I figured this would be helpful here. We use it to remotely grab logs from a Mac. Throw the script in a check-in policy and assign a computer to it. At next check-in, you will have their logs.This script will output the network quality. It then uses the API Role/Client 'Computer Attachments' (Update Computers, Read Computers, Create Computers) to pull the JAMF Computer ID using Mac serial number. It then runs sysdiagnose to create logs. It will then upload the logs to the Attachments section in the JSS portal. I set access token time to 300 because the file it uploads can be 400MB.Logs can be then downloaded from JAMF - Computers - Computer - Attachments.#!/bin/zsh --no-rcs## AUTHOR: Joshua Clark## DATE: 09/06/2025## PURPOSE: This script uses the API Role/Client 'Computer Attachments'## to pull the computer id using Mac serial number. It then runs## sysdiagnose to create logs. It will then upl

Hello guys, i am affected by the MS latest security patch Microsoft Active Directory Strong Certificate Mapping Requirements. My devices cant connect to wifi via certificates after the latest patch. My devices are not in domain, also users are local , so when i tried the objectsid Extension attribute it didnt work even though i have cloud idp as azure connected and i guess its because  users are local. Do anyone have any idea how to tackle this :) Can we use UPN or some other attribute for macbbos that uses local user account and not in domain?

Hi So i’m working in school where we are setting up Apple Tvs we  wanted make slideshow, although github is a good shout it is too public to use, is there any private websites that follow GDPR that could be a good recommendation? I was thinking about sharepoint, but not sure if that would work

I know JNUC 2025 in Denver isn’t even out of the gates yet but I enjoy speculating about future things.  Many people seemed to think it was Denver before it was officially announced.  It seems JAMF likes state capitols so far.  My wife is even interested too since she normally pops along with me.  The top 5 most populated state capitols are:Phoenix, AZ Austin, TX (JNUC 2023) Columbus, OH Indianapolis, IN Denver, CO (JNUC 2025)I have no knowledge of where, I just enjoy speculating.  My wife hopes it will be Boston.  I’d hope for Salt Lake City personally.  My bet is on Indianapolis though.  Just a guess though.Any guesses, insights or desires for a future JNUC (next year or beyond)?

If I turn off our current Cloud Identity Provider configuration with Google, will that remove the existing attributes from users’ User and Location fields in their profiles? My understanding is that it won’t, which would be a good thing in my case. I’m transitioning to Okta LDAP and want to make sure the current attributes remain, since I have smart groups based on department fields.

I have a custom script that I use to upload an ipa file to an in-house Jamf Pro mobile device app. I am using the endpoint: {URL}/JSSResource/fileuploads/mobiledeviceapplicationsipa/id/{app_id}?FORCE_IPA_UPLOAD=trueThe file does get added to the app in Jamf correctly, however the upload will stop at 99.9% or 100% and just hang until my timeout limit has been reached. So the script throws a timeout error. I have a check for a timeout and then check to see if the file exists in Jamf after, but this feels like a weird workaround. Am I doing something wrong? Why is Jamf not responding with a success 201 after my POST?

Does anyone have any SwiftDialog progress bar .sh examples they’re using during PreStage enrollment to enhance the end-user experience? I’m working on improving our setup workflow and would love to see how others have implemented theirs.

We have not transitioned to Jamf Self Service+ and Jamf Connect 3.x due to concerns about potential confusion among employees and the need to train them on resetting passwords and utilizing the new Self Service+. I perceive Self Service+ as a separate application that is not seamlessly integrated into Jamf. Additionally, our current Self Service is customized with our logo, which the new version does not support, which I guess is a minor inconvenience. Since Self Service is placed in the Dock during enrollment, switching to the new version would require reconfiguration using DockUtil. I am cautious about adopting it and would like to see if Jamf will replace the existing Self Service. Furthermore, Jamf Connect 3.x removes the capability to sync or change passwords via Intune, necessitating the installation of Self Service+ for this functionality. I am curious to know how many others are postponing this transition. Ideally, Jamf would update the existing Self Service to

Hello Nation, got a request to install the Cyberark Chrome extension. no problem there. Request was made to per-configure portal URL. Cyberark gave very vague instructions on how to create this. Asking if any one has already deployed this. I am assuming it would be additional keys inside of the  extensionforceintsall  settings but have no idea and have not been able to track at least something similar down. already had the team open a ticket with Cyberark to at least send a vanilla profile. thans in advance for any assitance

My organization uses Jamf Setup and Jamf Reset for our users to sign in with their SSO account with Microsoft Entra ID. The user will sign in with Jamf Setup at the start of their shift and then sign out at the end.   However, Jamf Reset frequently does not fully sign the user out of their SSO account, leading to the next users unable to log in.   I have found that a power cycle and attempt to sign out using Jamf Reset usually fixes this problem.   From what I can tell from comparing our Jamf Reset App configuration and "Managed App Configuration for Jamf Reset" documentation on learn.jamf.com, we have the standard configuration set up.   Has anyone else ran into issues with Jamf Reset "hanging up"?

I’ve federated our domain.  We never had any conflicts.  I have to assist a client with capturing their domain - but we already know they’ll have conflicts.I know the end user will get an email and have to create a personal account, but what happens on the device? A person creates a new iCloud account - does the login on the device auto-switch to the new account?I’d take an educated guess Apple does their stuff to make sure purchased content moves to that account.Do they have to sign out to get to the managed ORG ID?Question is - does the device automagically become the managed ID - or do they have to sign out / into the captured ORG ID?If it’s the latter, does their purchased content get purged from the device? Or is it more of a BYOD situation where they’re logged into both?

Hello everyone, After spending hours digging through forums trying to find a reliable way to fully automate the AVID NEXIS Client Manager installation on macOS, I’m sharing this step-by-step guide to save others the same trouble I went through.Unfortunately, Avid doesn't provide much help on this topic, so I hope this helps streamline your deployment.I’m aware that this isn’t the most secure or ideal approach, and there’s definitely room for improvement — but it works for us.If you have suggestions or improvements, feel free to share!If this can help new Mac admins or anyone else, all the better! Useful resources I consulted: Managing Legacy Kernel Extensions in macOS Using

At the begining of the year we set up a Jamf Migration app with and .mobileconfig profile to assit users in moving thier company managed machine from Mosyle to Jamf. I recenlty updated the .mobileconfig profile to extend the removal date however Im experiancing an new issue that  once the profile is installed and we try runninf the migration app I get a new error stating the jamf Migrate could not enroll in the destination JAMF Pro Server. What would be the next steps to resovle this? 

We have some entra integration in our environment. We use connect, have enroll enrollment customizations, etc.  The issue I’m having is while I can see AD groups, it seems jamf can’t see memberships (I’m assuming). When I attempt to scope a policy/config profile to an AD group (scope to everyone, limit to the AD group), it still goes to everyone with no limiting. I’m sure there’s a setting I’m missing. Has anyone seen this?

Our school district would like to defer the upcoming macOS 26 upgrade (scheduled for release on September 15) but still allow security updates for macOS Sequoia.What is the best way to configure this in Jamf Pro so that the major OS upgrade is blocked, while security updates and minor patches for Sequoia remain available? Thanks  

Hi everyone,we are currently trying to figure out how to deploy apps which are only available in specific regions, e.g. Shopee (which is only available in some Asian regions if I’m not mistaken). In ABM, we can only find apps from our origin region.I cannot really find any resources on this topic. Does anyone have an idea on how to achieve this?

As part of my rollout of platform single sign-on I created a script that checks the user’s password expiration date so that we can alert the user that their password is expiring within 14 days. I want the script to run once a day. I created a launch daemon to run the script. The script and the launch daemon get installed on every Mac with PSSO setup. If the user’s password is expiring on a date that is more than 14 days away the script slimply logs the expiration date and how many days are remaining. The problem I have run into is that if the Mac is not currently connected to the internet when the launch daemon runs the script, there will be no results from the password expiration check with Microsoft. How can I get the launch daemon to run the script again? Currently I have the launch daemon configured to run at a specific hour and minute daily. The deployment script that writtes the password expiration check script and the lauch daemon takes note of the current hour and minute and

Looking for some guidance with Jamf Pro - PreStage Enrollment and FileVault.The issue: In PreStage, we pre-create and hide a local admin account. During setup, the workflow prompts for end-user account creation. FileVault is enabled immediately after the user account is created and the user logs in for the first time. As a result, only the end user is added to FileVault , the local admin account is left out of the FileVault enabled users list. I haven’t found a way to ensure the local admin is automatically included in FV2 during enrollment.Should this be configured differently in PreStage, or would scripting the local admin addition after FileVault is enabled be the right approach?

I remember before the renovation of jamf dashboard there was an option to clear all users on shared ipad. Now with the new dashboard I didn't find it, can someone tell me where was that option? Thank you,

Hi, Tried to enable memcached across 3 servers. config as per documentation. memcached is communicating , however, i'm getting this error on the non primary servers  Type Status Report https 404 - not found   Description The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.

Right. Where do I begin.... I am going to try and be as constructive as possible rather than just complaining. We've been running Jamf Pro (currently 11.4.2) for almost two years. Since day one we had issues with out of the box or EACAS Macs fully completing enrolment. The usual state they would end up in was for the profiles to install fine, VPP apps to install, etc, but for no policies to run nor for Self Service to install. When I looked on Jamf Nation and other sources I saw that this can sometimes happen and so because I'm a scripting god I came up with an amazingly complex script that is installed as part of an PreStage Profile's enrolment package workflow. The script does the following:/usr/local/bin/jamf policyThis immediately caused enrolment to complete, the Self Service app appeared in /Applications and everything was once more right in the world. A reboot would achieve the same, but we didn't want to randomly reboot the Mac halfway

I have discovered a new problem, new computers enrolled in jamf using Dep and onboarding are not fully enrolling also computers that are already enrolled when an inventory runs the computer record is not updated, looking at the logs the last inventory should have updated on the 11th / 9.on new Macs I can run recon, policy manage and renew profiles and even push the framework from the api they still don't get an enrollment complete policies and profiles get installed but no apps,on already enrolled Macs everything works except the inventory does not update I have tried stripping back the enrolling all different Macs also different networksthe jamf management daemon is not installed also self service does not launch bellow is a log from an new enrolled computer Sun Sep 28 03:12:45 iMac jamf[1139]: The SSL Certificate for https://xxxx.jamfcloud.com must be trusted for the jamf binary to connect to it.Sun Sep 28 03:12:45 iMac

Good day, all! I have a couple of PreStages set up to configure newly purchased Macs for our environment that utilize JSM to install apps and configure the systems. I want to now tackle Macs already in our environment by having the customers, or our technicians, manually enroll them via the web, chiefly because they’ve already been in use and configured, and wiping them to put them in ASM isn’t an option. I want to utilize JSM to do some configuration and prompt for inventory information (ID, email, location info, etc.). Based on this discussion thread on JSM’s GitHub (https://github.com/jamf/Setup-Manager/discussions/88), I know that it’s possible to use JSM for user-initiated enrollments. My problem is that I cannot find anything on how to actually do it. Anyone out there have or know of a site, documentation, group discussi

Hi all       I’ve got an problem with my Jamf deployment at the moment and the way we use our iPads. Essentially, our filtering and monitoring solution relies upon an app being running in order to re-connect the filtering VPN if disconnected. When teachers restrict students to a specific app or apps, the filtering and monitoring app gets disabled and thus the VPN disconnects.Is there a way to force an app to never be able to be disabled by Jamf Parent or Jamf Teacher? ie. I’d like it so that if a teacher says “Right, no more anything other than Goodnotes” the filtering and monitoring app is not disabled and continues to run. Thanks in advance for any advice with this.

Does anyone has a way to setup MS Outlook 365 as default mail app? If you want to setup it manually you have to do it in the Mac mail app, although you never used it. I have to send out something to the organization with an mailto: link and I do not want all people calling me to ask why Mail is opening instead of Outlook. Additionally it would be nice to set default programs via config profile in Jamf pro. Thank you for your help.