As you’ve probably heard, Declarative Device Management (or, for less of a mouthful, DDM) is making significant changes to the way in which managed devices go about their business in some key ways - most notably how managed software updates work. We’re going to take a look at this in detail, as it’s been a particularly hot topic in the Apple Admin community over the last couple of years.   What is DDM, anyway? Firstly, it’s not a typo of ‘MDM’! In a nutshell, gone is the notion that the MDM server needs to constantly check-up on how a device is getting on with a certain command it’s been asked to do; instead, the device has much more independence and tells the MDM server when something has been done. This majorly cuts down on the stream of commands issued to devices (particularly when performing remote software updates, which we’ll loop back to shortly) and means that a growing number of attributes, such as OS version, can be updated on the MDM without an inventory update command

Instead of using the Okta Authentication API, Jamf Connect can also use the Custom identity provider type with an application set up for OIDC/ROPG in the Okta tenant. This allows for granular application of Authentication Policies in the new Okta Identity Engine tenants. Create App Integration in Okta Navigate to the organization Okta administration page.  Select Applications → Applications and pick the Create App Integration option.     Select the options for OIDC - OpenID Connect and Native Application.  Select Next to continue. Select a name for the App integration name.  In Grant type, select the options for: Resource Owner Password (this enables ROPG for ongoing password checks) Implicit (hybrid) Scrolling down for more options, remove the default entries with the X option for Sign-in redirect URIs and Sign-out redirect URIs.  Enter a new sign-in redirect URI with the value https://127.0.0.1/jamfconnect Optionally, assign users to the Jamf Co

Content backfill required

Co-Authored By Simone Martorelli and Jonathan Krauer At the Jamf Nation User Conference this year, the Mac@IBM team presented a new solution that’s set to transform Mac device migrations in the enterprise: IBM Data Shift. Developed in response to the unique challenges of managing large-scale Mac deployments, it provides a user-friendly, secure, and efficient method to migrate data on managed devices—bridging gaps left by traditional migration tools.   Why Traditional Migration Solutions Don’t Fit Enterprise Needs  When it comes to Mac migrations, enterprises encounter complexities that personal device users typically don’t face. Managed Device Environments, for instance, have high security standards and stringent configuration needs that general migration tools aren’t designed to meet. While Apple’s Migration Assistant is well-suited for a personal environment, it may lead to headaches in a managed setting. Some of the main challenges include:  Post-Setup Migratio

People ask me all the time what the most significant difference is between supporting an MDM for Macs and supporting Windows. I’ve thought about the answer a lot, and it comes down to the collaborative nature of the Apple support community. One underrated community aspect is the sheer number of open-source tools available. The sheer number of tools freely available by the community for the community is amazing!  As admins, we strive to make endpoints more secure and streamlined. This often requires acquiring new products and services. Still, it often comes down to Finance signing off on the expense and information Security, ensuring it doesn’t do anything improper with the data. Management approving the implementation of a new tool, not to mention your time making a Proof of Concept (in non-production of course!). This often comes alongside dealing with account representatives, solution engineers, and a slew of other hurdles they are concerned with.  Enter open source! I used

This week of the Mac Admins Podcast, we spoke with Jamf's VP of Product & Solutions Engineering Matt Vlasach to talk about Network Relays, and how they can be used to secure network traffic. Relays are different from -- and newer than -- a VPN in a lot of ways, and they're not as well understood. Matt joins hosts Marcus (Jamf SE) and Tom (JumpCloud Product Director) to talk about what makes Relays new and special for Mac Admins. Relays are a complicated technology behind the scenes, but Matt breaks it down into some key components for Mac Admins to understand.     The [MASQUE protocol](https://datatracker.ietf.org/wg/masque/about/) that drives Relays is highly secure and private, and the client is built directly into the operating system, all you need to turn it on is an MDM Profile, and if necessary, a per-app VPN. Matt talks at length about Relays are a "yes, and" technology that can go hand in hand with your regular VPN client, allowing you to ensure that key comp

Background  Like most organizations, we want the best — most secure — experience for our users. So, naturally, we’ve investigated leveraging Managed Apple IDs.  While Managed Apple IDs come with some significant limitations, my personal favorite has to be:  Allows browsing but not purchasing, paid or free in: App Store  However, the promise of a Shared iPad is quite alluring.  The Rub  I also suspect “the rub” for most organizations who wish to federate their domain is Apple’s unwillingness to inform the enterprise which of the enterprise’s users will be impacted before federation is enabled:  … but you can’t see their actual personal Apple ID.  Get notified about federated authentication user name conflicts, Item No. 7  Script  The following Domain Apple IDs Jamf Pro Computer Extension Attribute will inspect the current (or previous) logged-in user’s MobileMeAccounts.plist for Apple IDs associated with domains included in the domainsT

If you're like me, you wear many hats at your organization, and if your organization is like mine (higher education) your staffing is lean. You may think, as I once did, that you don't have time to start enforcing macOS security compliance, or even see why you should. But in today's climate of evolving threats, increasing regulation, and high-profile settlements, it's likely that you'll need to get started sooner than you think.  First of all, if you're new to security compliance, you might want to check out my presentation from PSU MacAdmins 2024, where I went into detail about how the macOS Security Compliance Project (mSCP) works together with Jamf Compliance Editor (JCE) to help you build a framework you can use to: set a compliance baseline, check your fleet to see what's compliant and what's not, report on those findings, and fix non-compliant devices. There are plenty of great resources on how to use mSCP and JCE, so what I'll concentrate on is the planning and staging.&nbs

Recently, my organization's Compliance and Security Operations teams requested visibility into how macOS apps are patched. They needed a report showing deployed apps via Jamf and their version status. After two manual reports, I knew there had to be a better way and developed a Python script for automation. Initially, I didn't plan to share the code publicly, thinking it might not be helpful to others. However, a friend, Chris Ball, encouraged me to release it—leading to the creation of Patcher. Manual reporting takes time away from critical tasks like CVE remediation and policy setup. Automating these processes allows MacAdmins to focus on more pressing matters. The time saved with Patcher has been invaluable for myself, and I hope others will benefit from it too. What does Patcher do? Patcher leverages the Jamf Pro API to automate patch management reporting, transforming data into actionable insights. Designed as a Command Line Interface (CLI), it integrates easily with LaunchAgents

You can manage so many more settings than Apple documents.  Apple’s list of supported management keys for configuration profiles is slowly growing, though some listed on their own support site no longer apply or work for current versions of macOS. If you want the official Apple documented supported settings for configuration profiles there’s two places, Apple’s developer documentation and an Apple support page  https://developer.apple.com/documentation/devicemanagement/profile-specific_payload_keys  https://support.apple.com/guide/mdm/complete-payload-list-mdm5370d089/1/web/1.0  The developer documentation is nice because it lets you know what keys have been updated and changed. The complete payload support page is nice because it gives a little more description about each setting.  But…But…But…there’s so much more, so many more settings you can manage with a configuration profile! So, what if you want to manage settings not listed in those documents…there’s a

For several years now, Apple has highlighted the important role that partners and Admins play in testing beta versions of their upcoming operating systems and submitting feedback for any issues that can (and do, particularly in the early versions) appear. They also provide some great tools that make it easy for this to be done, but those tools are only half of the story. The other half is an effective testing strategy that, when executed properly, will both provide Apple’s engineers with invaluable data for resolving unforeseen issues prior to public release and also give you ample opportunity to ensure your readiness (and confidence!) to deploy the latest OS version upon public release. This benefits your organisation and users alike by offering the latest software features to enhance workflows and maintaining security standards across your Apple fleet. This post aims to provide an overview of the tools Apple provides to Admins for beta testing at scale, as well as highlighting best p

Comic Sans is just my type.Not really. You’ve got a story! You know what you want to say. How do you say it? Your presentation deck is how you turn your ideas into something visual for your audience. It’s going to complement what you’re there to say. You as the speaker are not there to complement your presentation deck.   com·ple·ment | kämpləmənt | verb to complete or bring to perfection In other words, what you say is more important than what you show, but what you show can help you with what you’re saying. Apple Keynote, Google Slides, and Microsoft PowerPoint are the three big presentation tools. If you choose to use Google Slides, make sure you install the Google Docs Offline extension in Google Chrome or Microsoft Edge and then turn on “Available offline”. Always assume you can’t rely on conference Wi-Fi. Stick with one of these. You could create your presentation in something else and then create a PDF, but you’ll really limit yourself later when we discuss animations. And

Hello, Jamf Nation! The Jamf ID update is now complete. Your name, email, phone number, language and email opt-out status have been migrated. Please reset your Jamf ID password and re-enroll in Multi-factor Authentication (MFA), if applicable. Your time zone will be set automatically to the browser time zone when logging in for the first time with your new password.      Action Required: Reset Your Password Please reset your password by following these simple steps: Visit Jamf Account: Head over to account.jamf.com. Click on ‘Continue with Jamf ID’: This button will display if you've logged in recently. Enter your Email Address Click ‘Log in using Jamf ID’: This enables you to continue with your Jamf ID credentials, as opposed to utilizing SSO if it has been enabled for your organization.  Click on 'Reset Password': You'll find this option on the login page. Click on it to initiate the password reset process. Enter Your Email: Provide the email address as

This post was originally posted to my personal blog, which you can find by following this link. With Jamf Pro 10.49 admins can now use OAuth client credentials flow for authenticating to the product's APIs. The documentation for the new API Roles and Clients can be found here. The implementation is straightforward: Go to Settings > System > API Roles and Clients Create an API Role Select all of the applicable Jamf Pro API role privileges it should grant. Create an API Client. Select one or more API Roles to assign to it. Enable the API Client. Generate the Client Secret. You can now use the client ID and secret to obtain access tokens. This shell example below is taken from Jamf's developer docs. curl --request POST "${url}/api/oauth/token" \\ --header "Content-Type: application/x-www-form-urlencoded" \\ --data-urlencode "grant_type=client_credentials" \\ --data-urlencode "client_id=${client_

Welcome to Part 3 of our discussion of Certificates, SCEP, and 802.1x. In our previous post we took a look at how Active Directory Certificate Services works. In our final part in this series, we will explore SCEP and 802.1x. What is SCEP? SCEP = Simple Certificate Enrollment Protocol What does SCEP do? SCEP is a certificate management protocol that helps IT administrators issue certificates automatically. SCEP is used by a Windows Server Role called NDES or offered as a service by a third-party Certification Authority (CA). What is NDES? NDES = Network Device Enrollment Service NDES is a Windows Server Role Service which works with the Active Directory Certificate Services Role to distribute certificates via SCEP. What does NDES do? NDES allows software on routers and other network devices (e.g., Macs and iPads) running without domain credentials to obtain certificates based on the Simple Certificate Enrollment Protocol (SCEP). How does NDES work? NDES uses the Micr

Introduction Migrating from an on-premises Jamf Pro environment to Jamf Cloud offers numerous benefits, including increased scalability, simplified maintenance, and enhanced security. However, the migration process requires careful planning and coordination to ensure a seamless transition. In this article, we will explore the steps involved in migrating from on-premises Jamf Pro to Jamf Cloud, along with key considerations and tips for a successful migration.   Preparation Before initiating the migration process, several prerequisites must be fulfilled. Firstly, it is important to update your on-premises Jamf instance to the latest version. Jamf Cloud instances are automatically upgraded and kept up to date, so making sure your on-premise version is in sync with Jamf Cloud will ensure compatibility. Upgrading to the latest version also ensures that you have access to the latest features and enhancements available in Jamf Pro. For more information, see Jamf's documentation on Prepa

Additional information about Microsoft's Conditional Access filters for apps is available here. What is a “Custom Security Attribute”  Simply, the custom security attribute lets you stick a Post-It Note with anything you want written on it onto an Enterprise app, a user, or any other Azure or Azure AD resources.  Once you’ve tagged it, you can use that tag for things like applying conditional access policies or exempting apps or users from the policy. How are Custom Security Attributes used with Azure Active Directory Conditional Access policies Custom security attributes allow an administrator to tag an application or web service with a special flag.  This flag could be used like a group membership for applications, or it can be used to apply policies to an application which would not normally be subject to conditional access rules like native/mobile App registrations like those used with Jamf Connect.   In these examples, we will: Use a custom security attrib

A Little Background In 2017, Jamf released an integration with Microsoft Endpoint Manager’s (formerly Intune) Partner Device Management (PDM) API. This API allows Jamf Pro to send inventory data for managed computers to Microsoft Endpoint Manager, where compliance is then calculated using Microsoft Endpoint Manager’s Compliance Policies. In order for Jamf Pro to send data to Microsoft Endpoint Manager, computers must be registered to Azure AD using Company Portal, and a jamf agent (JamfAAD) must collect and maintain an active user session token. Organizations seeking to use the PDM integration must guide end users through this registration flow. The following document addresses best practices for registration, including configuration of the JamfAAD agent, Azure AD SSO Extension, using policies to guide the user, and tracking registrations via Extension Attributes. Configuring the JamfAAD agent UseWKWebView JamfAAD must prompt the user to sign in with their Azure AD crede

It’s that time of year again. You and your team have finished or are about to finish all the big summer projects, but what might you have missed in the shuffle? Here are a few things we re-check at Brewster just before students arrive for the winter term.    Certificates Certificates are something you should have well handled and probably on a team calendar for renewals. After all, there are plenty of them across many services, and missing one could have dramatic consequences, especially at the beginning of the school year. So double-check even if you’re sure you’re all set. Apple Certificates such as Developer and Deployment ID certificates - require yearly renewal. In JAMF Pro, double-check your Push Certificates, PKI Certificates, and your Apple School Manager/DEP integration to make sure everything is syncing properly.   Software Updates It’s nearly universal that educational software developers have this tendency to release new major updates in the weeks leadin

A Read-only Friday post by William Smith If the thought of standing up in front of an audience makes your skin crawl, trust me when I say every new presenter gets that feeling. Conference season for Mac Admins starts this year in late March and lasts through October. Locales range from Australia to Great Britain to Sweden to Canada to the United States. And despite the tragic wartime circumstances in Ukraine, the MacAdminsUA free online conference carried on for its second year in 2022. The fact this conference exists shows our Apple Admins community may be small and spread across the globe, but it’s tightly knit. A conference is where community comes together Yuri Vlasyuk, the organizer of MacAdminsUA, brought his story to the January 9 Mac Admins Podcast where he said (paraphrased): “In these conditions, I have a strong belief any community needs to talk more and maybe closer about topics they are working on, because there’s a lot of stress, a lot of depression, and community needs t

Local Admin Password Solution (LAPS) addresses security vulnerabilities of common admin workflows by supporting a unique and randomized local account password per device, that rotates after viewing, and that is accessible to a subset of authorized users. This security feature ensures an organization can maintain control over end user privacy and sensitive data. LAPS is an automated approach that allows IT administrators to maintain security, comply with regulations, improve efficiency, and maintain accountability by knowing who accessed the password and when.   With Jamf Pro 10.46.0, Jamf introduced LAPS support as an API-first solution for better securing shared IT admin accounts on computers. This implementation was specific to the admin account created during Automated Device Enrollment using a PreStage enrollment.   Jamf Pro 10.49.0, as part of User-Initiated Enrollment settings, Jamf expands LAPS support specifically for the Jamf Management Account specified. This soluti

A Read-only Friday post by William Smith “I’m not a terrible procrastinator. I’m a great procrastinator!” It’s Monday morning. You’ve tumbled out of bed and stumbled to the kitchen and poured yourself a cup of ambition. You sit down to check email and in your inbox is a message: Dear <insert your name here>, Congratulations! We are excited to inform you that the following session (or sessions) identified below have been accepted for presentation at this year’s <insert conference name here>. 😳 It’s been weeks (maybe months) since you submitted your session proposal and, frankly, you’d forgotten all about it. Are you excited? Terrified? You need more caffeine to process what you’re reading. The first thing you should do is fist pump the air. Yes! The second is go to your manager, tell them your proposal was accepted, and get the go-ahead to attend. Remember, conference speakers usually get conference costs waived. That can be a few hundred to a thousand dollars o

Happy birthday, Jamf! On June 10th you turned 21! But it’s not just your birthday this month. It’s also Charlie Root’s 30th birthday today! If it weren’t for Charlie, probably none of us would be here right now. Who’s Charlie Root?   Digital spelunking I consider myself an amateur digital spelunker and enjoy digging around the visible and hidden files of macOS to see what I can find. Apple has hidden some iconic Easter eggs in macOS over the years. Some are well-known. Easter eggs are those delightful undocumented software features that you might stumble upon accidentally or if you’re paying a little extra attention. They’ve come and gone over different versions of macOS, but Ventura still has a few to uncover. Look closely at the Maps icon and you’ll find the intersection of the 280 freeway and North Wolfe Road in Cupertino. In the upper right corner is Apple’s headquarters, the ring-shaped Apple Park.   Navigate to System > Library > CoreServices. Right-click CoreT

Working in end-user device management, focusing on onboarding, configuration, security, and updates, is easy. After all, getting everyone working is critical! But what happens at the end of a school year or employment contract? What about managing the sudden departure of a staff member or student with a BYO device? Do you have an end-user device offboarding process in place? Do you have licensed software to recover? Configurations to remove and permissions to reset or restore? What about the removal of the framework itself? In this article, I’ll guide you through the basics to complete these tasks and let those devices go with comfort and ease and, most importantly, satisfied end users.   In most circumstances, our users initiate device offboarding via Self Service. The policy becomes available when their computer record is scoped to our voluntary offboarding department. All institutionally licensed software and configurations are removed. Local student user accounts are elevated

In this blog we will assume you have Jamf Pro, Jamf Connect, and Jamf Protect or a combination of those and look at it through the lens of Microsoft and Jamf Device Compliance, but the exact same workflows can be achieved with the integration between Jamf and Google BeyondCorp, which was added in Jamf Pro 10.45!     For several years now, Jamf Pro has allowed organizations to integrate with Microsoft Azure AD and Microsoft Endpoint Manager to provide Conditional Access to Apple endpoints; initially it was only available for macOS using the Conditional Access feature in Jamf Pro, but Device Compliance for iOS was then added some time later.   Recently we received the deprecation notice for Conditional Access for macOS; Jamf now offers an alternative solution with macOS added as a supported platform to Device Compliance in Jamf Pro, which is good news!   With Conditional Access for macOS, Jamf Pro offered basic information like the state of FileVault, the firewall, a