Hi everyone, we’re currently testing Platform SSO (Secure Enclave) in combination with the Kerberos Single Sign-On Extensionon our Macs (managed via Jamf Pro).Since enabling Platform SSO, we’ve encountered issues with password synchronization as well as Single Sign-On authentication for ADFS-based web applications. As soon as Platform SSO is enabled, users receive the following prompt either after some time or following a reboot:Password SynchronizationVerify your Active Directory and Mac passwords. If they do not match, your Mac password will be synced. The passwords are identical (local macOS login = AD password). However, this prompt appears repeatedly — and only when Platform SSO is active. Additionally, our ADFS-based web applications (intranet portals, internal sites) no longer perform automatic Single Sign-On once Platform SSO is active.I’ve tested this behavior in multiple browsers (Safari, Chrome, Edge, and Firefox), and in all cases, users are prompted to sign in manually.Whe

The criteria Postion in the User and Location for iPad users was removed. Not all user... Any ideas why?  I can’t find that anything was changed in Jamf. 

In macOS 15, the new Private MAC address settings is enabled by default, and there is a new settings in Profile to disable it, BUT it's only for a spacified SSID. If you need a global setting to disable the Private MAC for all existed and new SSID, try to create a new policy to run this command: sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist PrivateMACAddressModeSystemSetting -int 1 It will not disable the Private MAC Address immediately, but it will work after forgot the network or reboot the computer.  

as a systemadmin I really like the Mac Apps updates , both Jamf App catalog and App store. But as a user (and all our users) we get annoyed by the popups. The announcement popup I can understand, but the thank you popup after update is really not needed I think.Would be great if we can disable that.

When creating a smartgroup, there’s a criteria for Last Enrollment. But it’s based on the enrollment date, which does not always have a value. Those machines seem to be excluded from any search which uses the enrollment date criteria. How do you search for machines with no enrollment date?

Hello all,   I am struggling getting OneDrive to silently sign in and redirect folders.  I have researched previous posts, and am using Microsoft's guide here: https://learn.microsoft.com/en-us/sharepoint/deploy-and-configure-on-macos to no avail. Here is my configuration policy below -- can anyone take a look and see what I'm missing?  I swapped out my real tenant ID with (Tenant ID) for the sake of sharing.  Thanks for your help.   <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1"> <dict> <key>KFMBlockOptOut</key> <True/> <key>KFMSilentOptIn</key> <string>(Tenant ID)</string> <key>KFMSilentOptInWithNotification</key> <True/> <key>KFMOptInWithWizard</key> <string>(Tenant ID)</string> <key>EnableSyncAdminR

Students are using Performance Matters but are just accessing Google Lens. We can open a Chrome window and type the following in the address bar: chrome://flags and it opens a settings window where you can enable and disable features but we are looking for a way to add an XML file to Google Chrome in Jamf School for our iPads to disable Lens Overlay. I have seen this XML file but I’m not sure it’s written for Jamf School:<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0">    <dict>        <key>LensOverlaySettings</key>        <integer>1</integer>    </dict></plist> Has anyone had success in disabling Google Chrome Lens in Chrome from Jamf School?

We are a school and deploy laptops to students starting in the 7th grade.  Administration would like to set it so that the computers lock between 10pm EST and 6am where the students cannot log into their device.  We have tried a few things but at best we can get the computer to lock but students just log back in.  Does anyone have a similar setup or suggestions on how to properly setup a curfew on an Apple laptop? For what its worth we are working with all Apple Silicon laptops. Thank you!

Environment: iOS 26 Jamf Pro with Apple School Manager (ASM) VPP token User Assignment licensing (not Device Assignment) Personal Apple ID (non-managed) Issue: Successfully accepted a VPP invitation this morning. Deleted the VPP user in Jamf Pro to troubleshoot an app assignment issue. Created a new VPP invitation and sent it to the same email/Apple ID.When clicking the invitation link on the device: Tap "Accept" Redirects to App Store Hangs with "Can't Connect to App Store" error Steps Taken: Confirmed App Store is accessible normally (can browse/download personal apps) Deleted and re-created the Jamf user with same email address Issue persists across multiple attempts Current State: Unable to re-establish VPP association with the same Apple ID. Appears to be a cached association on Apple's backend preventing re-invitation acceptance.Question: What is the recommended method to force-clear the VPP user association on Apple's side, or is the only resolution to wait for the

Is there any equivalent application to Microsoft's AD Users and Computers but available for Mac OS X?Basically the only time given, my specific role, to access a Windows box or start-up a Windows VM is to unlock a users account on AD or to move/delete a computer object in the Mac OU in AD. Given those two specific requirements is there a Mac app for that (that is free if possible)? I have looked before into this and I could only find outdated apps or very expensive high-end server style Enterprise solutions. Thank you

I have had success with scripts to insert the auth code for SPSS in past but SPSS 30 will not apply code through script. Popup still comes up. Script that used to work was this one. I have tried few option using the SPSS instruction manual but no success. What's working for you all?   

I have worked through paloalto's official support document which explains how to create a jamf policy to uninstall Global Protect. It say that the script will run with "superuser authority". However, it still prompts the user to authenticate for the removal of the extension. Is there any way to get around this prompt on the user side?

Apple Classroom on Teacher Macs in Jamf School - Possible without Managed Apple IDs?We're migrating from Jamf Pro to Jamf School. Previously had Apple Classroom working with Macs and iPads via ASM roster syncing from our SIS—no Managed Apple IDs needed.Current status in Jamf School:✅ Apple Classroom works on teacher iPads and student iPads ✅ Jamf Teacher app works on teacher Macs (shows rostered classes) ❌ Apple Classroom on teacher Macs won't load rostered classesTeacher Macs aren't receiving the Education Profile despite fresh enrollments. I suspect it's related to MDM-capable users, but can't confirm. Class data is clearly flowing (iPads get it, Jamf Teacher gets it), so it seems like a device-specific enrollment issue.Is Apple Classroom on teacher Macs possible in Jamf School without Managed Apple IDs?The solution seems tantalizing close based a on a checkbox still available in Jamf School - just that it only applied to pretty dated OS versions. Other 2 year old post   

We have run into a situation where closing the lid on a Mac Book Pro or even just setting the device to sleep is resulting in a machine that cannot be recovered without holding down the power button.I’ve looked for changes that might be causing this but the only thing I changed (and have now disabled) was an extension attribute that was reporting PlatformSSO status.OS impacted are Tahoe, Sequoia and Sonoma generally on latest versions.If anyone has any clues on which logs might reveal why this is happening or to help understand what a fix might look like, that information would be gratefully received. 

Hello, looking for some help/advice.Has anyone successfully deployed the Dameware Remote Everywhere Agent?Does anyone have a working script they could share?We have created the bulk agent and have the ID, but no success.Thanks for any info.

Hi everyone,I'm currently preparing to move about 500 devices from Jamf to another MDM. I've made sure all devices are updated to macOS and iOS/iPadOS 26 and have tested moving a few devices to confirm that it works without deleting them first.The question is, is there any way to see if they have been moved in Jamf? And if so, trigger a cleanup somehow?

Does anyone know if there is a to turn this setting off without admin credentials?Through terminal command or config profile? Thanks!

Evening All I have spent the best part off 3 months backwards and forwards with jamf support. Over why bootstrap tokens don't always get escrowed back to jamf pro during our enrollment process.My team off 3, have manual been through our 300 labs devices, to tidy up any machines that dont have a bootstrap token escrowed to Jamf. We did setup and extension attribute to try populate a smart group but this wasn't very reliable. It does seem this information isn't getting back to jamf during a inventory update.I'm still no closer in finding the root cause. As anyone else experienced this type of issue? I'm also after a script to create bootstrap token on the fly. As I'm moving onto sorting out our staff Devices next and don't want to recall them if I can help it.Thanks in advanceTom

The user is unable to elevate their privileges to an admin role using Self Service / Jamf Connect.When attempting to elevate, the following notification is displayed:Jamf ConnectA change in the system time has been detected.For more information, please contact your administrator.I verified that: Date and time are set to automatic Time zone is set correctly No manual time changes were performed by the user Despite this, Jamf Connect continues to block privilege elevation.Relevant Jamf Connect logs indicate a time-tampering detection eventTimestamp: 2026-02-10 09:35:29 +0000, Sender: Jamf Connect, subsystem: com.jamf.connect, Process: Jamf Connect, Category: PrivilegeElevation, Contents: temporary admin reason: Installation de logicielTimestamp: 2026-02-10 09:35:29 +0000, Sender: JCDaemon, subsystem: com.jamf.connect.daemon, Process: JCDaemon, Category: PrivilegeElevation, Contents: user is blocked from further elevations due to system time tamperingTimestamp: 2026-02-10 09:35:29 +00

Why we need to enable the Cloud Distribution Point for fresh. new instance manually when I am using the Pre-Stage for enrollment?

Our students are cheating on test using the Keyboard setting “Show math results”.  I created a ticket with Jamf but they told me the only way to fix this is to use Blueprints but we are not set up with SSO.  Is there  another way of fixing this issue.  Some very important state test are coming and our students are spreading the word on how to cheat.

Hi to all i've followed instruction on this link https://www.jamf.com/blog/help-users-activate-microsoft-office-365-and-configure-outlook-in-one-click/ to activate office 365 versione 16.94 on mac but office apps are not signed and when i open outlook the account has not be setted. In profile setting on the mac the parameter $email has been setted correctly with the email address settted on jamf inventory. There is something wrong? Thanks for your help

This has come to my attention recently. So basically, our users would change their password via jamf connect, it would go through and successfully change their azure ad password. Then once they login to the computer, it would give them a prompt, telling them to enter their old password for the local account to sync with the new azure ad account, we also have filevault enabled. This was all working fine, but recently when an end user changes their password via jamf connect. It gives an error message (I didn’t see it yet, have to wait until someone changes their PW again) and it will act like it doesn’t go through, but it actually does go through. It will not update their jamf connect expiration date (For example now, some users say their passwords will expire in -10 days) even though they changed their azure ad password. Now we have had users getting locked out of filevault because when they sign out or restart their computer and are on the filevault page, the local account password doe

Does anyone have issues when using JRA with the users that have multiple displays?During a session it will swap between displays automatically, even thought I have auto switch monitor turned off.

We’ll use Google Chrome and Mozilla Firefox for this questionI’m learning how to use Jamf Setup Manager. I followed the directions on GitHub but I made some changes. I have Google Chrome installing automatically with Jamf App Catalog so I decided to install Firefox to test. I also have the package on a policy instead of prestage to install after logging in with Jamf Connect. (the only prestage package is Jamf Connect). Jamf App Catalog should automatically update apps… correct? I don’t know if installing with JSM will stop something like this from happening. I have Firefox setup as available in Self-Service only (but still in Jamf App Catalog). I was also playing around with Jamf Pro AI and before all the troubleshooting to get Jamf Setup Manager to pop up, the AI told me that it may have confused me. During troubleshooting, it said:I need to be honest with you - based on the search results, I'm not finding specific documentation about a product called "Jamf Setup Manager" as a standal