How do I set up so that students are not able to use the Messages app on their Mac. 

Hi all, we are using cloud instance of Jamf Pro, with user-initiated enrolment for iPads, iPhones, etc always been unticked (all boxes, inc account-driven and profile-driven), while computers were enabled.Everything was fine till iPads with Apple M-chips were released - now users CAN enrol them manually… Is it because Jamf Pro mistakenly taking them as MacBooks? Is there a way to fix this?Thanks!

We just got the Jamf AD CS Connector set up for our environment. It's awesome considering we were using an ancient, user-initiated script through Self Service for a long time to accomplish the same thing. However, I am wondering what the best practice is for pushing the wireless config during or after enrollment is. As part of our zero touch efforts, we have the user enroll using our guest wifi network when on site. I'd like to get the wifi profile installed as close to enrollment time as possible so when it does its post-enrollment tasks (installing security software, settings, etc) it will pull from on-site distribution points rather than our Internet facing distribution point. Has anyone had success with this? I seem to find myself getting railroaded installing this profile as it either interrupts the enrollment or post enrollment when it automatically switches from our guest network to the corporate network. Thanks in advance for any thoughts.

I am running into this issue where after pushing an app, updating inventory or enrolling a device, the apps are going straight to the failed command list and display the “No license was found for app”. I have tried wiping and re-enrolling, updating OS, restarting, sending a blank push, or update inventory command but the issue persists. I check the apps and we do have enough licenses available. Any solutions or ideas on what can be causing this?Thanks

I just wanted to say they really helped me get across the finish line with a script I needed to move computers from one pre-stage to another.Also special shoutout also to ​@mattjerome for getting the base script started with me.Anyone else have cool stories of how Jamf Support came through for them when you were hitting a brick wall with things?

Hi,  Is it possible to block widgets with the Home Screen Layout but also allow apps to appear (at least on the second page) while not having those apps lumped into a folder? Here is an example I have setup -- Main group (All Student iPads): Has normal student iPad apps. These apps and profiles appear on the first page as intended according to the home page layoutSecond group (LMC): Has specific apps set to auto-install. Sometimes these apps appear after the first set of apps. But if wiped and returned to service, the apps will move to the second page of the home page and get lumped into a folder called “Managed”. Is there a way we can have this setup so the apps on the second page DON’T get grouped together while also hiding widgets/blocking students from removing apps? It would theoretically be nice to just have all the apps together but having the layout locked on page 1, and other apps on page 2 (if more then two groups) be together, that is fine too.  Thanks 

Hi,We’re using Jamf Radar and I created a group where internet access should be completely blocked except for a few allowed sites (internal tools and Jira, mostly).At the moment, full blocking works as expected. I then added some test domains under Custom Rules with "Allow" selected, but they’re still being blocked.What’s strange is that a domain like reddit.com, which is allowed via a custom rule inherited from the root level, works fine. But any domain added directly at the group level doesn’t work, even if the rule looks identical.Is there a known issue with group-level custom rules not applying correctly?Is there a better way to block all internet traffic for a group and only whitelist a few domains?Thanks,Michał 

Trying to install Chrome for Mac using the app installer.  When it installs, chrome will no allow me to update manually.  If I manually install chrome, then there isn’t an issue.I do not have a configuration profiles loaded for chrome.

I am attempting to import a new VPP token that I have downloaded from Apple business manager. Every time I try to do this, I get an error saying "The file received was not valid". I have tired using a different web browser. I have rebooted Jamf Pro, and I rebooted the entire Ubuntu server VM. The Jamf Pro server log does show an error at the time I attempted to import the token. I have an open case with Jamf for this, but if anyone knows how to solve this, that would be wonderful 😊

We are deploying ClearPass OnGuard to our macOS fleet using Jamf Pro. The ClearPass application installs successfully via the Jamf policy, but it fails to establish a connection with the ClearPass backend. Manual installations, however, are fully functional. The root cause has been identified as a missing or misplaced .agent.config file, which is a hidden file essential for the initial configuration and backend communication. This file is present within the ClearPass DMG but is not included in the standard PKG installer.The challenge is to devise a deployment method using Jamf that ensures both the ClearPass installer PKG and the .agent.config file are present on the client machine at the time of installation, allowing the application to connect to our backend successfully.

Hi all,I’ve been unable to find the answer to this one so I’m hoping the experts here will know the answer.I accidentally scoped a policy to all computers with the recurring check-in box ticked rather than just the enrollment complete option. I realised my mistake and rectified it, but now there are multiple pending commands in the policy log. How can I cancel these? Thanks

Hi everyone,I’m in the process of cleaning up a previous school system’s JAMF instance, which unfortunately lacked proper patch management. As a result, there are still devices running macOS Catalina and newer versions.I’m looking for advice or best practices on automating OS upgrades. While I’ll address the specifics of communication with my new manager separately, I’d really appreciate hearing from anyone who has dealt with a similar situation—particularly those without a dedicated team to handle the task.Thank you in advance!

We were configuring our new devices in Jamf pro and it was working fine till August 4th. After that there were no communication between the devices and the server. Any idea why this happened and how to fix?

I use IBM Notifier for most of the popup and notification messages for my user base. Has anyone had any luck using IBM Notifier with a progress bar from a script? I’d like to use a progress bar in a few of my longer running scripts. Would AppleScript be a better option? I’ve used CocoaDialog back in the day but that’s not an option right now.

I've been tasked with finding a way to prevent users from running applications out of unapproved locations such as their Desktop and Downloads folders.  I found a nearly 10 year old thread talking about doing exactly that, and it doesn't seem like much has changed in the years since.  That said, any decade old device management thread is going to be really out of date. Are there any major gotchas I should be aware of while building out the test Restrictions here?  Things like needing to whitelist unexpected directories for Microsoft or Google products?  Should I hold off until the Restrictions payload gets updated to match the modern Jamf payload setup?

I have a script that worked before OS15.5. After updating to OS15.6, the script became abnormal. Even if it connected to the allowed SSID and obtained the IP address, it would turn off and on WIFI infinitely. The following is the script. Thank you for your help~~

Basically we have disabled the screenshot feature for a certain group in my organization via JAMF Configuration Profiles, but recently we have found a loophole for users to take screenshots via enabling the “Show features for web developers” and then on Safari, going to Develop tab and “Show Web Inspector” > Elements tab and right click the html to show the option to “capture screenshot” and it will allow you to save the screenshot. We are trying to remediate this loophole by disabling the option to enable the web developers option. Anyone have any ideas? I have tried using Configuration Profile and using the Application & Custom Settings option, but could not get it to work using the plist I found online.https://www.geeksforgeeks.org/techtips/how-to-take-screenshot-apple-safari/

Has anyone found a way to configure the Canvas app with your schools site? One issue we see a lot of is our users entering in the wrong address when trying to access Canvas. I cannot find any information about configuring it from Canvas so I figured I would see if anyone else found out how.

I'm currently traveling around the globe and using VPN to have a static IP address. Is JAMF going to report my location either by detecting nearby WiFis and matching them to a location or by GPS?I understand that a script can always be pushed to do just that, but I'm asking about the more common default setups.Thank you! 

To deploy Platform Single Sign-On (SSO) for macOS integrated with Microsoft Entra ID, especially using the Secure Enclave key method, here’s a comprehensive step-by-step guide based on Microsoft & Jamf✅ OverviewPlatform SSO allows macOS users to authenticate using:Microsoft Entra ID credentials Smart cards Secure Enclave-backed keys (recommended for phishing-resistant MFA)In Secure Enclave mode, the local account password remains unchanged, and knowledge of it satisfies MFA requirements for Conditional Access.🔧 Deployment StepsStep 1: Determine Authentication MethodChoose one of the following:Secure Enclave (Recommended) Smart Card Password SyncFor Secure Enclave:Works on macOS 13+ (full support on macOS 14+) Uses hardware-bound cryptographic keys Leaves local account credentials unchanged Supports phishing-resistant MFA  https://learn.jamf.com/en-US/bundle/technical-articles/page/Platform_SSO_for_Microsoft_Entra_ID.html

I'm seeing a number of Macs reporting that FileVault 2 is not enabled, despite the encryption state being displayed as Encrypted. I've also seen this sometimes change to show Enabled before reverting back to Not Enabled again. Is this a known issue? The machines appear to be completely fine and encryption seems to be on.

We have our network setup with ADCS connector to get the certificates for the computer. The profile is working and the certificate is in the keychains.  In the admin user, I am able to connect to the wifi without any issues. In the user’s account, it won’t connect and doesn’t prompt to choose the certificate. It should prompt for the certificate. I have removed the plist in the user’s library preference folder that had anything to do with network. I still can’t get it to work. I had already cleared out everything in the /Library/Preferences/SystemConfiguration folder. I’m at a loss on what else to delete.

Hi everyone. Recently onboarded new MacBook Pro devices to JAMF School through Apple School Manager (added using Configurator 2). In the ADE profile, the option to allow the user to remove the MDM profile is unchecked but somehow students are still finding a way to delete the profile.Can anyone point me in the right direction to solve this? Not sure if there is another setting I'm missing somewhere. Thank you!

We are used to deploying apps by choosing an app in the App Inventory, assigning a scope and picking some options. One of the options is on-demand installation, as opposed to automatic installation. On-demand installations allow a user to choose an app from 'My resources' in the Jamf Teacher or Jamf Student app on an iPad or on a Mac. So far, so good.Recently, Jamf School added the extra option of 'App Installers' to install apps on macOS. Here also, you can choose between on-demand and automatic installation. Choosing the latter, the app installs correctly and as expected. Choosing the former: where can a user find the list of installable apps?

Hello, What do you guys use to track your iPads or MacBook Airs that have been lost or stolen? Just wondering what some of you have done to meet that requirement in your environment or school district. Thanks, as always, for your input.