Having a strange issue with JAMF Connect computers. We use Google SSO at the login in screen and it works normally, however, when the user logs out you are not able to click in the email box to sign in again. A restart will fix it but wondering if anyone has seen this. 

Hello jamfnation, I have a question. I try to rename some user accounts to match the company pattern. We want to do this process as smooth as possible for the user and admins. Therefore I've written a script which checks values and asks the user several questions which in the end creates a plist with some variables. After that the script reboots the computer and uses Rich Troutons "First Boot Package Install" (script almost completely rewritten) to show a log to the user what is happening. At that window the script, which is started by a LaunchDaemon, uses dscl to change the homefolder, uses mv to move the homefolder and again uses dscl to change the username. Now my problem:In order for dscl or mv to be able to change the homefolder it needs access to it (PPPC). My script is signed and stays signed, and a PPPCP is in place to allow for my script to access Admin Files and/or All Files. I also tried the unsecure way and allowed /bin/bash access to AdminFiles/AllFiles.However it is not

We are trying to figure out why most of our Macs updated to macOS 15.6.1 after I used Software Update in Jamf Pro to enforce getting Macs updated to macOS 15.6. When I set the update to go out, I specifically selected 15.6, not 15.6.1. I always check a few Macs in the group I selected to update to verify that they received the correct scheduled update. I confirmed that they had received the scheduled update for 15.6. Right after pushing out another update command, I saw that my own Mac already runnning 15.6 displayed an alert that it would update to 15.6.1 at the scheduled time. We have a profile installed that defers updates for 21 days. I confirmed that it is working using Macs not yet updated to 15.6. They all show 15.6 in Software Update. Macs running 15.6 do not show updates available. I wonder if the enforced update is responsible for this. I was very careful to specifially select 15.6 as the update we wanted to run. Has anyone else seen this behavior?

We would like to restrict our admin user from installing any applications via installer files (pkg or dmg) on their Mac. There is a functionality in the configuration profile under Restrictions that allows us to check "Restrict the App Store," but this only prevents users from opening the App Store. They can still download package files from the web and install them. Is there any way to restrict admin users through a script or configuration profile?

We upgraded some of our iPads to ios 7 and are unable to disable iMessage and Game Center. We do not use Apple Configurator as we are a Windows school. The iMessage option IS disabled in the restrictions for this profile group but still shows up on the individual iPads. We deleted the profiles on the iPad and it still came back.

Jamf is showing as disconnected after changing the user group membership (Version 11.19.1-t1754574720728).We are getting the following alert:"Exception_Group is actively targeted in the scope of the objects listed below. Changes to this group membership may require more time to deploy than usual due to the increased network traffic associated with redeploying certain content. Jamf Pro may be unusable or unstable during this time."After this message, if we save the assignment changes, the user device gets disconnected and does not accept any sudo commands.

Did someone have the problem logging in from a computer and this window appear? Some computers on our system do throw this if our trainees are trying to log in. They are on the same network as other devices and this appears on multiple browsers.  

Hi, I’m trying to manage our recurring license limit in Jamf School since we’ve just renewed a couple days ago. I’ve already released the devices from our organization and they don’t even show up in the Inventory > Devices menu anymore. When I select them under the License Assignment menu, I only get the option to “Assign a Perpetual License” and there’s no option to remove a recurring license: Thank you in advance.

To prevent user from syncing Chrome data with their personal google account, a custom setting for Google Chrome can be set and deployed by Jamf Pro. Preference Domain: com.google.ChromePlist file content: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>RestrictSigninToPattern</key> <string>(?:.*@domain1.com|.*@domain2.com)</string> </dict> </plist>  let's check the managed chrome policy status and the sync result.  

Disabling an Existing Local Account for FileVaultLog in to the JSS with a web browser.Click Computers at the top of the page.Click Policies.On a smartphone, this option is in the pop-up menu.Click New images/download/thumbnails/5832871/New_icon.png .In the General payload, enter a display name for the policy. For example, “Disable Local Account for FileVault“.images/download/attachments/12979842/DEC_Policy.pngSelect a trigger and execution frequency.Select the Local Accounts payload and click Configure.Choose “Disable User for FileVault 2” from the Action pop-up menu.images/download/attachments/12979842/LocalAccounts_DisableforFV2.pngEnter the username of the user you want to disable for FileVault.(Optional) Select the Maintenance payload and then select the Update Inventory checkbox so that the FileVault-enabled status for the local account is updated in inventory immediately when the policy runs.Click the Scope tab and configure the scope of the policy.Note: If applicable, you can us

Hi everyone, I have an JAMF managed I-pad that we use for testing. I need to connect it to my Macbook pro to run debugging. When I connect it to the Macbook  the Ipad does not show the Trust this computer pop up. Is there anything I can do to be able to see this alert in JAMF? 

Hello everyone,With the release of macOS Sequoia, I’ve run into an issue with our podium iMacs that are connected to projectors. By default, they no longer mirror the display to the projector screen, even when using scripts or third-party tools from GitHub.Currently, I have to manually adjust the display settings to enable mirroring for each instructor who logs in.Has anyone encountered this and found a reliable solution or workaround?Thank you in advance for any suggestions!

I’m getting Jamf Self Service error loading content when accessing self-service to download apps. 

Name and information link Available for Release date iOS 18.6.2 and iPadOS 18.6.2 iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later 20 Aug 2025 iPadOS 17.7.10 iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation 20 Aug 2025 macOS Sequoia 15.6.1 macOS Sequoia 20 Aug 2025 macOS Sonoma 14.7.8 macOS Sonoma 20 Aug 2025 macOS Ventura 13.7.8 macOS Ventura 20 Aug 2025  CVE patched ...https://support.apple.com/en-us/100100

Dear Team,Anyone can address which domains or settings need to bypass in DNS settings to login cloudflare warp client successfully? My Jamf Web Protection only enable Internet Content Filtering, therefore MAC OS machine no need Jamf Trust, it only needs profile configuration , UEM connect settings in place.I have the issue that  When the DNS settings disable I am able to login CloudFlare WARP client If the the DNS settings enable, i can not login the CloudFlare WARP client with the error message "CF_DNS_LOOKUP_FAILURE." and here is the solution Verify that the network the user is on has DNS connectivity.Verify that DNS resolution works when WARP is disabled.Ensure that no third-party tools are interfering with WARP for control of DNS.Ensure that no third-party tools are performing TLS decryption 5 on traffic to the WARP IP addresses 4.I already tried to bypass these domains without help in configuration proflie<string>*.cloudflareclien

I recently had to rebuild a device because it would not install any updates, so I started from scratch. I got Sequoia installed and when I attempted to use Jamf.OUR.COMPANY/enroll, it did not download the normal MDM & CA profiles, but the QuickAdd.pkg. Even with enabling all pkgs via “sudo spctl --master-disable” and “-allowUntrusted” when using “sudo installer” the package still continues to fail because it is untrusted. Is there any way to manually download the MDM & CA from jamf pro since the /enroll will not download it? Or just another workaround in general?  Thank you!~G

We recently implemented Content Filtering and saw that the “Clear All” button for safari is now disabled.  In providing support to our users, we often tell them to clear their cookies and cache when they are having issues loading a website. Now that content filtering is enabled, this is no longer an option.How have you overcome this? Any recommendations?

This has come to my attention recently. So basically, our users would change their password via jamf connect, it would go through and successfully change their azure ad password. Then once they login to the computer, it would give them a prompt, telling them to enter their old password for the local account to sync with the new azure ad account, we also have filevault enabled. This was all working fine, but recently when an end user changes their password via jamf connect. It gives an error message (I didn’t see it yet, have to wait until someone changes their PW again) and it will act like it doesn’t go through, but it actually does go through. It will not update their jamf connect expiration date (For example now, some users say their passwords will expire in -10 days) even though they changed their azure ad password. Now we have had users getting locked out of filevault because when they sign out or restart their computer and are on the filevault page, the local account password doe

Hi,I noticed that rather many of my Mac clients are not FileVault encrypted even though I have configured a configuration that should take care of that. Now I wanted to ask what is the best practice to enable FileVault on all my Macs. As far as I know there is an option to enable it via Policy and one via Configuration Profiles. What is the difference there and what is recommended?

Hi , I tried all the topics on jamf and internet , but didn’t work , and it seems there is a missed step related to PList i think. the steps i did are as per below:1- from computers , select configuration profiles , add new2- scope = add computer you want, level is computer level.3- Application & custom Settings : add External Application and name it, application domain is com.microsoft.Egde , Edit Schema and add the JSON as below [  {    "toplevel_name": "Managed Favourites"  },  {    "url": " https://keepersecurity.eu/vault/ ",    "name": "Keeper"  }]that didn’t take effect , but it has been applied according to JAMF logs.there is something missed ,specially i noticed the Plist preview didn’t change with JSON added as above 

End User Experience Reference: https://learn.microsoft.com/en-us/mem/intune/configuration/use-enterprise-sso-plug-in-macos-with-intune?tabs=prereq-jamf-pro%2Ccreate-profile-jamf-pro#end-user-experience   Secure Enclave After the configuration profile for PSSOe and the companion application for PSSOe are installed on the device, macOS will prompt the user to register.  The message can be customized with the configuration profile value of “Display Account Name”.  In this example, the Display Account Name was set to “Jamfse.io Entra ID”.    The user is then prompted for their local macOS UNIX account password.  This is used to determine the user is present and actively using the device.  The next step requires the user enter a strong credential like a security key or Passkey enabled on another device.  Other methods also include push with number challenge.   Upon completion, the user is shown instructions to set up the device as a Passkey provider for

Posting this for anyone that works with an organization that wants to disable Microsoft AutoUpdate with a Jamf Pro configuration profile. Preference Domain: com.microsoft.autoupdate2     <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ChannelName</key> <string>Custom</string> <key>EnableCheckForUpdatesButton</key> <false/> <key>HowToCheck</key> <string>Manual</string> <key>StartDaemonOnAppLaunch</key> <false/> </dict> </plist>        

 Any ideas what causing this issue, ive checked ABM and each app got enough licences so not sure what causing it.

Hello,I've enrolled new iPads in Jamf Pro. They are correctly configuring them. However, when downloading the apps, we get the following message: kCFErrorDomainCFNetwork error -1202.Any idea why this error is occurring?Possibly some pending configuration? Syncing between ABM works correctly and has available licenses for the app. The iPad is also connected to an unblocked network.

We have a smaller environment and some flexibility on our update schedule. There is an MDM profile we push out with a software update payload where everything is checked except “Restrict software updates to administrator users only”. It has been like this for years and usually it means after a few weeks some folks have updated and others need a little reminder. The recent 15.5 to 15.6 update appears to be different for us. This time it pushed out to everyone on either 8/5 or 8/6. Has anyone noticed a change in how the built-in software update runs in Sequoia with that kind of set it and forget it MDM payload? There are only 10 computers running Sequoia in our environment with another few dozen running a mixture of Sonoma and Ventura, so it might be sampling/anecdotal. The other releases are in their usual state of lag two weeks after the update and all of them are using the same payload.  This all came to attention because the one Sequoia user who hadn’t updated reached out complaining