I have some MacBooks that are pre-stage enrolled that have stopped checking in and stopped inventorying.  I have others that are User initiated enrolled that stopped checking in but I just had them remove the profiles and redo the enrollment and they are working again.  These are all remote users so I cannot be hands on.  I had a few of the pre-stage enrolled devices attempt to run sudo jamf recon and sudo jamf policy from terminal but they are receiving "Device Signature Error - A valid device signature is required to perform the action"  Other postings I've seen that are quite a bit older mention unenrolling devices and reenrolling them.  Not really an option if they are pre-stage enrolled from what I understand.  Does anyone know what I can do get these devices reporting properly?

We use Jamf Pro and have an integration with Conditional Access to register Macbooks within Microsoft Intune.We have recently started receiving this error message and have not been able to resolve it. Who can help me think about how we can tackle this issue?

Hey all - Ran into a thing that has been mentioned before, but it was a year ago and a few Jamf Connect login versions ago. We are now up to 3.6 Had a user who had their Microsoft Authenticator switch from sending them push notification to enter a number to requiring her to enter the 6 digit number. She would get the Jamf Connect Login window and enter her MS login, PW and the 6 digit 2FA code. The Jamf Connect Login window would stay up, but load her profile page. She would also see an error that password needed to be at least 7 characters, and contain one number and one alphanumeric character. It took me a VERY long time (and a computer wipe) to figure out that it looks like the Jamf Connect login window is passing that 6 digit number to the OS for login instead of the users Password.  Once we reset her Authentication Methods in EntraID so that the push notification workflow returned, her login issues on her laptop went away. 

I am a jamf admin working on getting our enrollment modernized. Within the last year we got our connection setup with ABM and Jamf so that our devices will have automated enrollment during setup. The issue we are running into is that our company requires all devices on internal network to be trusted (typically using a certificate)Since the enrollment is happening during the setup experience, I cant see how there would be a way to get the device the certificate before reaching out to our enrollment server. If we are on internal we get an immediate block. We have to connect it to an external network to enroll.  I put in a request with our security team and after some back and forth I asked if our specific enrollment URL could be allowed access on the network without being trusted. Understandably they are not too keen on this idea. I can’t find anything from jamf on getting around this, has anyone had a similar experience in their enterprise on anything like

Hey folks! Dropping in for another quick Self Service+ post on how to: determine available URL schemes for a macOS app (in this example, Self Service+.app) how to map policy URLs from Jamf Pro to the new schema and have the actions load within Self Service+ The Self Service app has historically supported URL schemes to automatically run a policy or open the app directly to a description of a given policy. Within the Self Service settings of an app policy in Jamf Pro there are installation and description URLs provided. Those URLs tie into URL schemes for the Self Service app, and can be launched in scripts and by sharing them directly via link.

Hi I’m trying to set a wallpaper for Apple Tvs in a school. I’ve set a configuration profile which locks the Apple TV in the conference display mode. I’ve also created a smart device group where i’ve uploaded a test jpg file, but it doesn’t want to pickup the wallpaper. Does anyone have have suggestions?

Hi, I want to deploy an initial default Dock layout after enrollment is completed, where the end user can later change it to whatever suits them.I’ve heard of multiple methods, such as using Dock items in Jamf Pro settings, scripts, Outset with docklib, and dockutil. I was wondering what the easiest and most hassle-free approach would be as an MDM administrator. Thanks in advance.

We are having problems with apps signing out  each time our students try to to use them on their iPad. They sign in with Google Single Sign on or use the QR code. As an example our students use the IXL app, sign in with google sign in and the next day they are signed out again. Does anyone have this problem or have solution on if something set in JAMF School would be able causing this problem?

Hi everyone i'm trying to understand the best way to configure Jamf Protect with our jamf instance. I set up a smart group in jamf to alert users about security issues and that works fine. Unfortunately the jamf protect documentation is a bit incomplete imho. What are the next steps i need to follow? Any suggestion or guide to suggest? Do i need to manually remove the mac from the smart group? Jamf Protect has some removing capabilities or i need to clean the mac manually?

Took me awhile to discover this and could not find a solution anywhere in Jamf Nation so thought I would post my solution I used. I have several Extension Attribute scripts that require a user to be logged in (including 2 provided by Jamf Onboarding, Jamf Connect First Run and Entra Registration statuses). Problem is if Inventory Update runs when no user is logged in (yes, this happens) the script does not detect current user so it cannot access current user folder to check plist file so it updates the EA to Not Found losing the Entra Registration completed or Jamf Connect First Run Completed (or any other EA that uses user directory).I created a script to detect if user logged in and if not to use a cached status created/updated from previous run when a user was logged in. Hopefully this helps someone else or someone else has an improvement to it: #!/bin/bash# 1. CREATE EA CACHE# Set this to match your EA name exact

With Apple recently expanding access to the ABM/ASM API, I set out to recreate the GSX experience. By leveraging Jamf’s new MCP feature, Claude Code, and MUT, I believe I’ve come very close. Additional details are outlined below.Please visit the following Github repo for the latest version of Warranty Wrangler: https://github.com/brndnwds6/Warranty-Wrangler/tree/main Warranty Wrangler — Setup & Usage GuideThis guide walks through everything needed to run warranty_wrangler.zsh, a script that pulls warranty and AppleCare+ coverage data from Apple Business Manager (ABM) or Apple School Manager (ASM) and produces CSV files ready for import into the Mass Update Tool (MUT).PrerequisitesA Mac running macOS Administrator access to Apple Business Manager or Apple School Man

Any on know how often is the built in Jamf External Applications repository updated in Jamf Pro?Also is Jamf pulling these from https://github.com/Jamf-Custom-Profile-Schemas/ProfileManifestsMirror?I noticed com.microsoft.autoupdate2.json was update on the github Feb 17 2026 but is does not seem to be updated in the built in Jamf External Applications repository (still says Revision: 2024-12-13)  

Hello all you Jamf Rockstars,I was building a new package and decided to add the script I needed to run at the end as part of the package instead of a separate component in the Jamf policy.  When I tried to deploy it I got “Installation failed. The package could not be verified.”Turns out this can happen when Gatekeeper rejects the package because the package is unsigned, and included a postinstall script.Composer has a setting for signing packages, I do not have that configured.  There is also a field for “Default Bundle Identifier” under the advanced tab. Is anyone signing their packages?  Do you use a third-party cert?Are you populating the “Default Bundle Identifier”?  Thanks in advance,-Pat

With the update of iOS 26.4 there is now a prompt for age verification in the UK for content. Most of our managed phones do not have apple id’s associated with them and all apps are distributed through self service. Is there a blanket way to say all the phones are with users who are over the age of 18 to avoid having to deal with many service tickets.

Hello,I am trying to update our method of deploying out the essential sounds for GarageBand through Self Service. In the past, I had leveraged the Carl Ashley AppleLoops script (it worked great!). After Apple removed Python from the base installation of macOS, I had been limping along with installing Python on the devices that were needing the sounds. This has posed other complexities.Currently, I am testing out installing all of the sound packages needed for the Essential Sounds from a cached copy of those packages on the laptop. This has not produced the desired results yet. The user is still prompted to install the sounds when launching GarageBand. All of the sounds that should be available from the Essential Sounds are present in GarageBand. The loops have also been reindexed in hopes that would resolve the issue.I would appreciate any help that anyone has to offer.Thanks!

Has anyone successfully implemented Epic Bedside using JAMF? I have the MyChart URL but anything after that I am lost. If so I could use some help with the AppConfig for Bedside. Epic has not been much help and our Epic team is not familiar with the values needed. Here is the only information Epic sent us. Work with your MDM representative to pass your MyChart server URL to hospital-owned tablets so the tablets can be activated with a numeric code. The MyChart Bedside application must be updated to version 10.9 or higher to receive the server URL. Pass your MyChart URL to the Bedside tablets. The exact setup to include the MyChart URL in the managed app configuration varies, so you should refer to your MDM system's documentation to determine how to provide the configuration value. Add the Configuration Key of MyChartURL to your sent configuration o

I'm trying to configure the app request for our iPad users but I'm not seeing the App Request option in the Self Service app.  I'm testing this on myself. So far I've... Created a static group and added myself to it In Settings > Self Service > App Request App Request Form > Checked "Enable App Request in Self Service for iOS" App Request Form > Added some request form fields and set the App Store Country/Region Requestors and Approvers > Set the Requesters to the static group Requestors and Approvers > Added myself as an Approver Email Address In Settings Self Service > iOS General > InstallType = Automatically install Self Service app General > Checked "In-house app updates" General > Landing Page = Home App Options > User Login = Allow users to log in to the login menu Signed into the Self Service app

Hello all,   I am working on deploying the updated company wallpaper.  Current attempt is using the script below, but it gives the user a that “Jamf wants access to control Finder...” (screenshot attached). Maybe there is a better way to do this. #!/bin/shcurrentUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}')sudo -u "$currentUser" -H osascript -e 'tell application "Finder" to set desktop picture to POSIX file "/Library/DesktopWallpaper/backgroundDefault.jpg"'exit 0 

Update your iPhones and iPads right now’'Darksword' exploit just went global: Millions of iPhones now wide open to hackersiPhone exploit DarkSword has been released in the wild | Mashable

Hi, everyone!We are in the “Pilot” stage of our Self Service+ deployment.  For the most part everything has run smoothly while deploying as a policy to our “test” group and our “pilot” group.  I scoped the policy to our “pilot” group on 3/23/26 and did not receive any reports of any strange activity or concerns.  However, this morning, three different users reported seeing a Self Service+ pop-up when they logged into their machines for the start of the work day.  When my colleague and I were testing this policy on our test machines, we did not see this pop-up or anything else happen out of the ordinary.  I know that this is considered  “expected behavior” but, I would like to figure out why it has only happened for three spereate individuals and no one else (as of yet).Has anyone else experienced or heard of this pop-up occuring on there end?  TIA!-Michael G. 

• https://support.apple.com/en-us/100100• iOS - 30+ CVEs patched• macOS - 70+ CVEs patches

I'm trying to upload a signed config profile and I keep getting "Unable to create object from file." It worked a few months ago, but I had to change the name. I changed the UUIDs, there is no duplicate named profile and the unsigned profile uploads fine. I tried both a couple signing certs I have in Xcode as well as creating a signing cert using these instructions.I can install the profile fine locally:We're running 10.41.0-t1661887915 in the Jamf cloud.

We have configured Jamf with Nudge. The action button Update Device launches the Self Service policy for the minor update of the current OS. However, with Self Service+, this does not work. The Self Service+ app launches, but the policy never begins. It simply spins. With the old self service, it works without a problem. This is a bit of an issue because it then becomes more difficult to enforce compliance with Nudge. Anyone has a solution? Thank you.

Hello, We have had "device compliance" for MacOS configured since August 2024 and it appears to be working correctly. I just enabled the iPadOS/iOS option and the test device appears in the Device Compliance = Compliant smart group in Jamf but continues to show as "n/a" for compliance in EntraID. It's been half a day and the EntraID compliance status has not changed. How quickly should the compliance status get updated in EntraID and is there a way to sync Jamf with EntraID to update the status? Is anyone seeing this work successfully?Thank you. 

Hello For those running MacOS 26 how are you deploying background security improvements?Blueprints doesnt seem to understand the format. https://support.apple.com/en-gb/111333I could find anything in Jamf blueprint documentation either.  thanks