This article is based off of the presentation at JNUC given by ​@tommypatzius , ​@Jordy-Thery and ​@glennu  Our session at this year’s JNUC 2025 was designed to present a list of helpful tools available to Mac Admins of all skill levels and backgrounds. We know that everyone’s experience with Apple device management is different, so we’ve pulled together a collection of tools that are approachable, practical, and, in many cases, free. Many of them have a low learning curve, making them accessible whether you’re brand new to managing Macs or have years of experience. Our goal is that everyone walks away with at least one new tip, trick, or tool they didn’t know before. To make things clear and easy to follow, we’ve divided the tools into categories by function: Apple apps, Jamf tools, maintenance, setup & customization, notifications & support, and inspection tools. We took a closer look at a few specific highlights—Jamf Helper Constructor, Self Service+, and IBM Data Shift—befo

This guide represents the synergy of the latest technologies from Apple and Jamf. It harnesses the power of the new Declarative Device Management (DDM) framework built into macOS 15 (Sequoia). This modern approach is unlocked by Jamf Pro version 11.8.0 or later, which introduces Software Update Blueprints. Critically, this entire workflow is powered by the Jamf Account SSO, which connects your instance to the cloud micro-services required for Blueprints to function, creating a truly modern administrative experience.The guide outlines the modern, three-part strategy for managing macOS 15 and newer in Jamf Pro. It leverages DDM via Blueprints for a reliable, automated workflow and is based on enterprise best practices for both aggressive and controlled rollouts.PrerequisitesBefore you begin, ensure your environment meets these minimum requirements:Jamf Pro: Version 11.18.0 or later. Target Computers: macOS 15 (Sequoia) or later. Device Supervision: Devices must be Supervised. Administrat

This October, I’ll be heading to Denver, Colorado, for the Jamf Nation User Conference (JNUC 2025). It’s a week that brings together community, learning, and all things new with Jamf, and this year, I’m especially honored to be attending as one of the recipients of the JNUC Diversity Sponsorship. The Sponsorship ExperienceThe Diversity Sponsorship program reflects Jamf’s commitment to amplifying the voices of underrepresented individuals in the tech industry. Now in its ninth year, the program selects up to 10 individuals to attend JNUC with full conference registration, a travel stipend, and access to exclusive networking opportunities. Being chosen for this year’s sponsorship is both humbling and energizing. It’s not just about attending sessions or seeing the latest product announcements—it’s about being recognized as part of a broader effort to ensure diverse perspectives are present in conversations that shape the future of Apple administration and security. Why I AppliedThis will

 This guide will walk you through setting the local macOS account pictures for end-users via Jamf Connect  Requirements: Jamf Pro Jamf Connect Formatted ID Token Path setup in Jamf Connect Login Config (/private/tmp/token) Azure Storage Blob Email addresses of users follow a pattern for all users (john.smith@myorg.com, jsmith@myorg.com, etc..)  Tested with: Azure AD and Jamf Connect Test User: John.smith@ericsontech.com Steps: 1. First step is to get all of your user images. To make this easy on yourself name them the same as the user's email address. So for John Smith his email is john.smith@ericsontech.com I would name his image as john.smith@ericsontech.com.png and upload that image and all other user's images to an Azure Storage blob. Example:   2. Setup this script to run via Jamf Pro. I have mine setup to run via Jamf Connect Notify Note:  You will need to update this with your Azure Storage Blob url  curl -L "https://myazureblobname.blob.core.windows.net/mdm/$EMAIL.png" -o /tmp/

Have you ever had to manage devices from a DEP instance you don’t control or even own? Or send DEP or BYOD devices to another campus where they need to be managed with a different MDM? This was the situation we encountered last year, and here’s how we solved it. Institutional ContextOur institution has expanded globally, adding new international campuses in Spain. These schools serve students from K–12, with management needs that differ significantly from those in the U.S. Because of local legal and operational differences, we chose to build independent technology stacks for each campus, modeled after our flagship U.S. campus. This provided consistency while allowing for flexibility.U.S. campus: Jamf Pro + Protect; BYOD model for students, DEP-managed devices for staff and faculty. Spanish campuses: Jamf Pro + Protect + Connect + Safe Internet; all DEP-managed, school-owned student devices.This design gave Spain the flexibility to support younger students in a day-school environment, w

Before we get too far into this I want to say one thing. I am not a medical or mental health professional. I’m a Jamf Engineer who has thought a lot about this but by no means am an authority on the subject. The following article is my reflections and not any type of mental health treatment. Now that that’s out of the way…here we go! Nobody goes to school to be a Jamf Engineer or Admin. The vast majority of us ended up in this field because we like to tinker with things, eventually break them and are forced to fix them without any help or education. For a lot of us, we ended up in this field by doing other things in a job where we do have formal training.When you fix what you’ve broken, you feel great. But when you can’t fix it, some of us give up, others seek advice, some keep plugging along to find the solution.  But what happens when you end up in a corporate environment and you have to tackle things that you inherited, need an upgrade or you just need to do maintenance, most of it

This article and many others can be found on Rich Trouton’s blog Der Flounder As part of Apple’s unveiling of Declarative Device Management (DDM) at WWDC 2023, Apple announced that DDM management included the ability to deploy MDM configuration profiles using DDM as the delivery mechanism in place of using MDM to deliver the profiles. Jamf Pro’s Blueprints leverages this capability to support device restrictions.Let’s see how this works using a device restriction configuration, using the example of setting the following Apple Intelligence management functions to false in order to block the corresponding Apple Intelligence functions on macOS:   Restriction Setting available in version Description Key Key value Default setting in macOS Allow Image Playground macOS 15.0.0 If key value is set to FALSE, prohibits the use of image generation. allowImagePlayground Boolean TRUE Allow Writing Tools

In the MacAdmin world, few names command the kind of respect Charles Edge does. Not just for his technical expertise, but for his relentless curiosity and generosity. After his unexpected passing in 2024, I found myself reflecting on a behavior I learned through Charles's actions. A mindset I've come to call the Edge Methodology. It's not a framework or a management technique in the traditional sense. It's a response to fear. A refusal to fake confidence in things not yet understood. And it's inspired by the way Charles lived: by digging in, learning with humility, and lifting up others in the process.  The Problem: Fear of Not Knowing At some point in our careers, many of us have worked in environments where saying "I don't know" felt like admitting defeat. Where curiosity was mistaken for incompetence, and asking questions risked being seen as unqualified.   I've definitely been there.    In those spaces, people would often bluff their way through techni

I don't know about you, but my in-person conference skills need a brush-up. For me, it's been a little over three years since my last in-person. So here are some tips I've put together with some help from a few friends. If you are turning up on Monday before dinner, check the JNUC Slack Channel for any pre-conference get-togethers Monday night. The same is true every night. You can sleep when you get back home. This may be the only chance you get to talk to these people for some time. Go to the Keynote. It's the start of the conference, and at JNUC it starts well. I know it might be hard getting out of bed after the long flight the day before but do it. In fact, get into the conference venue for breakfast and a gossip every day before the first presentation. Talk to people. Don't be afraid to talk to anyone. The "hallway" track can be a great part of the in-person experience. Ask questions. Seriously, the presenters want questions and hope all the attendees go away with

It must be 8 or 9 years ago that I started supporting customers with ZuluDesk (now Jamf School). This was my first step into the device management world. Before that, I was a repair technician.  As my curiosity grew, I was lucky enough that my employer allowed me to do the Jamf 100 and 200 courses. Managing iOS devices is all good and well, but with Mac you need a little more tools. Things like setting a wallpaper sound easy, but they actually require a bit more work than I expected.   Welcome to the world of Mac Admins! I discovered that for everything I wanted to figure out how to do, there is usually someone with the same question, and maybe they’ve already found a solution for it. Coming in as a completely new Mac Admin, it might be a bit difficult to find your way. But knowing the right people, tools or places to ask for help are really valuable and make all the difference.   So I thought, why not try and create some sort of list with starting points for f

Not too long ago, I wrote a Tech Thoughts article covering some of my favorite community resources. I wrapped up that post by mentioning a couple of conferences that might be worth your time. Well, it’s time to revisit those — because conference season is upon us! This list is heavily inspired by Jamf’s very own Armin Briegel whom has a fantastic page listing conferences and resources at scriptingosx.com/conferences — and he keeps it well updated!    A Quick Look Back  My personal favorite from last year was JNUC 2024 in Nashville. It was my second time attending, and I already knew a few folks, which made the experience even better. The networking opportunities are truly the highlight. Talking to like-minded professionals and getting insights into how different companies approach challenges — sometimes in very different ways — is incredibly valuable. Also, a special shout-out to the amazing @MusicCityMac Alan West, who was so welcoming and

Death by PowerPoint started in the living room Willis H. O’Brien was a famous Hollywood special effects artist known for his pioneering work in stop-motion cinematography. While we may look at his special effects in the movie King Kong from 1933 as outdated compared to the special effects we see in contemporary movies, his work is still relevant. He gave his audience the illusion that a giant gorilla not only moved but climbed the Empire State Building, then the tallest building in the world. And he did it one frame at a time. Unlike stop-motion, though, special effects are nowhere near as tedious with today’s tools. Whereas O’Brien spent 150 hours to create one minute of animation on film, today, we have tools like Magic Move that generate animated transitions between slides in just a few seconds. Transitions and animations important for presentations. Why? A transition is a change from one slide to another. It signals a change in thought to the audience. But a good transition should

If you haven’t read part 1, then click here and go back and read it. The next portion of Apple Intelligence is now shipping with macOS 15.2 and iOS/iPadOS 18.2. We now have Image Wand, Image Playground, Genmojis, ChatGPT integration, and a little more. To soothe all concerns quickly, Apple Intelligence is NOT powered by ChatGPT. It will never send data off to ChatGPT without first asking permission and that integration must also be enabled. Ok, now that that’s out of the way.Apple Intelligence now features image playground, Genmoji and moreWhat’s great is that all of these features have a way to be blocked. Apple has provided the following configuration profile keys for the preference domain com.apple.applicationaccessallowImagePlayground allowImageWand allowGenmojiAnd new as of Dot 2 releaseallowExternalIntelligenceIntegrations allowExternalIntelligenceIntegrationsSignInThe two new keys, as of the Dot 2 releases, must be deployed on the Dot 2 releases and higher versions. They may not

 Outlook Search is Broken  Problem:  When you search in Outlook, you get "No Results," even when you know the  email is there.  Solution:  Force the Mac to rebuild its search index for Outlook. Quit  Outlook .  Go to  System Settings  and navigate to  Siri & Spotlight .  Click the  Spotlight Privacy  button.  In a new  Finder  window, click Go → Go to Folder, from the menu bar. Paste this path  and press Enter: ~/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15  Profiles Drag the  "Outlook 15 Profiles"  folder into the Spotlight  Privacy list.  Wait about a minute, then click on the folder you just added and click the  minus  button to remove it.  Mac will start re-indexing in the background. It might take a few hours, but search  will work again when it's done. Mac is Slow After Update  Problem:  Mac feels sluggish and shows the spinning beachball a lot after updating to  Sequoia  Solution:  This is often temporary. Here are the main  things to check. Wait it Out:  Af

Many organizations recommend or prescribe a specific web browser for their users. The user can change the setting in the user interface, even though it is not really obvious where to look. Many MacAdmins would like to pre-set this browser and the default during enrollment. However, there are several challenges associated with this in macOS. It would be really nice if Apple provided some means to manage this with a configuration profile. If you agree, please file feedback with your AppleSeed for IT account. While we wait for that, what can we do?   Use the browsers Most third party browsers have a built-in command option to set themselves as the default browser. Most Chromium based browsers (Google Chrome, MS Edge, etc.) can be launched with the --make-default-browser option: open -a "Google Chrome" --new --args --make-default-browser open -a "Microsoft Edge" --new --args --make-default-browser For Firefox, the options are different: open -a "Firefox" --new --args -silent -nosplas

The Jamf 400 course is the highest certification level in the Jamf training program and is designed for administrators who want to deepen their knowledge in scripting and automation. This course not only requires a thorough understanding of Jamf Pro and macOS but also the ability to independently analyze and solve complex problems.    What to Expect in the Jamf 400 Course?  The Jamf 400 course covers advanced topics and practical challenges. Key focuses of the course include Automation and Scripting:   Developing and implementing advanced Bash scripts and API calls to automate administrative tasks.  Prerequisites and Target Audience  To successfully complete the Jamf 400 course, intermediate to advanced scripting skills as well as familiarity with the Jamf API are required. The course focuses on deepening these topics and applying them in complex scenarios.  The course is designed for Experienced Jamf administrators who are already familiar wit

I’ve been silly busy learning lots of non Apple related stuff. However there does seem to be a need for a how to guide of sorts on how to implement Jamf’s new SSO requirements.  Back in the day, you set up a SAML integration from your IdP to Jamf Pro. Access group of users on one side, Jamf user accounts on the other and you called it done.  Jamf is changing how all this works. Instead of an integration per app, they are replacing everything with one OIDC connection from your IdP to their Jamf Account page. Every single SaaS app you then get from Jamf will then already be enabled for SSO, you just have to put the accounts in place. Essentially authentication becomes a once and done and the gating is done on the application side.  Any other speculation as to intent from Jamf here I think is complete hogwash.  This article has a Okta focus, because that’s the IdP I use. Your mileage will vary with other providers.  Before I get into the technicals I do need to po

Microsoft has announced plans to move storage of the Workplace Join Key out of the user’s Login Keychain and into Apple’s Secure Enclave:    Microsoft Enterprise SSO plug-in for Apple devices - Microsoft identity platform    Announced in March 2024, Microsoft Entra ID will be moving away from Apple’s Keychain for storing device identity keys. Starting in Q3 2025, all new device registrations will use Apple’s Secure Enclave. There will be no opt-out of this storage location.  Applications and MDM integrations that have a dependency on accessing Workplace Join keys via Keychain will need to start using MSAL and the Enterprise SSO plug-in to ensure compatibility with the Microsoft identity platform.    In the same document, Microsoft provides guidance on how to test the Secure Enclave today to ensure the change will be compatible with your environment when the change goes live:   If you would like to enable Secure Enclave based storage of

At some point in your career as an Apple Admin, you’ve (most likely) inherited a Jamf instance and said either to yourself or out loud, “Huh, I wonder why they did that. I certainly wouldn’t do it that way” or “That’s not the best practice I was taught”.   Caveat: There’s no such thing as best practice. The better concept is defining the best practice for your environment.   This is where you get to step in and be the hero. It’s your job to take the environment, back it up first. Make sure you backup your instance and sync it to your free Jamf sandbox (If you don’t have one, talk to your rep). Once you’ve backed up and sync’d to the sandbox, I hope you’re noticing the theme here…you can get started with the H.E.R.O. process.   Something not mentioned is the process of writing documentation. DOCUMENT, DOCUMENT, DOCUMENT. Write down everything from the current state, proposed changes, changes you made (with dates), how configs work, workflow processes, and everything else. The 1st thing

Apple Intelligence is finally here now that iOS 18.1 and macOS 15.1 has shipped. However, many people and organizations want to know how they can block it.Apple Intelligence is an Opt-In service from Apple, so unless you Opt-In, there’s no concerns about AI, on or off device.Officially, Apple has provided the following configuration profile keys for the X.1 OSes for the preference domain com.apple.applicationaccess.allowWritingTools allowMailSummary allowGenmoji allowImagePlayground allowImageWandAnd DDM management of Math Notes.There’s also the key allowAssistant to disable Siri, which has become more intelligent with Apple Intelligence.Currently in the X.1 OSes, these are the features which are available and able to be restricted: Siri, Writing Tools and Mail Summary, even though there are controls for the other features not yet implemented.This will allow you to fully block those features. But is that it? …the answer is …No. So even if you implement all the Apple supplied restrictio