Howdy everybody! Time for my annual post about how we all need to get our budgets prepped and ready to go for all the hardware we need to replace that Apple is dropping from its OS Compatibility list! I've modified my previous regex statement to take out the models that were lost to us this year to the latest macOS version. It looks like Apple is taking a big ole axe to the intel macs, minus only a couple of exceptions that seem to tie to the devices that were still being sold at the time of the M1 release. One tricky piece are the specific intel MacBook Pro's that Apple has listed. In that grouping are the MacBookPro16,x models, where x is 1,2 and 4, but not the 16,3 model, so keep that in mind. If anyone has details that contradict that, please let me know here and i'll quickly change the posted regex. I've tested this in my own Jamf instances to verify its returning the data that i'd expect to see, and am confident this will be able to match everything that is no longer supported by

I’m unsure if this effects iPadOS 26.0 as I have just pushed out iPadOS 26.0.1 to devices this week.  We have a Single App Mode profile for TD Snap (though app doesn’t really matter).  After the device is rebooted it looks like on the home screen you can’t unlock the device.Swiping up just shows “No older notifications” but does not unlock the phone and take it to the Single App locked mode to TD Snap.Has anyone else experienced this?This iPad is on iPadOS 26.0.1.  Didn’t have this issue prior to the update.

Good day, all! I have a couple of PreStages set up to configure newly purchased Macs for our environment that utilize JSM to install apps and configure the systems. I want to now tackle Macs already in our environment by having the customers, or our technicians, manually enroll them via the web, chiefly because they’ve already been in use and configured, and wiping them to put them in ASM isn’t an option. I want to utilize JSM to do some configuration and prompt for inventory information (ID, email, location info, etc.). Based on this discussion thread on JSM’s GitHub (https://github.com/jamf/Setup-Manager/discussions/88), I know that it’s possible to use JSM for user-initiated enrollments. My problem is that I cannot find anything on how to actually do it. Anyone out there have or know of a site, documentation, group discussion, or anything that would help me? Thanks in advance!-Terry

Hi all       I’ve got an problem with my Jamf deployment at the moment and the way we use our iPads. Essentially, our filtering and monitoring solution relies upon an app being running in order to re-connect the filtering VPN if disconnected. When teachers restrict students to a specific app or apps, the filtering and monitoring app gets disabled and thus the VPN disconnects.Is there a way to force an app to never be able to be disabled by Jamf Parent or Jamf Teacher? ie. I’d like it so that if a teacher says “Right, no more anything other than Goodnotes” the filtering and monitoring app is not disabled and continues to run. Thanks in advance for any advice with this.

Does anyone has a way to setup MS Outlook 365 as default mail app? If you want to setup it manually you have to do it in the Mac mail app, although you never used it. I have to send out something to the organization with an mailto: link and I do not want all people calling me to ask why Mail is opening instead of Outlook. Additionally it would be nice to set default programs via config profile in Jamf pro. Thank you for your help.

As part of my rollout of platform single sign-on I created a script that checks the user’s password expiration date so that we can alert the user that their password is expiring within 14 days. I want the script to run once a day. I created a launch daemon to run the script. The script and the launch daemon get installed on every Mac with PSSO setup. If the user’s password is expiring on a date that is more than 14 days away the script slimply logs the expiration date and how many days are remaining. The problem I have run into is that if the Mac is not currently connected to the internet when the launch daemon runs the script, there will be no results from the password expiration check with Microsoft. How can I get the launch daemon to run the script again? Currently I have the launch daemon configured to run at a specific hour and minute daily. The deployment script that writtes the password expiration check script and the lauch daemon takes note of the current hour and minute and us

Hello Nation, got a request to install the Cyberark Chrome extension. no problem there. Request was made to per-configure portal URL. Cyberark gave very vague instructions on how to create this. Asking if any one has already deployed this. I am assuming it would be additional keys inside of the  extensionforceintsall  settings but have no idea and have not been able to track at least something similar down. already had the team open a ticket with Cyberark to at least send a vanilla profile. thans in advance for any assitance

Hi All,I need to disable most of the "More Gestures" (third tab of System Pref>Trackpad ) for MN Online Assessments.I have tried a custom Config Profile/user level which I created by uploading the trackpad plist, but while I was able to save it, it would not deploy.The rest of my profiles appear to be working, and the test computer is receiving all other expected profiles.MCX Settings in this area specifically say 10.6 onlySo I'm trying to package using Composer>Monitor File System ChangesThe files it appears to effect are~/Library/Preferences/ByHost/.GlobalPreferences.xxxxxxxx.plist~/Library/Preferences/com.apple.driver.AppleBluetoothMultitouch.trackpad.plist~/Library/Preferences/.GlobalPreferences.plist I have tried packaging and deploying every combination of these filesDeploy via login policy with: FEU, FUT, Fix ByHost Files The settings are not applying on my target computer (and not after logging out and back in) On my package creator computer with all de

Looking for some guidance with Jamf Pro - PreStage Enrollment and FileVault.The issue: In PreStage, we pre-create and hide a local admin account. During setup, the workflow prompts for end-user account creation. FileVault is enabled immediately after the user account is created and the user logs in for the first time. As a result, only the end user is added to FileVault , the local admin account is left out of the FileVault enabled users list. I haven’t found a way to ensure the local admin is automatically included in FV2 during enrollment.Should this be configured differently in PreStage, or would scripting the local admin addition after FileVault is enabled be the right approach?

Looking for an alternative to Carddav to push a shared contact list out to shared devices. We have several shared devices that no one will log into M365 on so sharing a contact list to a group of M365 users won't work. What if I set up a shared M365 account, created a standard contact list, created an Exchange Activesync profile in Jamf, and pushed it out to the shared devices as that shared M365 user? In Activesync settings I could deselect everything except contacts.I could share that contact list from the shared account to the entire department so that everyone in the department had the shared contact list in Outlook when signed in to M365. And for the people with an assigned device and sign into M365 on that device, I could direct them to use the contact sync option in Outlook mobile to copy the shared contact list to the native IOS contacts app.Then, I could delegate access to the shared account to designated people in the department so they can manage the shared contact list that

We started implementing Homebrew packages in our deployments.and there are permissions needed for them to run smoothly. When I try get the CDHASH for the binary, they report as not signed. codesign --display -vvvvvv <binary>code object is not signed at allwhen running tccprofile on our test computer, (tccprofile) it reports cdhash for binary <dict> <key>Authorization</key> <string>Allow</string> <key>CodeRequirement</key> <string>cdhash H"5703c8d7d913bc20bb2e219173cd89267b200400"</string> <key>Identifier</key> <string>/usr/local/Cellar/restic/0.18.0/bin/restic</string> <key>IdentifierType</key> <string>path</string> </dict>my question is how to get the cdhash , or how does apple get it when its not signed?

I know JNUC 2025 in Denver isn’t even out of the gates yet but I enjoy speculating about future things.  Many people seemed to think it was Denver before it was officially announced.  It seems JAMF likes state capitols so far.  My wife is even interested too since she normally pops along with me.  The top 5 most populated state capitols are:Phoenix, AZ Austin, TX (JNUC 2023) Columbus, OH Indianapolis, IN Denver, CO (JNUC 2025)I have no knowledge of where, I just enjoy speculating.  My wife hopes it will be Boston.  I’d hope for Salt Lake City personally.  My bet is on Indianapolis though.  Just a guess though.Any guesses, insights or desires for a future JNUC (next year or beyond)?

Hi all,Anyone have any skills with deploying NinjaOne to Macs through Jamf?I’m having some troubles deploying Ninja to my environment in Jamf pro. I’m deploying the pkg using a policy. I pulled the pkg direct from my Ninja admin site using their method of acquiring the necessary file. I’m also deploying a config file to allow the necessary streamer application to run in the background and quiet install (see screenshot for config.) Every time I deploy through Jamf, the NC Streamer file does not go to the device, and the device does not enter my Ninja console. When I manually install the same pkg without Jamf, the NC Streamer installs fine and the device is added as a local machine. I’m trying to figure out where I’m going wrong with my install and why this is isn’t working through Jamf. It’s just a simple PKG in a policy and a small config file.Please let me know if anyone has suggestions for me or if I need to provide more info.I have contacted NInja support already. They claim it’s a

HiI am a teacher and have two Mac suites, each with 17 machines. Is there a way to store the machine in the cloud as at the moment pupils are tied to always using the same machine, which isn’t always feasible. 

Hello everyone,We’ve encountered problems with personal hotspot in iOS/iPadOS 26.The option to activate it is dimmed on my colleges devices even though she has’t got any restriction profile. Before in OS 18 she used personal hotspot without password without any problem. Now she can (not the normal way) set a password for it but not activate the function/option. And she doesn’t seam to be alone with this problem. In my own case my devices don’t have the problem (have the same profiles as my college), if it matters I’ve always had a password set even when updating to 26.Anyone else encountered the same problem? Does it have to do with Jamf or the OS?       Bottom selection of search results. Password set at the option at bottom of search results. Top option of search results, the normal place.  

Okay we’ve never had this issue in the past.  The prestage enrollment naming requirements ALWAYS take precedence...but for whatever reason, this is not the case.  Workflow to replicate:Move device (currently named PS1-Serial) from one prestage to another  Perform “wipe” command from Jamf Enroll device under new prestage with new name PS2-SerialUnfortunately on step 3, the device ends up with a PS1-Serial name for whatever reason.  Did I miss a PI (product issue) behind this?  Is this known behavior? Or am I just losing it from the week of crazy JAMF PIs that I’ve found?!

Don’t forget to sign into your Apple Manager …• Sign into ASM and ABM for updated agreements• Banner: Settings->Global ->Automated device enrollment Accepting updated agreementsAfter Apple updates one of these agreements, any Apple Business Manager Administrator, Apple Business Essentials Administrator, or Apple School Manager Administrator must sign in to the program website to accept any new agreements. If you're an Administrator in Apple School Manager, sign in to https://school.apple.com. If you're an Administrator in Apple Business Manager or Apple Business Essentials, sign in to https://business.apple.com.  

Hello Everyone, Happy Monday. I’m trying to get Jamf Account SSO enabled for my Jamf Cloud instance so we can use the compliance pane, but the OIDC app I created following the steps the Jamf Learning Hub provides does not create an Okta tile because the instructions tell you to set “Login initiated by” to “App Only” instead of “Either Okta or App”. However, when setting it to “Either Okta or App” it requires a “Initiate login URI” to save the settings. Other app documentation suggests using the “Sign-in redirect URI”, but then the tile goes to an error page.Is there a different URI I can use, or is what I’m wanting not possible, and I need create a bookmark to the Jamf Account login page?

Hello,I am having some troubles to connect Jamf Protect with Jamf Pro.Many computers don’t show up in Jamf Protect console despite having the policies generated by the Jamf Pro plan.I am currently debugging on one computer:the protectctl info -v command tell me the connection status is connected, the plan has the correct ID and the tenant point to the correct tenant.The only error I have is when running protect repair, I have a JamfProtect.ConfigProfileValidatorError error 1: no valid content filter profiles installed. (when verifying the daemon status)(I also have Jamf security cloud, and I tried with and without a content filter profile applied, both yield the same error)There are other computers on this plan that do show up in jamf protect console. What could be the issue and how to resolve this ?

Anybody have experience deploying the MyQ X Desktop Client through Jamf?

Now that Tahoe is out of beta, gremlins that I'd noticed earlier now feel more pronounced.  During Build testing I find myself frequently running through sudo Jamf recon ; sudo Jamf policyBut since moving to the release of Tahoe they’re just painfully slow to report data. It doesn't matter if it’s an upgrade from Sequoia to Tahoe or fresh install via IPSW.  Wired or wireless. ...S.L.O.W…  Is it just me?

Hello Everyone,    I got a sudden challenge on my desk to get a BYOD system working for our comapny. From my knowledge there isn't a BYOD set up so to say for MacOS. I see user enrollment is the method for this and it enters a un-supervised state. My questions are: how do we differentiate in a smart group who has these machines to get certain policies? How do we remove company data if said user is offboarded for any reason (we don't want to leave the control to the user)? In anyone's experience, what are some best practices from your BYOD setup you have started in your company. I am a small team and JAMF isn't our expertise (working on getting help to dive deeper with MacOS Administration) so any help is GREATLY appreciated. Thank you!

Pro Tip:If you have a need to take action on a a number of devices, no need to put them into a group.Use the blank search and enter serial numbers separated by a comma “ , “ and “ “ space example:serial1, serial2, serial3, serial4, serial5You’re welcome.

Since this came up during our meetup:The name "Jamf" is a reference to Laszlo Jamf, a character in the novel Gravity's Rainbow by Thomas Pynchon. It’s not an acronym. It’s not rude. It’s not what happens when you type “f” really hard.Knowing is half the battle. . .

Need help with Jamf Pro API automation. We're trying to bulk update computer inventory records using the Classic API, but getting conflict errors when posting device information updates.Can authenticate and pull device lists fine, but PUT requests to update asset tags and department fields are failing. Need someone familiar with Jamf's API endpoints and bulk device management.Should be 2-3 hours remote work to fix the API calls and test bulk updates. Need working this week for our asset audit.