notification window appears asking, “Do you want to allow downloads on ‘login.microsoftonline.com’?”No matter what we select here, the process then stalls at “Retrieving enrollment profile.”We have already checked ABM, Intune/Entra ID, and Jamf settings (token), and all syncs are running.Does anyone else have any idea what the cause might be here?