Hi all,I'm hoping someone with experience around LAPS-managed local accounts and Declarative Device Management (DDM) can weigh in on this.Scenario 1:When applying the "Change passcode on next authentication" payload via DDM, I’ve observed that this flag applies to all local accounts on the device — including the one managed by LAPS. My question is:If LAPS rotates the password while that account is flagged for password change on next login, what happens?Will the password change flag be satisfied automatically by the rotation, or is there a risk of the user being prompted unexpectedly or getting locked out?Scenario 2:If the same DDM payload is in place, and the passcode for the affected LAPS-managed account is manually changed (e.g., by an admin or user), then when LAPS next attempts to rotate the password — it will likely operate with an outdated expectation of the current password.Will this mismatch disrupt LAPS password cycling?Does LAPS handle this edge case gracefully or will it fai

Hi All,  how to triggar configuration profile from App in self service portal? Thank in Advance 

is there anyway I recover Apple Devices Warranty in Jamf pro as Mass load without a GSX Account? Thank in Advances

If you are wondering what the “Login Window Size” Options of WIDE, COMPACT and MAX looks like for Jamf Connect. Here they are, especially for Okta on the login screen. Not the prettiest of Login windows but at least they will give you a good idea what to expect.This was changed in 2.45.1 I believe and is still the same in 3.2.0CompactCompact Settings for Login Window SizeWideWide Settings is the same as Compact, except stretched side waysMaxMax Settings covers the date and time.  

Good day all,  What is everybody’s current/past solutions for PKI and SCEP for Apple. Specifically for EAP-TLS. If you are a mixed enviorment, please also share! Currently using step-ca for everything Apple with JAMF Pro aswell as ChromeOS and Intune devices.  Moved away from AD CS and NDES. However, currently on the hunt for a hosted Cloud solution. Share your thoughts, solutions and challenges.

Hi,I need to delete all classes in Jamf pro imported by ASM. Does anybody have a working sh. script?I have used this one below but getting in terminal this error "-:1: parser error : Document is empty" #!/bin/bashjssUser="xxx"jssPass="xxx"jssURL="https://xxxx:8443"echo "Downloading list of class IDs..."ids+=($(curl -X GET -s -k -u "$jssUser:$jssPass" "$jssURL/JSSResource/classes" | xmllint --format - | awk -F'>|<' '/<id>/{print $3}' | sort -n))for n in "${ids[@]}"; docurl -kvu $jssUser:$jssPass ${jssURL}JSSResource/classes/id/$n -X DELETEdone

Hey, I’m curious if anyone has come up with a way to build a smart group that can report specifically on apps located in ~/Applications, since /Applications currently only shows system-level applications.

I have always used JSSConduit to purge old classes to learn JAMF no longer accepts basic authentication.  Support sends me the below script to run without explanation.  I am a network guy who also manages Jamf, and par for the course Jamf Support falls short.  As I stated, I am not a JAMF scripting expert so I am only looking for a detailed procedure on how to delete the classes which typically took me 5 minutes has now lingered for 3 weeks.  Any expert advice / instructions would be appreciated. Script below:#!/bin/bash #################################################################################################### # # THIS SCRIPT IS NOT AN OFFICIAL PRODUCT OF JAMF # AS SUCH IT IS PROVIDED WITHOUT WARRANTY OR SUPPORT # # BY USING THIS SCRIPT, YOU AGREE THAT JAMF # IS UNDER NO OBLIGATION TO SUPPORT, DEBUG, OR OTHERWISE # MAINTAIN THIS SCRIPT # #################################################################################################### # # DESCRIPTION # T

Hello, I’m Radhika Sharma, and I manage an online textile business specializing in Jaipuri Print Fabric and Discharge Hand Block Printed Fabric. I’m exploring ways to manage both inventory and Apple devices (like iPads and Macs) used in my business operations using Jamf Pro.Specifically, I need help with: Device Management – Setting up Macs/iPads for employees handling stock and orders. Inventory Management Solutions – Integrating Jamf with inventory software or systems for better tracking and automation. Any advice on how to effectively use Jamf Pro in a retail or business setting would be greatly appreciated!Thanks in advance!

Hello every one,Trying to make a bash script for adding a printer via Self Service. Some things is easier to solve and others not. :)In this case I’m trying to fill out the following string to complete a command for a script.lpadmin -p <destination> -E -D <destination> -v <device_uri> -m everywhereThe problem for me is what to set within all the < >, the printer in question is named followme and is a papercut-printer/que (follow me).I’ve already run a command in my terminal that lists alot of parameters for the printer in question but I get rather unsure what to put where. Anybody able to help med out a bit? :)

Join Chris Schasse (you know, the guy steering the Rocketman Tech ship 🚀) for this month’s LaunchPad on Friday, Aug 8 @ noon MDT. We’re talking Blueprints, Compliance, Jamf’s new AI stuff—and why it’s all locked behind Jamf ID.Expect honest takes, a few laughs, and time for live Q&A.🔗 Sign up free: https://rkmn.tech/m-launchpad  

I was wondering if it was possible to make the footnote under "Lock Screen Message" (section for the configuration profiles) bigger as we have users who cannot read text as small as it is.Alternatively is it possible to in some way (maybe a script) push a lock-screen/pop-up notification with a message if a user enters their pass code wrong too many times and gets locked out? Thanks!

Hi All,Windows admin here, thrust into a mixed environment consisting mainly of Mac’s. I’ve worked with Intune for a few years now, but Jamf/managing macOS is totally new to me. Looking forward to learning a lot, but I was wondering what everyone wishes they knew at the beginning of their Jamf journey?   

Hello all,I am in the process of rolling out OneDrive to our Mac environment.  I assigned the app from the Jamf app catalog and put together a plist with all of our settings.  I discovered that OneDrive has to have full disk access in order to automatically back up the desktop folder.  I used the Jamf PPPC tool to grant onedrive full disk access, however it does not seem to take.  I check in system settings → general → device management and I see the config profile, however when I run sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \ 'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"' in Terminal, onedrive is not listed as one of the apps that has full disk access.  Any ideas?

Hi,We are working on implementing Managed Blocking of Macros in Office365.  My task was to to have every user (not computer) have the Macro Security locked to "Disable all macros without notification" There was also to be an exclusion group for users who would not be controlled by the above lock.  For the exclusion group, we wanted if possible for them to be locked instead to "Disable all macros with notification" as that setting allows a user to enable macros on a document by document useI also had to make this work with Entra or our On Premises Active Directory (to which the Mac's are bound).  As there's no linkage yet with Entra I've focused on Active Directory (AD)I found that the settings for this in the Configuration Profile only work on a "Computer Level" even though they seem to be User settingsMy Configuration Profile looks like this:This works but generally takes a few minutes for the machine to pick up a change in the group from ADIf I try and make a second Config Profile an

Hey everyone!I'm reaching out for guidance on a complex issue I've encountered with integrating Jamf Pro and Microsoft Entra ID for SSO, specifically regarding user attribute mappings and device enrollment processes. Despite a successful setup of Single Sign-On and Cloud Identity Providers for new macOS device enrollments with corporate credentials, I've hit a stumbling block with more detailed configurations.Core Issues:User Attribute Mappings: My goal is to map the User Name attribute to the onPremisesSamAccountName (essentially, the UPN without @domain.com) for a more intuitive username representation. Additionally, I aim to map Phone attributes to mobilePhone and Position to jobTitle, enhancing user profile completeness within our system.Device Enrollment Customization: During the Setup Assistant phase of Automatic Device Enrollment (via ABM), I intend to pre-fill the primary account information with the device owner's details. However, the system defaults to using the UPN/email fo

I am attempting to use SSO Enrollment through Enrollment Customization, but having issues with getting the desired Full name and Account name (Home folder).The Account name is always the user’s full email address.I am NOT using Jamf Connect. Using Entra ID as IDP. I am using pre-fill from Pre-Stage Enrollment for the user account.johnsmith@email.comThe goal is for Full Name to be John Smith. And Account Name to be johnsmith.I’ve tried checking and unchecking pass through Jamf Pro to Jamf Connect with different attributes. (I know I’m not using Connect, but I’ve been running out of ideas). This always places the proper Full Name and always the the email for the Account Name.I adjust the IDP attribute mapping to change the username to mailnickname. This tests properly and the username appears as johnsmith. It pulls User & Location from my directory properly when I do a search by just the nickname. When I go through enrollment customization though, it still places the full email as th

We’re Trying to force OneDrive to sync Desktop and Documents on our Macs using Jamf. machines aren’t domain-joined. They’re already signed into Outlook/Teams with their work accounts.Here’s what I’m trying to do: Auto sign users into OneDrive Turn on Known Folder Move (KFM) for Desktop/Documents Avoid macOS prompts asking for folder access What I’ve done so far: PPPC profile – I used the correct code signature from the OneDrive app (verified with codesign). Gave access to Desktop, Documents, and Downloads. But the profile fails to apply in Jamf with a status of “Failed”. Script – I’ve got a script that reads the signed-in email from Office apps and uses the odopen:// URL to trigger OneDrive login. It runs, but OneDrive either doesn’t sign in or doesn’t start syncing unless the user manually clicks through prompts. Where I'm stuck: PPPC profile won’t install, even though the code signature looks right. Even if OneDrive opens, syncing doesn’t start unless the user allows folder a

I’ve got a weird issue with MS Defender Configuration Profiles applying/Un-applying intermittently. As part of our enrollment process we install MS Defender and apply Configuration Profiles.  This has been working fine for close to 12months.Now for some reason even though the Configuration Profiles are still applying (You can see them in Device Management).  The configuration doesn’t always apply even when it does apply the settings can stop taking affect shortly afterwards.Device Management still has the Configuration Policies applied.I’ve tried downloading fresh configurations, onboarding etc. from Microsoft with exactly the same result. Has anyone else seen this? 

I am trying to test out Single App Mode so we can fulfill a request a user has when their new Ipad comes in. They want it to only allow access to Safari and not allow any websites except the sign in page they set up. I have been able to restrict other sites with no issues, but the Single App mode is causing me issues. I created a Configuration Policy and selected Safari from the Lock to App drop down. When I scope it to my test group, it does attempt to apply, but fails due to "The field “Identifier” contains an invalid value.". Even when I chose "Specify Build ID" and enter "com.apple.mobilesafari" as the build ID, I get the same error. This happens for all apps in the drop down.I have confirmed the Ipad is supervised and all other settings I set up have applied with no issues. It is just this one thing that will not apply.  Any assistance anyone can provide would be appreciated. 

Suggestions needed for this query...

Hello All,We’ve just started to implement Jamf Pro in our company. Nearly all configurations are completed except sending compliant information to Microsoft Intune. We have to do this because we’re using Azure (Entra) Conditional Access rules in our company. If a macOS device is not compliant it cannot reach internal company resources. Just a simple rule. Steps CompletedJamf <> Intune compliance partner connector connected successfully. Microsoft Device Compliance configuration policy prepared in Jamf Policies -https://learn.microsoft.com/en-us/intune/intune-service/protect/jamf-managed-device-compliance-with-entra-idProblem SummaryAfter enrolling to jamf, we are trying to sign in to Company portal and jamf compliance popup appears. Then we are entering our user account details again but somehow Microsoft login page shows that “get app”. It behaves like Company Portal is not installed. Briefly some of our computers are being Compliant without any problem, but some of others canno

I created an EA to tell me the last time Adobe Acrobat was used. The issue I am facing is that i have gotten a lot of results showing as NULL. From what I can tell this happens if the user has not launched Adobe Acrobat since it has been updated. Any ideas or a better way to report the last time it was used?    #!/bin/bash    # Define the path to Adobe Acrobat    acrobatPath="/Applications/Adobe Acrobat DC/Adobe Acrobat.app" # Adjust path if needed    # Check if Adobe Acrobat is installed    if [ -d "$acrobatPath" ]; then        # Get the last used date using mdls        lastUsedDate=$(mdls -name kMDItemLastUsedDate -raw "$acrobatPath")        # Check if a date was returned (meaning it was opened at least once)        if [ -n "$lastUsedDate" ]; then            echo "<result>$lastUsedDate</result>"        else            echo "<result>Never Opened</result>" # Or a default date like "2001-01-01"        fi    else        echo "<result>Not Present</result&g

I dunno know who this will help out, but here it be ………We normally do screen recordings of macOS enrollments. This does several things for us.We provide it to our Support Team so that they can see the new[er] enrollment flow. Become familiar with it. As it sometimes changes from time to time. We share it out with our Security Team as well. So that they can see the enrollment process as well. In case they have a question or request a change that they would like to change. Lastly, we do it for training as well. We show the process of beta’s [macOS 26b3]. So that the team can see the process & changes that have been made or are coming down the pipeline.This has been & continues to be a helpful tool we continue to provide to our teams. However Apple has made some changes with how this process was done in the past. No matter what I tried we were not able to capture any video output until it got to the desktop. This just sux’d, we could no longer provide this service. Sure we could t

Hi all -Trying to install Adobe Creative Cloud through Jamf School. I have had success with other .pkg files, but the installer file generated from our Adobe Admin Console is opening up like a folder and not a simple .pkg file.I've scanned the posts here for answers. Tried to send it as a zip, tried to generate a file with Compressor. No luck.Anyone have any suggestions? Thank you!