After the October 13, 2026 cumulative update, our on-prem NDES started rejecting SCEP requests from Jamf Pro SCEP Proxy (Jamf Cloud). Each failure logs:Application log, source NetworkDeviceEnrollmentService, Event ID 60 (EVENT_MSCEP_REJECTED_SID_IN_SAN_URI): “…rejected a certificate request because the Subject Alternative Name (SAN) extension contained a URI entry with a security identifier (SID). SID values must not be present in SCEP request SAN entries when no custom policy module is registered to validate them.”Our profiles follow Jamf’s strong-mapping guidance: a URI SAN of tag:microsoft.com,2022-09-14:sid:$EXTENSIONATTRIBUTE_#, with the EA pulling objectSid. That’s exactly what NDES now refuses.Environment: Windows Server 2019 NDES, AD CS, NPS for EAP-TLS Wi-Fi Trigger: KB5126651 (the Server 2019 October update). Uninstalling it restored enrollment immediately. Impact: existing certs keep working, but new enrollments and renewals fail.Microsoft appears to accept a SID in a SCEP r

Recently (October 2026) Apple made some changes to their app purchasing UI and license management, has anyone else seem issues in their JAMF Pro instance with iPad error messages like “No license was found for app “com.clever.InstantLogin” ?My team and I have been trying to figure out what was causing this errors for a week now. JAMF suggested to renew our ASM token, which did not solve the issue. Apple’s changes seem to be relate to the app license numbers and if they are free or paid. If the app is free, it will show a huge available license number in JAMF, like "2,156,452,236" which somehow seems to cause the license issue I'm getting in my Jamf instance. The only solution I have right now is for the user to install apps multiple times before one attempt miraculously and randomly succeeds. JAMF support has our server and VPP logs, the issue has been escalated to a higher engineering team but have had no answer as of today.Have any of you seen this issue recently or had success in fi

We’re deploying MyViewBoard (free, Mac App Store) to Apple Silicon Macs via Jamf’s VPP “Mac Apps” distribution. The install reports success and a license is consumed, but the app won’t launch — [I get either no feedback when I open the app or I get a message telling me the app cannot be opened]. If a user instead opens the App Store themselves and clicks “Get,” it installs and works fine every time.The app is a Designed for iPad app but can work on Apple Silicon.Has anyone run into this with MyViewBoard, or with other App Store apps that are iPadOS binaries running on Apple Silicon Mac? Curious if there’s a known fix or workaround for getting this working with JAMF Self Service since our users don’t have Apple IDs with their macs unless they use their personal one.

When I try to delete an empty, no longer needed static group, I get the message: “The following items are dependent on this Static Mobile Device Group and need to be updated:...”Then there is a list of profiles, policies, and apps the group is scoped to.There are NO devices in this group, so why can’t I just delete it?  It appears that I will have to go to each item listed and manually remove the defunct group from its scope.  The group I am currently looking at has 12 items its scoped to.  12 items to click in to and remove the group from scope, BEFORE I can delete the group.  Others have 20+ item which will be very time consuming if this is what I have to do to get rid of EMPTY unwanted groups and clean up my Pro instance. Thoughts?  Am I missing something? Thanks!

I work for a school county and all our iPads have some apps in single app mode and they are not auto-locking and the battery is draining fast.

I’ve got a simple solution with dockutil.Package installs automatically after enrollment or recurring check-in Installs Password Manager.app in /Applications and to files in /usr/local/bin   Script for dockutil runs after the installation.dockutil --add "/Applications/Password Manager.app"All gets installed but the application is not put in the Dock. The details says: Script exit code: 64 Script result: Error: /var/root/Library/Preferences/com.apple.dock.plist does not seem to be a home directory or a dock plist Usage: dockutil [<options>] [<plist-location-specifications> ...] See 'dockutil --help' for more information.  Does anyone know what’s wrong? The Mac I’m tesing on runs macOS 27.0.1 and our version of Jamf Pro Cloud is 11.33.1.

We’re currently testing Jamf Setup Manager with Simplified Platform SSO.When Jamf Setup Manager is triggered and reaches the Preparing stage, the Mac restarts. After the restart, instead of continuing the expected setup/enrollment experience, the device comes back to the macOS login screen where only the local administrator account is available to log in.Has anyone experienced similar behavior when using Jamf Setup Manager with Simplified Platform SSO? If we remove Jamf Setup Manager from the enrollment workflow, the Simplified Platform SSO setup completes successfully.So the issue only seems to occur when Jamf Setup Manager and Simplified PSSO are both part of the enrollment process.Has anyone encountered this behavior? Are there any known configuration considerations or timing conflicts between Setup Manager and Simplified PSSO that could cause the Mac to restart and return to the local admin login screen?

Management request is we should send notification for laptop restart with 3 rmeinder post that system should restart automatically if it possible to do through JAMF Pro

Does anyone know if you can or there are plans to be able to make folders for Blueprints. A coworker and I were working on some and were talking about how it would be nice to be able to sort them. 

Who’s going to this in person meeting in Mexico City?I won’t be there, but it’s going to be something you wont want to miss! Register here:https://luma.com/mxtw-185040fe?utm_medium=referral&utm_source=mxtw And if you go and have a great time, take some photos and post about it on LinkedIn so more awesome in-person events like this can happen in the future!    

Hi,We have to renew any iPads fleet from our parc.Is there a way to massively remove devices, as iPads from Jamf?Also the same question in AppleSchool Manager? Thanks for your tips.Best Regards.

TL;DR: Okta Platform SSO enrollment with Jamf works on an existing account, but the Identity First (Simplified Setup) PreStage flow fails with "Registration failed" before any credentials are entered. Looking for the full list of PreStage requirements, plus best practices for recovery when the Okta and local passwords diverge.ENVIRONMENT- Jamf Pro (cloud), macOS Tahoe 26.x, Apple silicon, ADE through ABM- Okta Verify 9.59.0 (enrollment package), Okta Platform SSO with password authentication- Fleet currently uses Jamf Connect Login/AuthChanger; my test Macs are excluded from both- Local admin account created by Jamf's managed local administrator (LAPS-style) settingGOALZero-touch onboarding: ship a Mac, the user signs in with Okta during setup, the local account is created and linked to Okta, and IT has a dependable recovery path if the user gets locked out.TARGET WORKFLOW1. New Mac is added to ABM, auto-assigned to Jamf, and lands in a dedicated PreStage.2. During Setup Assistant, the

As a QWERTY user one thing that has been bothering for a long time when deploying a Mac via ADE is the following: On a macOS device with a QWERTY keyboard I start the macOS Setup Assistant:I choose ‘Nederlands’ as the language   I choose ‘België’ as the country Ok, keyboard layout seems fine… Fast forwarding to the Jamf Connect Login window:WTF? Belgian keyboard layout again? Ok, I change it to ‘Nederlands’ again. Sure this will be fine now.After authenticating… Aaarrgh, again on Belgian keyboard layout 😠 Did you guys came across this issue? And how do you handle this?

I have Self Service (Classic) and Self Service + on a macOS 27.0.1 Created a new Blueprint and added Self Service+ information into it.The settings I’m managing are not being applied to the endpoints.Removed few sections, rearranged items on the left.I even changed scope to only two devies and made it simple to track (static group) deployment status.Ideas? 

Issue - Adobe Reader, when installed using the default “vanilla” method e.g., via Adobe’s public download, exposes users to In-app advertisements and upgrade prompts promoting Adobe Acrobat Pro features setting the expectation that all users are entitled to Acrobat Pro licenses. I created a plist file, but it isn’t working. Can anyone help me sort this out? I’d really appreciate it. Thanks in advance!

HI I am trying to connect domain and its hard to connect with JAMF .I have checked all DNS Servers but its not working . Server authentication we were getting . I need solution for this , please can anyone help on that.Thank you .Asha

With recent macOS updates introducing Declarative Device Management (DDM) controls for Migration Assistant (migration-assistant.settings)—allowing IT admins to restrict or allow selective file and folder migrations—I wanted to check how others are currently handling this payload.Jamf prides itself on Day 1 support for Apple features, but currently, Jamf Pro does not have a native blueprint component or UI option in the Blueprint Builder to deploy and manage migration-assistant.settings.While other MDM vendors have already integrated DDM support for Migration Assistant settings into their platforms, it appears Jamf relies on future roadmap cycles to surface these Apple DDM specifications.A few questions for the community:Is anyone successfully deploying migration-assistant.settings via custom DDM declarations/blueprints or custom profile workarounds in Jamf Pro today? Has anyone received updates from their Jamf Account Team on when this DDM payload might be officially added to the UI/Bl

looking to the community for recommendations on keeping tabs on Apple updates.My org is strict about keeping things up to the latest version within 30 days.What sites/ RSS feeds, etc do you use to track upcoming updates?

 On some of our managed Macs, users notice a screensaver password prompt that runs indefinitely with an  old interface —even after entering the correct password, the dialog reappears immediately. This doesn’t happen on all Macs, only on a subset of our fleet. Investigation:an affected Mac using:security authorizationdb read system.login.screensavervalue: authenticate-session-ownermy question : Can the authorization database change the Mac unlock interface?

enterprise JAmf pro with the URL https://flexera.jamfcloud.com/.  package deployment is failing on the JAMF client machine. due to download issue.email: smallikarjunappa@flexera.com,hm.sushma@gmail.comClient logs: Downloading https://flexera.jamfcloud.com/jcds/v2/downloads/csia.dmg... Error: Package was not successfully downloaded. 403 The network connection was interrupted while downloading the package from https://flexera.jamfcloud.com/jcds/v2/downloads/csia.dmg. Attempting to reconnect... Downloading https://flexera.jamfcloud.com/jcds/v2/downloads/csia.dmg... Error: Package was not successfully downloaded. 403 Error: csia.dmg is not available on the HTTP server. [STEP 3 of 5] Running script dmgAgent... Script exit code: 1 Script result: Error running script: return code was 1. [STEP 4 of 5] [STEP 5 of 5]

Hey everyone!I’m looking to bring JNUG (Jamf Nation User Group) Chicago(land) back to life, and I want to see who’s interested in being part of it!Whether you’re a Jamf admin, macOS admin, Apple IT professional, or just someone who enjoys figuring out better ways to manage and support Apple devices, this group is for you.The idea is simple: get local admins together to share ideas, learn from each other, talk through challenges, and build a stronger community. We can discuss Jamf, macOS, Apple management, automation, security, scripting, new technologies, lessons learned, and whatever else is relevant to our day-to-day work.You don’t need to be an expert or have a presentation ready. Sometimes the best conversations come from sharing a problem you solved, a new tool you discovered, or a question you’ve been trying to figure out. Who wants to be part of something great?I’m gauging interest for our next meetup, with November 13 as a tentative date. The location and time are still being w

Hey everyone,I've been working on a side project for a while and figured I'd share it here in case it helps someone else.At work I kept getting techs asking how to change the same stuff on iPads: groups, asset tags, assigned user, clear passcode, lost mode, wipe, etc. In Jamf that's all spread out over a bunch of different tabs and screens, and it can get overwhelming for some techs, especially the newer ones. So I built a simple web app that puts it all on one page.What techs can do from it:Search an iPad and see the important info in one place Change department, building/room, assigned user and asset tag Add or remove the iPad from static groups (you can limit which groups they see, like only ones that start with "Tech-") Restart, update inventory, clear passcode Enable/disable Lost Mode Wipe the device, either a full wipe or Wipe with Return to Service. They have to retype the serial to confirm, so nobody wipes the wrong one by accidentHow it works:Techs sign in with their own Jamf

Hello,I have deployed a package through Jamf and made it available in Self Service. However, the installation fails for users running macOS Monterey 12.The logs show the following error :Verifying DMG...Verifying package integrity...Installation failed. The package could not be verified.The package installs successfully on other macOS versions, but fails specifically on macOS Monterey 12. I have already tried re-uploading the package to Jamf, but the issue still occurs.Could you please advise on what might be causing this issue and how we can resolve it ?Thank you.

参加登録はこちらから！https://luma.com/eq24ilqtMac Admins Japan #1Appleと仕事、いままでとこれから ​Mac Admins Foundation (US) の公式日本コミュニティ（一般社団法人 Mac Admins Japan）です。​職場や学校に Apple 製品がある方、これから導入を考えている方、Apple が好きで社内に広めたい方 —— 職場の立場や経験年数を問わず、Apple製品に関わるすべての方を歓迎します。 ​📅 開催概要 ​🕑 タイムテーブル ​18:30 受付開始 ​19:00 開会 ​19:10 Mac Admins Japan の紹介（Mac Admins Japan メンバー） ​19:20 LT枠① Sansan株式会社 坂本さん ​19:50 LT枠② t.b.a. ​20:20 懇親会（ハッピーアワー） ​21:00 閉会 ​※内容は変更となる場合があります。登壇者が確定次第、本ページを更新いたします。​​📍 会場・アクセス​　会場名：Sansan株式会社本社​　住所：〒150-6228 東京都渋谷区桜丘町1-1 渋谷サクラステージ 28F​　アクセス​　最寄駅：渋谷駅​　（各渋谷駅より5分～15分ほどかかります。お時間に余裕を持ってお越しください）​　・JRをご利用の場合：渋谷駅 新南改札をご利用ください　・東横線／田園都市線／半蔵門線／副都心線をご利用の場合：渋谷駅 渋谷ヒカリエ1改札または渋谷ヒカリエ2改札をご利用ください　・銀座線をご利用の場合：渋谷駅 スクランブルスクエア方面改札をご利用ください　・井の頭線をご利用の場合：渋谷駅 中央改札をご利用ください​　▼渋谷駅各線からのサクラステージまでのアクセス方法 https://jp.corp-sansan.com/assets/pdf/accessandreception.pdf​💭 Mac Admins Slack への参加について​本イベントにご参加いただく方は、Mac Admins のグローバル Slack ワークスペース（および #macadmins-japan 日本語チャンネル）へのご参加をお願いします。イベント後の日常的な情報交換や、当日集まった仲間との繋がりは、Slack 中心となります

I wanted to provide feedback and a suggestion for something which could be improved, but I can't find any way to do it. The built-in AI tells me to come here and go to a section that doesn't seem to exist, which is extremely helpful. LOLAnyone know?For the record it is to allow reordering of smart group criteria as currently if you want to make a change such as adding a new OR rule at the top of the smart group you have to delete everything below it first - so suggestion is to allow drag to reorder which seems so stupidly simple I am amazed they have never done it!