As the title says, I just got access to blueprints and eager to start learning this, but right away i notice im missing things.  Jamf chat box told me thisYou'll need the Cloud Services Connection (Read) privilege in addition to your existing Blueprint permissions. This privilege is required for app installation functionality within Blueprints. To resolve this, you can: • Contact your Jamf Pro administrator to add the Cloud Services Connection (Read) privilege to your user account • If you have a custom privilege set, ensure it includes both Blueprint permissions and Cloud Services Connection access Once these privileges are added, you should be able to access app installation features alongside the declarative configurations you're currently seeing.Now after checking everything and confirming with Chatgpt,  I am being told App installations in Blueprints are not Enabled at the Tenant Level.  Something about being a Backend feature flag.   i am unsure how to proceed with this. Any help

Hello Everyone, Not sure if anyone here could help. But over the last year we have been seeing a lot of devices that just stop syncing. I have been trying to find a solution and have had many tickets open with jamf. I can have the device on wifi, unlocked and just stilling at the home screen and it still times out when i resync the device. It seems most times that clearing the Activity log will allow it to resync for a time. I can’t seem to figure out what is causing this and its making us look at other MDMs because of this a few other issues. 

I’m trying to figure out how to configure the passcode to be 6 digits instead of 8 characters, including uppercase and lowercase letters and numbers. 

We have the policies to install the following Office 2024 components in order during our prestage deployment:2024 Volume SerializerMicrosoft Excel 2024Microsoft PowerPoint 2024Microsoft Word 2024For the past couple of years, this has worked exactly as intended. The volume serializer is installed to activate the license, then the individual apps are installed one by one. After deployment these have also opened and been activated. However, over the last week or so, the activation is no longer applying. I’ve tried everything I can to try and deactivate the license/reactivate it from self service etc, but the only fix appears to be completely removing all office components, and reinstalling them - only then does the volume serializer work. I thought this might be as a result of the latest Office apps, so I reverted to using older versions of the pkg files but the problem remains. I even tried using the whole Office suite pkg but the same thing is happening. Anyone else seen this before?  

I need to use the JAMF School API to retrieve a list of devices. When I call the /api/devices/ API in PowerShell, it returns *all* the devices as part of the JSON response - which could run into many thousands. That’s a response size of tens of MBs, probably larger.This could cause problems with the code and the memory of server on which the script is running. I don’t see a way to paginate the response. Neither the documentation nor the Postman project have any information about paging the response to keep the response to a reasonable size.Am I missing something in the documentation that could allow me to paginate the response? Or is there another API that I can use to retrieve devices in smaller sets?

Hey Everyone!  We have scheduled our February virtual meet up for February 24th at 7PM.  Our very own Scott Kendall is going to be presenting on the DDM-OS updates app and his take on it.  We also will be discussing the new in person meetup tentatively planned for April.  Link for the invite is here https://www.icloud.com/invites/06dNX9sTcNhZda4-KkqPTkuqw

Is there a way to disable iPad access during certain hours of the day?!--a=1-->

Anyone want to share best practice for this? Blueutil doesn’t work as great/possibly at all in our environment after updating to macos 26.As a workaround I’ve been using the api to send the MDM command in a policy/script to those macs that turn it off. We have an outset login script that manages to lock out bluetooth changing in the control center and system settings, but there’s a short window of 5 seconds or so where students can turn it off before it is locked. 

Hello all,     Does anyone know how to build a Static Computer Group from a list of computers? It doesn’t matter what the list format is.  That should be simple enough to reformat.   Any help or ideas are appreciated.-Pat

A workflow improvement to Import would be to have a default assumption that if the Asset Tag is already defined and is blank in the device CSV that the system maintains the same asset tag.Currently if you fail to enter the asset tag on a subsequent import, the data is wiped. If you are rapidly setting up classes, you may not have the asset tag information - you have the serial number and the student details. Finding it again from previous data and then adding it to a device placeholder adds unnecessary time to the process. In the cases I’m working through, the system already knows the asset tag, and it hasn’t changed - and it won’t change for the life of the device.If the asset tag should be reset, allow a character like dash - to signify please reset / delete the asset tag. 

I received this feedback from one of our teachers testing out Jamf Teacher- When I take control and lock them in an app, it literally clears their ipads from all other apps. Which is great! Except when I clear the locks on my end, all of their apps end up in different locations on their device. So I had a few angry students that spend hours organizing and categorizing folders and apps then suddenly I come along and clear things and then their apps are all messed up and scattered. That isn't a nice feature of this app for sure. I get it. I love having my iPad organized by apps I use and in folders. It's a shame that this developer didn't think of that aspect of things when designing the app. Just a little feedback for you. Are others experiencing this?

I am a Jamf Pro customer and think Jamf Teacher has great potential! However, our teachers are struggling to fully integrate it because of some missing key features. 1.) We are not enforcing the home screen layout payload so students can customize their iPads and organize their apps in a manner that works best for them. After restrictions are cleared, their apps lose their organizational structure and end up anywhere on their iPads. Apps that were in folders don't stay in those folders. 2.) Lack of status window/confirmation pop-up to see when you have a lesson in progress or have issued a command to student iPads. Teachers would like more visibility/confirmation as they issue commands and place restrictions.

https://www.thenewit.com/account-managerWe are seeking a dynamic and experienced Account Manager to join our team. The ideal candidate will have a strong background in client relationship management and a passion for technology and security, specifically in the Apple ecosystem. The Account Manager will play a crucial role in maintaining and expanding our client base, ensuring customer satisfaction, and driving business growth. Client Relationship Management Serve as a primary point of contact for existing customers. Build and nurture strong relationships, understanding customer needs and technical inquiries. Maximize the value of The New IT’s solutions, focused on how to best meet management, device functionality, and security needs. Apple Consulting Services Develop a strong understanding of The New IT’s unique services relationship with Apple. Collaborate with Apple Business teams and the broader partner community to grow customer consulting and service engagem

Since November 2025 you can find the warranty information for your Mac devices in Apple Business Manager. You can call this information using API calls. Is there any information if Jamf is going to make an Jamf integration? This warranty information would be a cool feature to have in Jamf. As an MSP it would be great for Life Cycle Management for our customers.I’ve seen no information from Jamf jet.Sofar I've been working on local scripting in python to get the ABM warranty information in Jamf as an Extension Attribute. For Computers I've succeeded I'm however not successful yet for mobile devices. The Jamf Classic and Pro API’s won’t let me update Extension Attributes for mobile. So I'm stuc.Anybody there who would like to help? Or can somebody tell me how to update an extension attribute for mobile, if it is possible and not blocked in api.Kind Regard Remco.  

We currently have the “Erase All Content and Settings” option blocked on our student iPads. However, we would also like to block the “Transfer or Reset” option, or at least the “Reset All Settings” option, on those devices.Is this something that can be configured?  Thank you

We manage our ipads using Jamf Pro. We load the students google email accounts onto the device using a Jamf configuration profile with the Google payload.  The mail account will appear on the device (ipad iOS mail app) and prompt user to enter google password.  The user enters the password and the iOS mail app will display the students google email.  However,  several times through out each day, the iOS mail app will stop displaying google email and prompt user to re-enter their google password.   After re-entering the google credentials, the Mail app will not always start working again.    I have had Jamf support review our config file with the google payload - they said it is set up correctly.  I have contacted Google and they said that it is a Jamf issue.  Has anyone else experienced this issue?  How did you resolve it? thanks.

Howdy everybody! Time for my annual post about how we all need to get our budgets prepped and ready to go for all the hardware we need to replace that Apple is dropping from its OS Compatibility list!I've modified my previous regex statement to take out the models that were lost to us this year to the latest macOS version. It looks like Apple is taking a big ole axe to the intel macs, minus only a couple of exceptions that seem to tie to the devices that were still being sold at the time of the M1 release. One tricky piece are the specific intel MacBook Pro's that Apple has listed. In that grouping are the MacBookPro16,x models, where x is 1,2 and 4, but not the 16,3 model, so keep that in mind. If anyone has details that contradict that, please let me know here and i'll quickly change the posted regex.I've tested this in my own Jamf instances to verify its returning the data that i'd expect to see, and am confident this will be able to match everything that is no longer supported by M

Issue: Mobile Devices on iOS and iPadOS 26 or later Booting are occasionally booting into Recovery Mode. Standard expected workflow: We have Microsoft Entra ID SSO extension configured with the Jamf Setup and Jamf Reset apps. When a user signs out using Jamf Reset three different configuration profiles are removed:Profile with a Passcode payload Profile with a Restrictions payload Profile with a Lock Screen Message payload When the above profiles are removed, two profiles are installed:Profile with a Restrictions payload Profile with a Lock Screen Message payload The issue appears to occur during Jamf Reset sign out as one configuration profile is removed (confirmed by completed command logs) and can vary between the Passcode payload profile or the Restrictions payload profile while the other two commands are left pending.Example pending commands that occur at the time of issue:Clear PasscodeEnable App StoreProfile ListCertificate List I have not been able to reproduce the issue on tes

After poking around Jamf Pro and Jamf Protect, it seems that JSC/RADAR/Wandera is the only source of storage for CVE-level details for managed client app inventories. I can plainly see them in the default web dashboard. So I set up a Risk API key, and enabled the option to see user and device details.Both the docs [1] and manual exploration seem to conclude that only “Device risk” can be gathered from the public API, whereas things like “Average CVSS score” (or anything related to CVEs) cannot. Which would be fine if those two had a tight relationship, but I can plainly see things like an endpoint with six (6) high-scoring app vulnerabilities (including a 10 and a 9.8) per CVSS that only has two (2) app vulnerabilities reported per device risk and grading overall as low-risk.I did notice that app vulns as a category can be force-upgraded from low to high to influence device risk more, but it’s possible that device risk will entirely miss the presence of vulnerable apps and this still d

Hello Jamf Nation!We’ve released Jamf Pro 11.26.0 beta. This release includes updating session duration and time out within Jamf Account, automatic device registration with Microsoft Entra when using Simplified Setup for Platform Single Sign-on (Platform SSO), various bug fixes and more! For full details, check out the release notes after enrollment.How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Click “Join Community” to join the beta forum once enrolled. If you encounter an error on Jamf Nation joining the beta forum, please log into Jamf Nation and then click “Join Community” again. Please also check out this recent blog on Configuring SSO in Jamf Account prior to testing Compliance Benchmarks, Blueprints, and App Switcher. Email beta@jamf.com with questions.The beta program is covered by the Jamf non-disclosure agreement; please do not share any information regarding your testing on any public forum, including the non-beta areas of Jamf

Hello everyone,i wanted to roll out our new custom TeamViewer Host and everything works except that our custom design with the company logo is not displayed. I did it exactly as in the instructions: https://hcsonline.com/images/PDFs/Jamf_Teamviewer_Host.pdf After the custom logo didn't show up, I kept searching and came across these instructions: https://community.teamviewer.com/English/kb/articles/50739-mass-deployment-on-macos#perform-an-assignmentThe groups and the membership works but unfortunately our custom layout does not. Am I missing something or have I done something wrong?  

We are currently using a pre-stage created managed account and the LAPS process for passwords on that account. Since we use Jamf Connect, we have ‘skip account creation step’ turned on.I am finding that this account is not getting the bootstrap token escrowed or a secure token after MDM enrollment. Is this intended? How can I change this? Ideally, I’d like to have a hands off option that doesn’t require a manual installation so that we always have the bootstrap token escrowed and a secure token on our managed account. What am I missing in this step? I am finding when we do need to use the local admin account, it’s not able to take some actions, like install a new OS.

Hey all - Ran into a thing that has been mentioned before, but it was a year ago and a few Jamf Connect login versions ago. We are now up to 3.6 Had a user who had their Microsoft Authenticator switch from sending them push notification to enter a number to requiring her to enter the 6 digit number. She would get the Jamf Connect Login window and enter her MS login, PW and the 6 digit 2FA code. The Jamf Connect Login window would stay up, but load her profile page. She would also see an error that password needed to be at least 7 characters, and contain one number and one alphanumeric character. It took me a VERY long time (and a computer wipe) to figure out that it looks like the Jamf Connect login window is passing that 6 digit number to the OS for login instead of the users Password.  Once we reset her Authentication Methods in EntraID so that the push notification workflow returned, her login issues on her laptop went away.  Has anyone else run into this before? If so is there a se

Due to changes being made by our network team we’re required to deploy a new Trusted Root Certificate within our Wifi Configuration Profile.  DigiCert are changing Root Certificates.What I’m encountering is even though I can successfully deploy the Certificate and Trust it within the Configuration Profile if I deploy more than one Root Certificate the Mac will not connect.I’m hoping that I can deploy the new certificate without impacting the existing wifi connection before Networks make the backend change.

Greetings all, We are trying to enforce screen lock time limits (which InfoSec wants), but when we do, it also enforces a particular screensaver module (which InfoSec doesn't care about in the least).  Some of our users don't like "Flurry" and want to set their own.  These two seem joined at the hip in the GUI.  Copilot had a suggestion using a script, but it didn't work for me. Does anybody have these two things functioning, but separately.  It doesn't seem like a big deal to me, but some of our users are really not happy about not being able to set their preferred screen saver.