Inherited a Jamf Pro deployment and looking to upgrade a piece of software that is being pushed out. This is what the policy looks like:GeneralEnabledTrigger: Recurring Check-InExecution Frequency: One per computerPackagePKG file, action InstallMaintenanceUpdate Inventory If I want to upgrade this with a new package, do I need a new policy with the same scope and disable this one? Or can I put a new PKG file in there?Thanks for any nudges in the right direction!

I am interested in how we can automate some reports or feed data into a SIEM like Splunk of Jamf Connect activity.  The most important data point is when a user uses the privilege elevation feature.  Does anyone have any experience or advise on this? Thanks in advance,   -Pat

Shifting compliance checks left—giving control directly to end users via Self ServiceAs part of improving endpoint security and reducing operational overhead, I built a macOS compliance dashboard using SwiftDialog and Jamf, available to users via Self Service.This solution focuses on managing third-party vendor applications that are not updated through Jamf VPP/App Catalog or Installomator. These apps are maintained using internal PKG deployments, with the script enforcing organization-defined required versions.From an admin perspe

Apologies if this is covered elsewhere and I’ve missed it!I’ve noticed that with the latest version (15.1.1) of Keynote, Numbers and Pages, the new version installs, and the old version remains. Using my Mac as an example, I currently have Numbers 15.1.1 and 14.6.2 installed. Trying to sort out a way to remove old versions from our Macs using Jamf Pro? I’ve tried a few scripts that claim to work even on Apple apps,  but haven’t had any luck. 

Hi all,I’m looking for guidance on how to fully automate macOS updates across our company-managed Mac devices.We currently manage our Mac fleet using Jamf Pro version 11.24.1-t1769438062288. At present, macOS updates are being deployed manually through Self Service using packaged installers, but we would like to move to a more reliable and scalable automated process.So far, I have tried the following methods, but I have not been successful with either approach:Mass Action Command Managed Software UpdatesFor context, all company devices are:Enrolled via PreStage Enrollment Supervised Configured with Bootstrap Token allowed and escrowedIf anyone has successfully implemented a fully automated macOS update workflow in a similar Jamf environment, I would greatly appreciate your advice on the recommended process, prerequisites, or any known limitations.

Hi Jamf Folks,I use nginx file distrubtion server. It works, but I have errors in the nginx log everytime I install something via Self Service +```2026/02/17 12:54:16 [error] 13387#0: *1 open() "/<pathToPkg>/Package.pkg/index.bom" failed (20: Not a directory), client: <ip-addresse>, server: webserver.de, request: "GET /<pathToPkg>/Package.pkg/index.bom HTTP/1.1", host: "webserver.de"```When I download it via webbrowser or wget, I do not get an error.here is my nginx.conf```worker_processes  1;events {    worker_connections  1024;}http {    include mime.types;    default_type application/octet-stream;    server {        listen 443 ssl;        http2 on;        server_name webserver.de;        ssl_certificate     fullchain.pem;        ssl_certificate_key privkey.pem;        location /Packages/ {            alias /<pathToPkg>

With the recent release of the M5, we’ve been trying to connect MacBook Pro’s to our 802.1x secured Wifi Network.We’re using the same configuration profile that has worked on the rest of our fleet.  Our network team have looked at the logs and have determined the issue is on the endpoint side “WLC keep sending EAP-TLS request and no response from client”.Wondering if anyone else has encountered this issue and what if anything was done to fix it.Thanks

HiWe use Mac and Windows with Outlook in our schoolIn the group policy I can configure default fonts for Windows How can I configure Default Fonts for Mac for all the users in the organization Kind regards,

Am working on a project to migrate to Blueprints in Jamf Pro as much as I can and something I’m finding exceptionally frustrating is how to plan for future management of Apple Intelligence. We disable it by default for a host of privacy/protection reasons, but everywhere I look I see that the current tools will be deprecated (or were with 26.4) and there’s zero guidance on how to manage this going forward.Currently resorting to some Custom Settings payloads but am under the impression this will soon also not work after 27.0’s release. Couldn’t find anything searching the boards, but would love if I could get clarification from the community on if I’m correct or not in my concern or where to look for future-proofing.

We’ve been using the jamf provided MakeMeAnAdmin shell script for temporary user account elevation without any issues for a while, but as of the last week or so it appears to have stopped working. jamf/MakeMeAnAdmin: Provides temporary admin access for a standard user via Jamf Self Service This has failed on two separate devices, one 26.2 and another on 26.4.  When reviewing logs, it mentions a group no longer being found.  I’ve looked around on Reddit and these forums and haven’t seen any other mentions of this issue recently, so figured it would not hurt to check in with the community. Typically we have been using the script via the Self Service app with no issues.  I know Self Service + is coming fast - could this be related?  Or is this just awkward timing on that front. We don’t use Jamf Connect, but putting a partial

In Acrobat Pro and Adobe reader the Generative AI upload is enabled by default and you have to opt-out if you don't want to do that. Here for more: https://helpx.adobe.com/acrobat/using/generative-ai.htmlFollowing script can be deployed with a policy and creates two plists which disables Generative AI in Adobe Reader and Acrobat Pro. #!/bin/sh # Adobe Reader /usr/libexec/PlistBuddy -c "Add :DC dict" /Library/Preferences/com.adobe.Reader.plist /usr/libexec/PlistBuddy -c "Add :DC:FeatureLockdown dict" /Library/Preferences/com.adobe.Reader.plist /usr/libexec/PlistBuddy -c "Add :DC:FeatureLockdown:bEnableGentech bool false" /Library/Preferences/com.adobe.Reader.plist # Adobe Acrobat Pro /usr/libexec/PlistBuddy -c "Add :DC dict" /Library/Preferences/com.adobe.Acrobat.Pro.plist /usr/libexec/PlistBuddy -c "Add :DC:FeatureLockdown dict" /Library/Preferences/com.adobe.Acro

Hey Jamf Heroes! I need some of that superhero good will.Going wide on my PSSO Pilot today. Testing went very smoothly, but we all know that sometimes the difference between dev and prod can be expansive.(Yes, I copied and pasted this from Slack. ;-)

I’m looking for a good printer for home use and would like some advice. I mainly need it for printing documents, school work, and occasional color pages. My old printer has been slow and expensive to maintain, so I’m thinking of upgrading.What printer would you recommend for reliable and cost-effective home use?

We set our users to be Standard users on their Macs, and which prevents them from being able to delete Wi-Fi SSIDs. Sometimes, we've needed to allow them to do so, so we have a script in Self Service that will delete a known SSID when run.#!/bin/sh ## Get the wireless port ID WirelessPort=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $NF}') ## Run a SSID removal if its present networksetup -removepreferredwirelessnetwork $WirelessPort "NAMEOFTHESSID" 2>/dev/nullBut we've run into a situation where a work-from-home user wants to delete an SSID from their home network, etc. I was wondering if there's a way to a have a script that would allow the user to choose from existing "preferred wireless networks" SSIDs and choose which one to delete? That way, we could just have one "Remove Wi-Fi Networks" item in Self Service, and users could remove whichever one they want.

I am seeing a Keychain not found alert after I recently started enforcing OneDrive Desktop and Documents sync. This just happened on my newly enrolled test Mac after I registered platform single sign-on. The alert appeared as I was logging in to OneDrive. There is actually an entry in Keychain. I looked up the ID shown in the screenshot. Reset to Defaults is NOT the right choice. I found that unlinking the Mac from OneDrive and then signing in again helps, but this prompt came up as I was in the process of logging in. We use platform single sign-on so there is no password prompt. Has anyone else seen this and solved it? 

So as we approach the inevitable coming of Self Service + we have noticed something that would be great to remove if possible to bypass some potential issues.In the Mac menu bar the Self Service + icon does not go away no matter what at the moment, and it also has a “Get software” option in the menu that does not apply to us. So I have the following questions:1: Is there a way to automatically hide or disable the icon from showing up?or2: Is there a way to customize what menu options the icon has so that it is more applicable to different use cases where optional software deployed through self service is not a thing? 

We would like to restrict our admin user from installing any applications via installer files (pkg or dmg) on their Mac. There is a functionality in the configuration profile under Restrictions that allows us to check "Restrict the App Store," but this only prevents users from opening the App Store. They can still download package files from the web and install them. Is there any way to restrict admin users through a script or configuration profile?

I’m currently rebuilding our enrollment process and testing everything in a Jamf sandbox. So far it mostly works as expected, but I’ve run into an issue that I can’t fully explain.This is how my flow looks right now.macOS 26.2In PreStage Enrollment I deploy: JamfConnectLogin-3.5.0.pkg dialog-2.5.6-4805.pkg (used for Setup Your Mac) icons.pkg (icons used by Setup Your Mac) When it comes to configuration profiles related to Jamf Connect, I’m using: Jamf Connect License Jamf Connect Login (login window configuration) Jamf Connect Menu Bar The flow itself:I start the Mac, choose Enroll, and no local account is created during enrollment. After configuration finishes, I get the Jamf Connect login window (which is exactly what I want and how it works in production). I log in with Okta credentials, the local account is

Hi everyone,I’m trying to set a default font in Microsoft Outlook (macOS) using Jamf Pro, and I’m running into some trouble.By default, Outlook uses Aptos, but I’d like to change it to Book Antique, which is already available on the device.What I’ve tried: I attempted to use the 3rd-party tool OutlookFontPoke by Paul Bowden @ Microsoft. Here’s what I did:• Deployed the OutlookFontPoke script and TemplateRegDB.reg via a package (both located in /private/tmp/OutlookFontPoke-master).• Created a policy in Jamf that:• Extracts the current logged-in user• Fixes permissions• Run the command as that user: sudo -u "$loggedInUser" /private/tmp/OutlookFontPoke-master/OutlookFontPoke 'Book Antique' '11.0pt' 'black' Issue: Despite several variations of the above, I keep getting this error in the script logs:

Using Escrow Buddy. Its rotating keys as expected, but the keys are not working to unlock the disk. I have run sudo fdesetup validaterecovery and it returns with false. I re-run the Escrow Buddy policy and get a new PRK, still says the new PRK is false. Anyone experience this? It seems like no matter what, even though Jamf is saying the PRK is Valid, its not escrowing properly.

Hello all,  Today and last week Friday, we’ve been seen users get the Jamf Connect Keychain pop up. Computer will show JC 3.5 is installed and it’s getting the latest Self Service + and the popup reoccurs on restart.  I’ve opened a ticket but wanted to reach out here and see if something clear and apparent is happening.

Hello,Google is our IdP for logging in to Jamf Connect Login. I am using Self Service+ which states that the local password is “In Sync”. If I change a users password in Entra (which then will sync to Google Workspace), the “in Sync” does not go away or update ever. If I were to reset the password locally though Self Service+ using the menu bar drop down (opens Entra password change portal) it then states that the password is out of sync and that I need to login again to Self Service+. Great! I login, it accepts the new password, and states that the password is “in Sync”. I am never prompted for the old password.If I log out of the user and log back in with the new password, I am successful at the Google SSO pane, but it then has a smaller Jamf Connect pane that asks for valid credentials, which is the previously set password. The local password will not update despite “being in sync”.I have to be doing something fundamentally wrong, any help would be really app

Has anyone started down this road of managing MacBook Neo’s with JAMF School? I have started testing and have encountered a couple of annoyances thus far. We are generally a Microsoft shop and use JAMF School to manage student iPads. As such, we are using JAMF Connect for student login to the devices on these devices as well.There seems to be an issue with the Neo’s not wanting to reconnect to wifi after a restart. Also, Keychain is asking for access to JAMF Connect password after installation. We have this same setup working on 10 iMacs at one school and they do not ask for Keychain access.Any thoughts or shared experiences would be great. Thanks.

Hello All,We’ve just started to implement Jamf Pro in our company. Nearly all configurations are completed except sending compliant information to Microsoft Intune. We have to do this because we’re using Azure (Entra) Conditional Access rules in our company. If a macOS device is not compliant it cannot reach internal company resources. Just a simple rule. Steps CompletedJamf <> Intune compliance partner connector connected successfully. Microsoft Device Compliance configuration policy prepared in Jamf Policies -https://learn.microsoft.com/en-us/intune/intune-service/protect/jamf-managed-device-compliance-with-entra-idProblem SummaryAfter enrolling to jamf, we are trying to sign in to Company portal and jamf compliance popup appears. Then we

Hi everyone,I'm working on upgrading our Mac fleet from Jamf Connect 2.39 to 3.7.1 and running into some cleanup issues I'd love some guidance on.Environment:Jamf Pro 11.26.1 macOS 15 Sequoia Apple Silicon and Intel endpoints Devices enrolled via Apple Business Manager (ABM) using Automated Device Enrollment (ADE) Identity Provider: Azure AD / Entra IDCurrent situation: All of our managed Macs have Jamf Connect 2.39 installed. I have already built and validated a Jamf Connect 3.7.1 configuration profile in Jamf Pro and scoped it to a handful of test machines successfully.The problem: When pushing JamfConnectLogin.pkg (3.7.1) via policy, it does not remove or replace the existing 2.39 installation. After the policy runs I can confirm:Jamf Connect.app (2.39) remains in /Applications The 2.39 men