• Starting as early as the next major software release, Apple operating systems (iOS, iPadOS, macOS, watchOS, tvOS, and visionOS) might refuse connections to servers with outdated or non-compliant TLS configurations due to additional network security requirements.• Requirements: Servers must support TLS 1.2 or later, use ATS-compliant ciphersuites, and present valid certificates that meet ATS standards. For complete network security requirements, reference the developer documentation• Link:  https://support.apple.com/en-us/126655

We got Defender working on our Macs about a year ago - deployed via JAMF Pro and with configuration profiles. We are not bound to the domain and do not use JAMF Connect.I am trying to follow along with Microsofts documentation (Onboard and offboard macOS devices into Microsoft Purview solutions using JAMF Pro | Microsoft Learn) which seems to be written for setting this up from scratch rather than adding it in to an existing setup. It seems to be doing something as we are getting better feedback under Device Onboarding, but still not making much progress. Here is an example of the details in Device Onboarding  in Microsoft Purview with the error messages before and the more informative messages after I have created the configuration profiles in JAMF from the above guide:

We use Jamf Pro Cloud with Jamf Connect (for account creation + Entra ID password sync).After enabling “Use Self Service+ as the default end user app” in settings:Old Self Service was upgraded to Self Service+ on existing Macs Jamf Connect was removed, menu bar now has Self Service+ icon instead On new enrollments, we install Jamf Connect 2.45.1 → now it’s there alongside Self Service+I can’t find clear docs on this — so:Questions:Is Self Service+ intended to replace Jamf Connect completely? If yes, should we skip installing Jamf Connect post‑enrollment? Or should we move to Jamf Connect 3.x? Any official migration guide for 2.x → 3.x with Self Service+?Any experience or official Jamf resources appreciated.

What’s NewWe are excited to announce the next step in helping admins configure their user’s experience in Self Service+.  With this extended beta release, admins will be able to configure the order of items in the left navigation bar, the presence of sections on the home page, and the appearance of the Self Service+ menubar item. With this first phase of the release, these three options above are configurable by configuration profile using the schema included in the release notes.In addition to this change, we are also currently working on a blueprints implementation within Jamf Pro to make changing these settings even easier.  As we work through your feedback on these changes, we also want to be bringing even more customizations to help you bring a more tailored experience to your users. If you have any ideas for Self Service+ experiences that you would like to configure, we ask that you also share your ideas for us to consider as we priori

Hi everyone, I’m new here, so if this has already been asked before, please go easy on me 😅 Here’s the situation: I have a client who wants to prevent their developers from losing time every time they switch to a new machine (setting up their development environment, SSH keys, cloning repositories, etc.). Right now, their servicedesk team spends almost an entire morning preparing each device… but here’s the catch: instead of rebuilding the environment cleanly, they’re cloning everything from the user’s old machine. Personally, I don’t agree with this approach. I believe it’s better to go for a clean and automated process: regenerate SSH keys, clone repositories from Git, and configure the environment from scratch. So my question is:Is there any common approach or script within the community to handle this kind of scenario?For example, something that, using the user’s credentials, can generate SSH keys,

Trying to deploy device based certs to Non Domain MacOS devices, which will automatically connect to wifi. We have the following configured: AD (Ghost object created for the MacOS Device) ADCS (separate certificate template created for Mac) NPS NDES When we deploy the cert from Jamf, the cert deploys and installs on the device and I can see it’s issued with the correct template in ADCS. When we try connecting to wifi, we see ‘The specified user account does not exist.  What am I missing? The domain controller is 2016, ghost object created, network policies created, we just can’t seem to bind the cert to the ghost object therefor it does not authenticate. Windows auth is obviously fine via the same NPS server. Any suggestions? 

I was wondering if Jamf Hero’s is still open? Is there a application process?

We are currently in the process of implementing Jamf Pro in our company environment. So far, we have successfully integrated several scripts, SMB shares, and other configurations, and everything was running smoothly.As the next step, we attempted to set up Jamf Connect in order to integrate a SAML authentication flow via our Entra environment. The goal was to allow users to log in with their Entra credentials during a fresh macOS installation.However, after configuring Jamf Connect, we started encountering a critical issue. The Microsoft 365 login window appears as expected, but after a few seconds, the entire Mac screen goes black and becomes completely unresponsive. The only way to recover from this state is by manually restarting the device.Additionally, since this issue started occurring, our previously working scripts and configurations are no longer functioning as expected.Has anyone experienced a similar issue or has any suggestions on how to troub

Does anyone has a way to setup MS Outlook 365 as default mail app? If you want to setup it manually you have to do it in the Mac mail app, although you never used it. I have to send out something to the organization with an mailto: link and I do not want all people calling me to ask why Mail is opening instead of Outlook. Additionally it would be nice to set default programs via config profile in Jamf pro. Thank you for your help.

Any had this issue , devices where PSSO was already registered, users were prompted again to register. When they attempted to register, the process failed, and the devices entries are removed from Azure, resulting in loss of all organization access.we had to re-register the devices through System settings > User and Groups > Network account server > Edit, and then click repair.Note: We use Secure Enclave as authentication type, No changes where done at profiles

I’m well aware that there’s a big “old dog/new tricks” aspect to my reticence to move away from configuration profiles to blueprints, but my primary hangup with even exploring Blueprints too much is the limited scoping capabilities. In particular, I find it really useful with a configuration profile to just be able to exclude a single computer from the scope to remove it for testing or other reasons. But with Blueprints being entirely smart group dependent, the only way I know of to do that would be to modify the smart group to not include a computer name, or maybe link the smart group to a static group, but that feels janky. Help me think through this please.

Was this a feature add that administrators have been clamoring for over other features or is this just another case of everything needs to have AI jammed into it?

I have searched AI and here but I can’t find anything that matches (or works) for our organization.  I would like to have (as part of the pre-stage enrollment) the Mac device be renamed to a prefix + s/n.  The configuration profiles logs all show MacBook Pro or Users’s MacBook Pro and not the naming scheme that is approved for the company.   From what I understand, you can’t go b ack and rename machines in any log. and modify it.                               

Hi, First time poster here.We have a fleet of student iPads that we're managing through Jamf, and that have Microsoft Teams deployed on them for classwork.The students have learned that, if they tap "+ Add Account" within Teams, they can connect a personal Teams account within the app, and have been using this to send notes in class without oversight.We've been able to limit the Windows Desktop Teams App so that it'll only allow accounts on a specific Teams "tenant ID" to sign in - and we're hoping that a similar capability is possible in the iOS Teams app via Jamf, but have had trouble finding any information about it.Is this something that anyone has managed to accomplish, or has advice about?   I'm relatively new to Jamf, so step-by-step guides are greatly appreciated.

Can get some help with Packaging Xcode. We currently use Mac apps but it a hit and miss. I will like some help on the best practice to packaging and maintaining this app. 

We’ve been using Jamf now for almost 10 years and are still struggling with users that don’t update their computers and mobile devices. So now we’re thinking of activating Software updates in Jamf. When we choose activate/enable it we get the message bellow. Is it just to continue or could it cause problems?

Unable to complete file upload. fiie contents does not match file type in Jamf when uploading an automated device enrollment token from apple business manager

The documentation from Cisco is pretty abysmal, it took me hours to finally make sense of it all. I made my own guide and an all-in-one config profile to use for deployment via Jamf. I hope this helps anyone in the future.  https://scribehow.com/shared/Create_Cisco_Secure_Client_Jamf_Installer_pkg__ODli2lu5QiyylY4S5aCvMQ

As of macOS Sonoma 14.4 using "/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport --getinfo" no longer returns info about the active Wi-Fi connection. If you want to collect the active SSID for macOS 14.4 or later you can use the wdutil tool and here's an EA to do that:    #!/bin/sh # EA - ActiveSSID # # Note: Using wdutil instead of networksetup so I don't need to know what # interface is Wi-Fi # Returns the currently active SSID activeSSID=$(/usr/bin/wdutil info | /usr/bin/awk '/SSID :/ { print $NF }') echo "<result>$activeSSID</result>"  

Hi,with MacOS 26 Tahoe Apple introduced the new Simplified Setup for Platform Single Sign-On. Both Jamf Pro and Jamf School support this new feature in theory, but I was not able to get it working with Jamf School using Microsoft Entra.Jamf School support says that it should just simply work, but both Jamf and Microsoft say that it is not yet supported (see Jamf and Microsoft).Has anybody been successful?

All the existing devices in our system stopped updating inventory on 21th-26th February. Any devices added since then are updating ok. How do we rectify this bug and what caused it? We cannot delete and start again on 200 devices.

Has anyone had to renew the built-in CA in Jamf Pro before and if so, mind sharing your experience with it?  I'm primarily curious how many devices ended up having to unenroll and re-enroll as a result of MDM profiles failing to renew.  With over 11,000 Macs in my environment, the suggestion shared by Jamf support by disabling automatic MDM profile renewals before renewing the built-in CA, then issue MDM renewal commands manually to no more than 100 devices at a time isn't realistic in my environment, especially when both the smart and the static computer groups aren't designed to group devices strictly by quantity into groups of 100 that easily.

We are deploying Xcode as a Mac App (VPP).  Apparently after updates it is requiring admin creds to accept the End User License Agreement.  I am stumped on how to fix this one.  There’s not much I think we can do with Mac Apps.-Pat

Apple's Terms and Conditons have been updated ...   

Hi everyone, we are currently exploring the Jamf Security Cloud and it’s capabilities with Jamf Trust app.So far we were able to create a connection between our Jamf Pro instance to Jamf Security Cloud, along with Entra ID for IdP integration.Current configuration deploys a Jamf Trust activation profile to end devices via Jamf Pro. However, I was wondering if the Jamf Trust app automatically gets installed via the activation profile. Or is there another process we need to configure to deploy the Jamf Trust app to end devices (for Mac and iOS). I would appreciate any expert’s opinion on how a typical Jamf Security Cloud and Jamf Trust configuration and deployment would get configured on end devices. Thanks in advance!