I had a few devices upgrade to iOS 26 and the homescreen layout is not working….has anyone ran into an issue with this? 

So we have Google LDAP connected to Jamf. It's working great for populating User & Location information, etc. However, I'd really like to leverage 'Directory Service User Group' to scope stuff. It just doesn't seem to be working. I've tried to do some reading and I've found people saying it's unreliable. When I go to Cloud Identity Providers > Google LDAP > and do a lookup of myself or others + and also search for a group name - it correctly returns that I'm a member of ___-staff group. There's a specific policy I want to exclude for this staff group. I can go to exclusions for this policy > Directory Service User Groups > search for the staff group I'm apart of > it finds it, and I add it. After doing that, I still see my computer as pending like it's still in the scope. User & Location info is accurate, my local account matches LDAP user name, etc. How are people future-proofing scoping?

Hi,I have recently deployed a new wifi cert for our wifi office network and I am testing it at the moment.Once I choose the network, it will ask me to choose a certificate or enter credentials. I choose the new certificate and then afterwards the “eapolclient” prompt pops up. I click Deny and then I am able to connect to the Wifi with the new cert. I am wondering if there is a way to either always click Deny, or during these network authentications allow it to have permissions to the System keychain. Also if someone has a way to allow users to use our new certificate without even having to choose the new cert themselves, that would be even better. What I am trying to do is to minimize the steps that users have to do to connect to our Wifi with the new certificate. On the configuration policy, I only have the p12 cert and t

Hi! Looking for a way to disable the "Restart and show password reset options" as mentioned in https://support.apple.com/en-us/HT202860 We have firmware passwords set on our laptops (by policy the firmware password is only known to IT) and when a user clicks that, it gets stuck at the firmware password screen. Reboots go right back to the firmware screen. Unfortunately, with all the work from home, we can't just stop by to fix it. 

Hello,Before asking my question, I’d like to briefly describe our current environment:We are using Jamf Pro on-premises. MacBook devices are enrolled using the User-Initiated Enrollment method. During enrollment, a hidden local account named jamf is created on the machine. All devices are domain-joined, and FileVault is enabled. Users log in with their Active Directory (AD) accounts, which are configured as mobile accounts. Initially, we manually create a local admin account named support during setup. This ensures that both the support account and the user’s AD account are enabled for FileVault.Our security team has raised a concern because the support account currently uses the same password across all devices. They have

Has anyone had luck getting Accessibility to "allow" or "let standard user approve"?Similar to the post here https://community.jamf.com/t5/jamf-pro/enabling-privacy-accessibility-setting-for-ms-teams/m-p/245576#M230198 we've used the PPPC Utility to "let standard users approve" Screen Recording but does not seem to work for accessibility. We have a handful of apps that needs Accessibility to "allow" or "let standard user approve" for non-admins but cannot get it to work. Apps like MS Teams, Logitech Logi Options will not work for the "Accessibility" section. I've attempted to use the PPPC utility and though the other options work it's "Accessibility" that will just not work.

New behaviour in iPadOS 17 - when you only define a lock screen wallpaper and do not define the home screen wallpaper and you do not click the check box to use the same image for lock and home, iPadOS 17 now magically makes home and lock screen identical. (Huh? That's not what I asked for)I filed an Apple Feedback Assistant ticket and they said it is "currently functioning as intended".It didn't do this in 16.So what's the issue? If you make a reasonably great looking lock screen wallpaper it is totally distracting as a home screen wallpaper. The app icons become too cluttered with the background - there's no visual sense of depth to separate. If you use the QR code, it looks terrible on every page.The consequence is that you have to allow changes to wallpaper and you have to choose a plain style home screen. Then if you want your beautiful lock screen to stay "locked" so that students don't remove it you have to play the restrictions dance in both Restri

Hi All,  I am trying to remove the phone icon and nothing is working.  This device does not have a SIM card, it uses Wifi only.  I have tried adding it to a Restrictions profile where I am removing all other system apps and it's the only icon that is not being hidden.  I am also applying a Home Screen layout and this icon is not one of the icons I wish to display in that policy.  What am I missing?Appreciate the help! 

Instead of seeing iOS 19 and macOS 16 at WWDC this year on June 9, Apple is planning for iOS 26 and macOS 26. It's a similar name convention for automakers. Like the Toyota Camry 2026.   Other Apple Operating Systems will follow suit.  iOS 26iPadOS 26macOS 26watchOS 26tvOS 26visionOS 26 Thoughts? https://www.macrumors.com/2025/05/29/ios-26-again-rumored/

Do you have a naming convention for Smart Groups and Static Groups in Jamf as well as for iPhones and iPads?

HII apologize in advance if that question was asked but I cannot find answers :( I need to retrieve following information through API: 1. retrieve members through API from static computer groups - i need to list computer names that belong to specific computer groups.  All i'm able to find is how to list computer groups, but not how to retrieve members. # Endpoint to retrieve computer groups$computerGroupsUrl = "$jamfUrl/api/v1/computer-groups"# Request computer groups$responseComputerGroups = Invoke-RestMethod -Uri $computerGroupsUrl -Method Get -Headers $headers -ErrorAction Stop 2. retrieve members through API from smart computer groups - i need to list computer names that belong to specific computer groups 3. retrieve data through API from "reports" found under "Search inventory" 

Hi, Does any of you have a solution to synchronize all contacts from Active Directory and keeping them updated?While searching for a solution, I came across a post that suggested to have a shared Exchange account that would have all contacts stored, and add that as an extra account on all iOS devices. Is it possible to tell an Exchange profile to only sync contacts? If not, this is not an ideal solution in our case.Any ideas?

Like a lot of other Jamf admins I see a small number of Macs that have stopped checking in and sending inventories. I see some that appear to be having problems with MDM. I am curious about what everyone else is doing to solve these issues. Since we also use some other management agents I can see that a lot of the Macs that are having Jamf agent issues are working with the other management agents. They appear to be in use. I wrote a script that leverages the Jamf Management Framework redeployment API command. I was able to deploy it through Tanium to some systems that had stopped checking in and sending inventories. This has worked on some but not on others. For the systems having MDM issues, this may not work since the Jamf Management framework redeployment using the API needs MDM functionality to work. Here’s the current version of the script that I created.#!/bin/zsh --no-rcs:<<ABOUT_THIS_SCRIPT-------------------------

Student devices have had iOS 26 deferred until recently. They’ve been on iOS 18 until this month. But with the students finally upgrading the “Modifying wallpaper” restriction hasn’t been working as usual. They still can’t access the wallpaper menu in their system settings however when they press and hold to edit apps and widgets on their screen they can edit their home screen wallpaper from there. As a last ditch resort we can make a home screen layout payload but this locks in all app and widget customization. We have made and automated management action that will change the wallpaper every day but we do have some tenacious kids who continue to change it every day. Does anyone know another fix for this or maybe it will be something patched in the future? What would be really amazing is if they could restrict it so they cannot select photos but only pick the gradients or a solid color. but it doesn’

Hey,I am looking for a way to distribute Firefox Addons via Self Service …?The following Addon should be available in Self Service:Passwork Self-Hosted Extensionhttps://addons.mozilla.org/en-US/firefox/addon/passwork-self-hosted/?utm_source=addons.mozilla.org&utm_medium=referral&utm_content=searchDo I have to change anything else after the distribution as an PKG?How can I make sure that the installed Addon gets automatically updated?

Ninyo did a fantastic little article on update management with Blueprints. I just was hoping for some clarification on the process. I had setup a test blueprint just as spec’ed from the article and it doesn’t act the way I would expect.  I am using the Software Update Settings payload. It is configured with deferrals just like the article. I then go to “Computer Software Updates” and select the test group, select update, select “Download and Install” and “Install latest version based on device eligibility”. I can then see the update start to be queued on the devices Management pane.After 10 minutes an error appears on the management pane.OSUpdateStatus The client requested cancellation completed. 12 minutes ago

We use Snow as an asset management system and would like to use a smart computer group to target machine’s for updatesWe have created the package, a policy and also a smart computer group.The SCG has criteria of:Application Title - is - Application Ver - is not. - latest versionPackage Installed By Jamf → is not → YourPackageName.pkgOur current issue is that even though it looks like “snowagent” is the application title, the Smart group shows 0 completers when clicking View. If I do drop app tittle and app ver, then it does show the machines that do not have the Package installed.So but this still does not push out the pkg to these machines.Any help on what might be wrong would be greatly received. Thank youAdam

Lots of posts about return to service, but nothing I have found about the Wi-Fi profile  used in the Prestage Enrolment.As this profile cannot have anything except the Wi-FI payload (why??) There’s a workaround for Enterprise networks which have such things as a certificate payload.The workaround is to add the certificates to the profile after you have added the profile to the Prestage Enrolment. But when you go to save the modified profile, you are given a choice between sending to all devices or only devices without the profile.Well none of the devices have the profile yet, and if it’s a clone of your normal enterprise Wi-Fi profile, what will happen if you go ahead? Will you end up with two profiles with the same Wi-FI payload? I am reluctant to go ahead as changing WI-Fi profiles midstream is fraught...

Hi All,  Does anyone has a script for automate User, Email Address, Position and Department after enrolment?Thanks in Advances

I’m pretty new to JAMF. I’ve got JAMF Connect 3.5.0, Self Service+, and JAMF Connect Launch Agent 3.5.0 deployed on my Mac Mini test device. I deployed these so I could start working on Tahoe support. After upgrading to Tahoe, everything seems to be working fine, except I now have to log-in twice when rebooting. The first login seems to be Filevault for unlocking the disk, and the second is the Entra web sign-in window from JAMF Connect.With Sequoia and the older version of JAMF Connect that most users are on, they only have to log-in once with the Entra web sign-in window.I’m using all the same config profiles as the old machines. Is this expected in Tahoe or is there some config change needed to get SSO sign-in to cover both filevault and OS login? Also, I have to enter the username in the second login as well. I’m pretty sure this was pre-populated before. I’m not 100% sure if this was caused by the new JAMF Connect apps versions, or only after the Tahoe upgrade.

We currently have an instance installed on tomcat and working on getting memcached working.memcached out of the box works fine, but it supports TLS encryption.  When we enabled this, it appears that JAMF doesnt know what to do with the TLS connection.We will firewall off that port as suggested.  But TLS seems like a good idea.

Is there any expectation that the Self Service+ icon will be Liquid Glass compatible when using custom branding? This would be helpful for consistent appearances across the new macOS UI. I created a .icns file using Icon Composer that contains icons using our own branding for Default, Dark, and Mono themes but, I’m unsure if there’s a preferred or supported method to deploy these icons in a way that ensures compatibility with Liquid Glass design standard. 

Apple now supports Platform SSO during Automated Device Enrollment (ADE) in macOS 26. This allows users to authenticate with Entra ID directly in the Setup Assistant, create a local macOS account, and gain immediate SSO access to apps and websites.Currently, the Microsoft Platform SSO plug-in does not support this flow, and Microsoft has not announced full support.Could this serve as a workaround for first-time login on a JAMF-managed Mac?A possible setup using Entra ID:1. Start the Mac → Setup Assistant2. Sign in with Managed Apple ID (federated with Entra ID)3. Redirect to Entra ID → authenticate4. Create a local macOS user5. Enroll the device in MDM6. Configure Platform SSO later using the Entra ID user This approach enables initial device setup while allowing Platform SSO to be activated once the local user account is established.

Is there a way to prevent local administrators from removing the JAMF Binary with jamf removeFramework ? We still need local administrator accounts for our professors but don't want them to be able to delete the JAMF Framework.

Hi all,I’m looking for some advice on improving our macOS update workflow. Current setupRight now we’re using a mix of:Restrictions payload with no deferral for our tester group, 1week deferral for everyone else.Nudge -separate config profiles depending on whether we want to push a required update or just remind users.This works, but managing multiple profiles every time there’s a new macOS version isn’t ideal.What I’d like to achieve is: A cleaner process for forced updates for everyone when needed.A standard workflow where users get UI prompts to update (Nudge-style), based on our deferral policy.Ideally: define the update version and handle the user prompts from one place, without juggling several profiles. Does Jamf Pro offer any built-in way to handle both the update logic and user prompts together?Or is Nudge still the best option?If you have a setup tha