Looking after iOS devices for a large IT company.We have a 'default' set of restrictions; every newly setup device gets this. There are other profiles as well that look after things for all devices (passcodes are a good example). Restrictions, though, are the main concern.So, there are manually created restriction profiles for managers. Another set for those in comms. Another set for interns, another set for something else, and so on. Things are now a little arbitrary.TLDR managers can use WhatsApp and USB (for Carplay) connections. Comms are allowed to use WhatsApp, and interns are allowed to use only critical apps (for example, only Outlook, Teams, and MS Authenticator). Everybody else just gets the Default (automatically) and can play with the Calander and other not-so-important stuff. But not WhatsApp! GDPR laws in Europe.A static group based on serial is used to 'map'  each device to each set of restrictions.What is starting to get on my nerves is the 'configuration creep'. I

Bonjour à tous,J’ai mis en place la solution de filtrage JAMF Trust, l’application bien installée, visible sur RADAR, le filtrage WEB fonctionne correctement.Cependant, je me suis rendu compte d’un problème un peu plus tard, j’ai un conflit avec le VPN Cisco qui confond le paramètre DNS de JAMF Trust.Lorsque le VPN Cisco est monté, le filtrage WEB ne fonctionne plus.Lorsque je désactive le VPN, le filtrage fonctionne à nouveau.Avez-vous déjà vu cela ?Pourriez-vous s’il vous plaît avoir une solutionMerci beaucoup pour votre aideTraduit avec DeepL.com (version gratuite)

Has anyone successfully implemented Classlink as their Single Sign Out for Jamf Pro?

Hello,I'm currently developing a profile automation system on Jamf Pro and I'm having a problem deploying wallpapers. I want to automate their deployment but I don't want to go through device commands. So I've opted for smart groups in the Jamf GUI, but I can't find anything to modify a smart group from the api.Do you have any ideas?

Hi, we have a situation where we're seeing several devices that have recently checked in but aren't provided inventory updates which means some of our policies aren't kicking off.   Is there a way to force a recon in this situation?  Do we scope a recon specifically to these devices and when they check-in next time it should kick off the recon? Or is there a better method to handle this? 

We are implementing a "home made" solution so our AD students can login into specific Macs on specific time remotely using Screen Sharing.In order to complete our solution, we thought on activating Screen Sharing (not ARD) on specific hours by sending scripts to activate/deactivate Screen Sharing.We haven't found the command lines to add users/groups to the "only these users" menu.Yes, it is easy to do it with ARD (ARDAgent / kickstart), but we need to use Screen Sharing.Anyone knows the commands to set specific users to use Screen Sharing ?

Hello, I am new to this discussions, but I have already found here so many solution in the last few months that I decided to create an account in the hope that someone will be able to help me on an issue that I have and for which I haven't been able to find a solution on Google. At work, we have 3 WiFi SSID, One for laptops, one for smartphone and one for guest.The smartphone and laptop wifi have a lot of security and uses the AD account for connection.However, for the guest WiFi, it has a standard password and is "outside" our network. With these command line: security delete-generic-password -D "802.1X Password" -s com.apple.network.eap.user.item.wlan.ssid.Laptop security delete-generic-password -D "802.1X Password" -s com.apple.network.eap.user.item.wlan.ssid.Smartphone We are able to remove the Laptop wifi password on Keychain Access. For both Laptop and Smartphone. However, we are having an issue for the guest network.Unlike Smartphone and Laptop WiFi, as well as having the

Hi Jamf Nation Team,Is there an automatic way to move the inactive Macs from one production site to another? We have identified the Macs that need to be moved to the inactive site, but can we move them automatically when they reach the "inactive" status?

Hello, I'm at the point where I had to create Sites in Jamf. I've never had a problem adding VPP licenses to apps but now when I scope an app, i.e. GMail, to "Campus A", I get "Content not available to assign to mobile devices". If I remove the site (in other words Full Jamf), I can assign VPP to the apps. (I tried adding it first to Full Jamf and then changing it to Site and I still had the same problem).Do I need to add these sites to ASM?  

Hello, I applied a "Facetime Deletion"  and " iMessage App Deletion" within the Restricted Software. The process name I used was -----System/Applications/FaceTime.app and /System/Applications/Messages.app I restricted the exact process name, applied "delete application" and "kill process". Both apps still appear on the dock bar on the test Macbook laptop. Am I missing something?  

I have a Mac mini that after upgrading to Monterey 12.7.5 will not allow a password to be entered. Tried multiple keyboards (this machine is usually headless). Keyboard still works in recovery. Mouse works at login. No policies/CPs have been scoped to limit input. Was fine before the update. Anyone seeing something like this?

Hi Everyone,Is there a method to automatically enable LastPass in the browser? For instance, without having to manually click on the extension icon in the browser.Thanks,Kenneth   

So we have found for a managed and a non managed Sonoma machine, there is a bug in Apple's Lockdown mode.In order to enable Lockdown mode, one must be an admin on the machine.Once Lockdown mode is enabled, one can no longer use Apple's ARD program or ssh into that device. This is to be expected based on Apple's documentation.We also have an additoinal admin type account on our machines so the Tech department can work on machine without the end user's login information.  We could log in with that account, go to systems prefs and disable.HOWEVER disabling lockdown mode with the other account DOES NOT restore the ability to use ARD or ssh into the machine.I have reached out to Apple and our Apple SE but have received no followup communication.

Hello All, We noticed that mac users are getting kicked out from Zscaler, and internet is becoming very slow. In that case we are supposed to loginto Zscaler manually, any idea why it is happening? Is it specific to macOS version? What is the solution on this? Any log can help me to do the troubleshooting? Please tell me the path of that log to collect it.

Looking to limit UIE to a specific group via SSO and/or Cloud Identity Provider (Azure).Currently we have SSO configured via Okta and CIP setup with Azure.  Anyone got ideas on how to do the restrictions?  I've tried adding the group under Access, but it still allows all users.  

We are investigating potential inconsistencies in device registration status for the Jamf Pro Device Compliance integration with Microsoft Entra.Observations:Devices are marked as non-compliant in Microsoft Entra despite appearing as compliant within Jamf Pro's "Compliant" Smart Group.The Jamf AAD plist file and the MS-ORGANIZATION-ACCESS keychain entry go missing on affected devices.Re-registration through Self Service/Microsoft Company Portal temporarily resolves the issue, but devices fall out of registration again after a period of time, then fall out of complaince. (approximately two weeks).Environment:Jamf Pro version: 11.4.2 (presumed not to be related to recent product issues)Request:I would appreciate any insights from the community regarding similar experiences or potential solutions.

Hello,I'm looking for Managed login items in profile configuration. I've seen it in documents and video (see screenshots), but don't see it in my Jamf Pro.My interface is in French.Where is it?

Trying to figure out a script that can delete all of the Default Keychains - local items - accesstokens. Would appreciate any assistants. Kind of new to scripting.#!/bin/bash# Function to list access tokenslist_access_tokens() {    security find-generic-password -a $USER -s "OAuth Access Token" -g 2>&1 | grep "acct" | cut -d '"' -f 4}# Main functionmain() {    echo "Access Tokens found in Keychain:"    list_access_tokens     echo "Enter the name of the access token you want to remove (or type 'exit' to quit):"    read access_token_name    if [ "$access_token_name" == "exit" ]; then        echo "Exiting..."        exit 0    fi    # Check if the access token exists    if security find-generic-password -a $USER -s "OAuth Access Token" -l "$access_token_name" >/dev/null 2&g

Talk about a BS money grab

I've run into a troubling issue.I used the JAMF Software update BETA Install Action to set a "Download and schedule to install" for last Friday night with a deadline just before midnight Friday.The scope was for macOS 14 devices to update to macOS 14.5On Monday morning, two users had reported that they were stuck at a Recovery Mode screen - asking to "Enter your recovery keys to unlock the volume Macintosh HD".I supplied the escrowed FV2 keys to the users.  One user was able to move beyond the Recovery screen and work normally - now operating on macOS version 14.5Unfortunately, the other user is not able to get past the screen - with the error "The supplied password failed to unlock the disk".I don't know if I have any options to get past this, with the JAMF escrowed key not working.Thanks for any thoughts.

Hello Team,After installing Nudge and pushing the configuration profile, the Nudge Agent do not open. We have 12.4.0 version of OS Installed.Please let me know what is that has to be changed/Modified. I've install Nudge_Suite-1.1.8.81421.pkg and configured the profile too.Upload FilePLIST file containing key value pairs for settings in the specified domain <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>PayloadContent</key> <array> <dict> <key>PayloadContent</key> <dict> <key>com.github.macadmins.Nudge</key> <dict> <key>Forced</key> <array> <dict> <key>mcx_preference_settings</key> <dict> <key>optionalFeatures</key> <dict> <key>acceptableApplicationBundleIDs</key> <array> <

Hello,We are currently in the process of utilizing Zero Touch Deployment for JAMF Pro and also need to deploy JAMF connect but are having some issue on the EntraID side for verification. I am thinking of going ahead and deploying enrollment and utilizing a local account on the computers while I continue to test/troubleshoot Jamf connect and installing at a later date through a policy. If I was to do this, and when ready to deploy connect enable the "convert local account to network account", would the users documents/programs/setting etc. remain in the converted account or will it delete them? I ask as we have to have a 3rd party install a proprietary program onto each of the computers prior to giving them out to employees and I don't believe JAMF connect would be set up in time for our appointment.I appreciate any insight!

I recently got the Return to Service workflow working on some test iPads. When I deployed it to my student iPads and tried to run it manually through the app it returned the following error message in the management tab in JSS: Erase DeviceMDM profile is required for Return to Service on this device. I'm a bit confused by this message because the iPad is present and checking in since the app got pushed out just this morning. Trying to search for this error message is getting a lot of generic MDM results so I'm hoping someone else might have come across this with RtS or something else and it's something easy I'm completely overlooking.

We have been creating a local Administrator account during enrollment on every machine. We are now questioning whether this is necessary at all. Currently all of our users are administrators and we do not use standard accounts. Can anyone think of a good reason as to why we would need another administrator account on the machine? 

Hey everyone, we're currently working on upgrading to MacOS Sonoma using Jamf Pro as Admin. We're looking for a way to run the upgrade overnight without requiring end users to enter admin credentials. According to Apple Support documentation, users need to be volume owners to initiate the upgrade, but they still need admin credentials to do so.https://support.apple.com/guide/deployment/about-software-updates-depc4c80847a/web#dep7d4a58bedCan we implement any type of policy to run the upgrade without asking for admin credentials?