@AJPinto also know as Anthony James Pinto, is Jamf Nation’s number one community contributor. With some all-star stats like providing 289 accepted solutions, 2,607 posts and 1,145 kudos, it's likely that you’ve seen his name splashed around the community.   Jamf Nation, the world’s largest Apple Admins community, relies on the smarts and dedication of members to help advance and maintain this space as a valuable asset of learning and connection. People like Anthony make communities like Jamf Nation function in their highest level.   Let's take a peak inside Anthony’s brain and learn more about the man behind the avatar, shall we?  Tell us about yourself, Anthony  I am from LA and have lived all over the US. I settled down in central Alabama for reasons beyond me, met my wife and just sorta stayed here. My wonder lust never went away, and I love to travel and experience new places and new things. My preferred travel locations are places far a

        I was asked last week to think of some practices as a Jamf Admin that I’ve adopted into my environments that have really helped me out. One of the first things that came to mind was organization practices. Organization is key to keeping a clean environment and can help you quickly identify what is being configured and where. I’ve made some notes on how I like to keep my environments organized with naming conventions and will share them below.    Naming conventions will help to keep objects organized, reduce confusion, and help optimize our Jamf Pro platform. As additional policies, configuration profiles, packages, groups, etc. get added to the platform, a consistent naming scheme will provide clarity.    The name of any object in Jamf Pro should quickly describe what it does or what it’s for. Each object within Jamf Pro should also be tied to an appropriate category. Keep it simple.    Static/Smart Computer Groups  &

"Security is not a product, but a process." – Bruce Schneier   In today’s endpoints landscape, organizations managing macOS / Windows endpoints face an increasing need to enforce stringent security standards to protect sensitive data. The CIS (Center for Internet Security) Benchmarks serve as a globally recognized framework for safeguarding endpoints against security threats. When combined with the powerful capabilities of Mobile Device Management (MDM) such as Jamf Pro, Intune, Endpoint Central, etc., , IT administrators can seamlessly implement these benchmarks to enhance security without compromising user experience.   CIS Benchmarks are consensus-based, best-practice security configuration guides. They provide detailed recommendations on configuring IT systems to mitigate vulnerabilities. For macOS, the CIS Apple macOS Benchmark offers actionable steps to harden systems against cyberattacks while ensuring compliance with organizational security policies.   Using CIS

  As enterprises grow increasingly and rely on technology, finding efficient ways to provide  employees with access to digital tools is important. While iPads are often the device of choice  for many organization, a one-to-one deployment may not always be feasible. Apple’s Shared  iPad functionality, combined with Jamf Pro, offers a powerful solution for enterprises  looking to provide secure and personalized access on shared devices without compromising  user experience or data security.    What is Shared iPad in Enterprise?    Shared iPad is a feature designed to enable multiple users to share a single iPad while  maintaining a secure, personalized experience for each individual. Each user logs into the  device with their Managed Apple Account or a temporary session, accessing their unique  apps, settings, and data. When users log out, their data is stored securely and becomes  inaccessible to others.&nbs

Effectively managing devices is essential for IT administrators in today's rapidly changing digital environments. While tools like Jamf offer powerful capabilities for managing Apple devices, a truly optimized IT strategy involves more than just top-down policy creation. Incorporating user feedback loops into your Jamf-managed environment can transform device management from a purely administrative task into a dynamic, user-centric process. By conducting surveys, analyzing self-service usage metrics, and adjusting policies based on user behavior, IT teams can ensure their strategies align with the needs of employees or students. This approach enhances device utilization and promotes greater satisfaction and productivity.  Why User Feedback Matters in Device Management  Device management policies often stem from IT goals such as ensuring security, minimizing downtime, and maintaining compliance. However, the end users—employees, educators, or students—interact with t

Note: A newer version of this article is available on the Jamf Blog.   Jamf added support for LAPS in April’s Jamf Pro 10.46.0 release.   What is LAPS? LAPS is short for Local Administrator Password Solution. It was coined by Microsoft in May 2015 as a solution for automatically rotating passwords of shared IT administrator accounts on end users’ computers. Since then, it’s become a standard industry term used across platforms. Desktop administrators have added shared IT admin accounts to their end users’ computers for decades for those times when they need to sit in front of a computer or remotely control it and log in. But this practice introduces a few major security problems: Typically, these accounts share the same username and password across computers. If the credentials are ever exposed to unauthorized persons, the entire fleet is vulnerable to attack. Multiple people know these shared IT admin credentials and they’re easy to reshare to anyone without any mea

We have added a new reward to Jamf Nation Rewards: the ability to donate using points to Los Angeles County, by supporting organizations providing emergency relief.  Dangerous wildfires, including the destructive Palisades fire, have ravaged Los Angeles County. The wildfires have burned more than 60 square miles and destroyed over 12,000 buildings. More than twenty people have died, dozens more are missing and more than 90,000 people are under evacuation orders.   It is the most destructive fire in LA history.  If you’re interested in a way to help through sending a donation, we have set up a new way you can redeem your Byte reward points to help with the LA wildfire relief.  It only takes 50 points to donate $25! To find out where the donations are heading, check out this page -https://jamf.benevity.org/community/fundraiser/24332  Donations can be made under the reward '$25 Donation to Emergency Relief LA County'. Please reach out to jamfnation@jamf.com s

As you’ve probably heard, Declarative Device Management (or, for less of a mouthful, DDM) is making significant changes to the way in which managed devices go about their business in some key ways - most notably how managed software updates work. We’re going to take a look at this in detail, as it’s been a particularly hot topic in the Apple Admin community over the last couple of years.   What is DDM, anyway? Firstly, it’s not a typo of ‘MDM’! In a nutshell, gone is the notion that the MDM server needs to constantly check-up on how a device is getting on with a certain command it’s been asked to do; instead, the device has much more independence and tells the MDM server when something has been done. This majorly cuts down on the stream of commands issued to devices (particularly when performing remote software updates, which we’ll loop back to shortly) and means that a growing number of attributes, such as OS version, can be updated on the MDM without an inventory update command

Instead of using the Okta Authentication API, Jamf Connect can also use the Custom identity provider type with an application set up for OIDC/ROPG in the Okta tenant. This allows for granular application of Authentication Policies in the new Okta Identity Engine tenants. Create App Integration in Okta Navigate to the organization Okta administration page.  Select Applications → Applications and pick the Create App Integration option.     Select the options for OIDC - OpenID Connect and Native Application.  Select Next to continue. Select a name for the App integration name.  In Grant type, select the options for: Resource Owner Password (this enables ROPG for ongoing password checks) Implicit (hybrid) Scrolling down for more options, remove the default entries with the X option for Sign-in redirect URIs and Sign-out redirect URIs.  Enter a new sign-in redirect URI with the value https://127.0.0.1/jamfconnect Optionally, assign users to the Jamf Co

Content backfill required

Co-Authored By Simone Martorelli and Jonathan Krauer At the Jamf Nation User Conference this year, the Mac@IBM team presented a new solution that’s set to transform Mac device migrations in the enterprise: IBM Data Shift. Developed in response to the unique challenges of managing large-scale Mac deployments, it provides a user-friendly, secure, and efficient method to migrate data on managed devices—bridging gaps left by traditional migration tools.   Why Traditional Migration Solutions Don’t Fit Enterprise Needs  When it comes to Mac migrations, enterprises encounter complexities that personal device users typically don’t face. Managed Device Environments, for instance, have high security standards and stringent configuration needs that general migration tools aren’t designed to meet. While Apple’s Migration Assistant is well-suited for a personal environment, it may lead to headaches in a managed setting. Some of the main challenges include:  Post-Setup Migratio

People ask me all the time what the most significant difference is between supporting an MDM for Macs and supporting Windows. I’ve thought about the answer a lot, and it comes down to the collaborative nature of the Apple support community. One underrated community aspect is the sheer number of open-source tools available. The sheer number of tools freely available by the community for the community is amazing!  As admins, we strive to make endpoints more secure and streamlined. This often requires acquiring new products and services. Still, it often comes down to Finance signing off on the expense and information Security, ensuring it doesn’t do anything improper with the data. Management approving the implementation of a new tool, not to mention your time making a Proof of Concept (in non-production of course!). This often comes alongside dealing with account representatives, solution engineers, and a slew of other hurdles they are concerned with.  Enter open source! I used

This week of the Mac Admins Podcast, we spoke with Jamf's VP of Product & Solutions Engineering Matt Vlasach to talk about Network Relays, and how they can be used to secure network traffic. Relays are different from -- and newer than -- a VPN in a lot of ways, and they're not as well understood. Matt joins hosts Marcus (Jamf SE) and Tom (JumpCloud Product Director) to talk about what makes Relays new and special for Mac Admins. Relays are a complicated technology behind the scenes, but Matt breaks it down into some key components for Mac Admins to understand.     The [MASQUE protocol](https://datatracker.ietf.org/wg/masque/about/) that drives Relays is highly secure and private, and the client is built directly into the operating system, all you need to turn it on is an MDM Profile, and if necessary, a per-app VPN. Matt talks at length about Relays are a "yes, and" technology that can go hand in hand with your regular VPN client, allowing you to ensure that key comp

Background  Like most organizations, we want the best — most secure — experience for our users. So, naturally, we’ve investigated leveraging Managed Apple IDs.  While Managed Apple IDs come with some significant limitations, my personal favorite has to be:  Allows browsing but not purchasing, paid or free in: App Store  However, the promise of a Shared iPad is quite alluring.  The Rub  I also suspect “the rub” for most organizations who wish to federate their domain is Apple’s unwillingness to inform the enterprise which of the enterprise’s users will be impacted before federation is enabled:  … but you can’t see their actual personal Apple ID.  Get notified about federated authentication user name conflicts, Item No. 7  Script  The following Domain Apple IDs Jamf Pro Computer Extension Attribute will inspect the current (or previous) logged-in user’s MobileMeAccounts.plist for Apple IDs associated with domains included in the domainsT

If you're like me, you wear many hats at your organization, and if your organization is like mine (higher education) your staffing is lean. You may think, as I once did, that you don't have time to start enforcing macOS security compliance, or even see why you should. But in today's climate of evolving threats, increasing regulation, and high-profile settlements, it's likely that you'll need to get started sooner than you think.  First of all, if you're new to security compliance, you might want to check out my presentation from PSU MacAdmins 2024, where I went into detail about how the macOS Security Compliance Project (mSCP) works together with Jamf Compliance Editor (JCE) to help you build a framework you can use to: set a compliance baseline, check your fleet to see what's compliant and what's not, report on those findings, and fix non-compliant devices. There are plenty of great resources on how to use mSCP and JCE, so what I'll concentrate on is the planning and staging.&nbs

Recently, my organization's Compliance and Security Operations teams requested visibility into how macOS apps are patched. They needed a report showing deployed apps via Jamf and their version status. After two manual reports, I knew there had to be a better way and developed a Python script for automation. Initially, I didn't plan to share the code publicly, thinking it might not be helpful to others. However, a friend, Chris Ball, encouraged me to release it—leading to the creation of Patcher. Manual reporting takes time away from critical tasks like CVE remediation and policy setup. Automating these processes allows MacAdmins to focus on more pressing matters. The time saved with Patcher has been invaluable for myself, and I hope others will benefit from it too. What does Patcher do? Patcher leverages the Jamf Pro API to automate patch management reporting, transforming data into actionable insights. Designed as a Command Line Interface (CLI), it integrates easily with LaunchAgents

You can manage so many more settings than Apple documents.  Apple’s list of supported management keys for configuration profiles is slowly growing, though some listed on their own support site no longer apply or work for current versions of macOS. If you want the official Apple documented supported settings for configuration profiles there’s two places, Apple’s developer documentation and an Apple support page  https://developer.apple.com/documentation/devicemanagement/profile-specific_payload_keys  https://support.apple.com/guide/mdm/complete-payload-list-mdm5370d089/1/web/1.0  The developer documentation is nice because it lets you know what keys have been updated and changed. The complete payload support page is nice because it gives a little more description about each setting.  But…But…But…there’s so much more, so many more settings you can manage with a configuration profile! So, what if you want to manage settings not listed in those documents…there’s a

For several years now, Apple has highlighted the important role that partners and Admins play in testing beta versions of their upcoming operating systems and submitting feedback for any issues that can (and do, particularly in the early versions) appear. They also provide some great tools that make it easy for this to be done, but those tools are only half of the story. The other half is an effective testing strategy that, when executed properly, will both provide Apple’s engineers with invaluable data for resolving unforeseen issues prior to public release and also give you ample opportunity to ensure your readiness (and confidence!) to deploy the latest OS version upon public release. This benefits your organisation and users alike by offering the latest software features to enhance workflows and maintaining security standards across your Apple fleet. This post aims to provide an overview of the tools Apple provides to Admins for beta testing at scale, as well as highlighting best p

Comic Sans is just my type.Not really. You’ve got a story! You know what you want to say. How do you say it? Your presentation deck is how you turn your ideas into something visual for your audience. It’s going to complement what you’re there to say. You as the speaker are not there to complement your presentation deck.   com·ple·ment | kämpləmənt | verb to complete or bring to perfection In other words, what you say is more important than what you show, but what you show can help you with what you’re saying. Apple Keynote, Google Slides, and Microsoft PowerPoint are the three big presentation tools. If you choose to use Google Slides, make sure you install the Google Docs Offline extension in Google Chrome or Microsoft Edge and then turn on “Available offline”. Always assume you can’t rely on conference Wi-Fi. Stick with one of these. You could create your presentation in something else and then create a PDF, but you’ll really limit yourself later when we discuss animations. And

Hello, Jamf Nation! The Jamf ID update is now complete. Your name, email, phone number, language and email opt-out status have been migrated. Please reset your Jamf ID password and re-enroll in Multi-factor Authentication (MFA), if applicable. Your time zone will be set automatically to the browser time zone when logging in for the first time with your new password.      Action Required: Reset Your Password Please reset your password by following these simple steps: Visit Jamf Account: Head over to account.jamf.com. Click on ‘Continue with Jamf ID’: This button will display if you've logged in recently. Enter your Email Address Click ‘Log in using Jamf ID’: This enables you to continue with your Jamf ID credentials, as opposed to utilizing SSO if it has been enabled for your organization.  Click on 'Reset Password': You'll find this option on the login page. Click on it to initiate the password reset process. Enter Your Email: Provide the email address as

This post was originally posted to my personal blog, which you can find by following this link. With Jamf Pro 10.49 admins can now use OAuth client credentials flow for authenticating to the product's APIs. The documentation for the new API Roles and Clients can be found here. The implementation is straightforward: Go to Settings > System > API Roles and Clients Create an API Role Select all of the applicable Jamf Pro API role privileges it should grant. Create an API Client. Select one or more API Roles to assign to it. Enable the API Client. Generate the Client Secret. You can now use the client ID and secret to obtain access tokens. This shell example below is taken from Jamf's developer docs. curl --request POST "${url}/api/oauth/token" \\ --header "Content-Type: application/x-www-form-urlencoded" \\ --data-urlencode "grant_type=client_credentials" \\ --data-urlencode "client_id=${client_

Welcome to Part 3 of our discussion of Certificates, SCEP, and 802.1x. In our previous post we took a look at how Active Directory Certificate Services works. In our final part in this series, we will explore SCEP and 802.1x. What is SCEP? SCEP = Simple Certificate Enrollment Protocol What does SCEP do? SCEP is a certificate management protocol that helps IT administrators issue certificates automatically. SCEP is used by a Windows Server Role called NDES or offered as a service by a third-party Certification Authority (CA). What is NDES? NDES = Network Device Enrollment Service NDES is a Windows Server Role Service which works with the Active Directory Certificate Services Role to distribute certificates via SCEP. What does NDES do? NDES allows software on routers and other network devices (e.g., Macs and iPads) running without domain credentials to obtain certificates based on the Simple Certificate Enrollment Protocol (SCEP). How does NDES work? NDES uses the Micr

Introduction Migrating from an on-premises Jamf Pro environment to Jamf Cloud offers numerous benefits, including increased scalability, simplified maintenance, and enhanced security. However, the migration process requires careful planning and coordination to ensure a seamless transition. In this article, we will explore the steps involved in migrating from on-premises Jamf Pro to Jamf Cloud, along with key considerations and tips for a successful migration.   Preparation Before initiating the migration process, several prerequisites must be fulfilled. Firstly, it is important to update your on-premises Jamf instance to the latest version. Jamf Cloud instances are automatically upgraded and kept up to date, so making sure your on-premise version is in sync with Jamf Cloud will ensure compatibility. Upgrading to the latest version also ensures that you have access to the latest features and enhancements available in Jamf Pro. For more information, see Jamf's documentation on Prepa

Additional information about Microsoft's Conditional Access filters for apps is available here. What is a “Custom Security Attribute”  Simply, the custom security attribute lets you stick a Post-It Note with anything you want written on it onto an Enterprise app, a user, or any other Azure or Azure AD resources.  Once you’ve tagged it, you can use that tag for things like applying conditional access policies or exempting apps or users from the policy. How are Custom Security Attributes used with Azure Active Directory Conditional Access policies Custom security attributes allow an administrator to tag an application or web service with a special flag.  This flag could be used like a group membership for applications, or it can be used to apply policies to an application which would not normally be subject to conditional access rules like native/mobile App registrations like those used with Jamf Connect.   In these examples, we will: Use a custom security attrib

A Little Background In 2017, Jamf released an integration with Microsoft Endpoint Manager’s (formerly Intune) Partner Device Management (PDM) API. This API allows Jamf Pro to send inventory data for managed computers to Microsoft Endpoint Manager, where compliance is then calculated using Microsoft Endpoint Manager’s Compliance Policies. In order for Jamf Pro to send data to Microsoft Endpoint Manager, computers must be registered to Azure AD using Company Portal, and a jamf agent (JamfAAD) must collect and maintain an active user session token. Organizations seeking to use the PDM integration must guide end users through this registration flow. The following document addresses best practices for registration, including configuration of the JamfAAD agent, Azure AD SSO Extension, using policies to guide the user, and tracking registrations via Extension Attributes. Configuring the JamfAAD agent UseWKWebView JamfAAD must prompt the user to sign in with their Azure AD crede