Hi all, I've seen various threads on this, some dating back to years ago, and I was hoping to get some concrete suggestions on the most efficient way to go about this. We're wanting to deploy only the VPN, Umbrella, and AMP portions of AnyConnect, along with their respective config files from our organization. I've seen seen mention of using the Packages app, as well as Pacifist, but going that route leads to the com.apple.installer issue. I've tried a myriad of different things, but I can't seem to get it setup without issue. Any insight is greatly appreciated!

Hello, we use Cisco AnyConnect 5 on our Mac systems. The one feature I've been unable to get working so far is our VPN management tunnel. We have the management tunnel configured by an XML file on our Windows systems but I can't find any information on where exactly it should go in MacOS (we're running 13.5.2) or how I can use Jamf to push this profile to make sure the management tunnel connects, even before login if possible.Any suggestions?

Hi Guys,   I'm trying to deploy SentinelOne and followed all the steps in the HCSOnline PDF, but I'm still getting an error. I've attached a screenshot of the error. Any advice or help would be really appreciated! Thanks in advance!

Hey all, We’re currently testing Jamf Connect Login as part of a move to improve our remote deployment process. We haven’t previously used Jamf Connect at login. Currently, devices enrol via ADE, IT enters the user’s name and password, and setup begins with macOS Onboarding. This then installs the Jamf Connect menu bar app for password syncing, which works well - but we’re aiming for a more seamless experience, especially when sending laptops directly to staff. The goal is to let users authenticate directly with Entra ID (Azure AD) during setup, allowing the account creation process to be automated, reduce mistakes, and speed things up.   After that first login, we’d like the Mac to: Revert back to the native macOS login window No longer use Jamf Connect Login Keep the Jamf Connect menu bar app (Self Service+) running for password sync, SSO token refresh, etc. I’ve tested removing the config profile and LaunchAgent, which removes the settings — but the login window still s

Hi everyone, I'm looking for a reliable best practice for a common administrative task: automatically clearing the contents of the Desktop and Downloads folders for our standard (non-admin) student users every time they log in or log out of a MacBook. I attempted to resolve this by deploying a shell script directly through the Jamf School "Scripts" module. However, after pushing the script to the MacBooks, it did not successfully clean the files from the target folders upon user login or logout. Environment: MDM: Jamf School Device Platform: macOS (currently on macOS Sequoia 15.5) Target User Accounts: Standard, non-admin users Here is the script I used: #!/bin/bash target_users=("student_ac" "public_user") current_user=$(/usr/bin/stat -f%Su /dev/console) if [[ " ${target_users[@]} " =~ " ${current_user} " ]]; then find "/Users/${current_user}/Desktop" -mindepth 1 -exec mv {} "/Users/${current_user}/.Trash/" \\; find "/Users/${current_user}/Downloads" -mindepth 1 -exec mv

We like to use Patch Management for whatever we cannot patch with app installers but will use Patch Management for reporting even if there is an entry being used in app installers. Sometime early last week we noticed that Microsoft Teams was listed in patch management as having the latest be 25122.1207.3700.1444. App installers never updated and even this morning it still reports 25107.1606.3643.3915 while patch management says 25151.505.3727.5755 is now the latest. I'll give that a little leeway since it says 17 min ago. It reads to me like patch management has a system in place for Teams that keeps it on top with the latest version but app installers not so much. At any rate it seems a bit strange for patch management and app installers to not be in sync. On a related note Jamf Connect 3.0 was recently released yet patch management says 3.2.0 is the latest and there is no 3.0 listed. Jamf Connect Login is listed as 3.0.0 and so is Jamf Connect Configuration. This confu

Hi, I have the problem that my users often dont comply with some policies, like if they received a new device they have to return their old device within 14 days. Many of them just ignore that and my bosses are of no help here. Is there a way to just annoy them via a pop up or something so that they are more willing to return items borrowed from IT or their old Computers, when they finished migrating to a new one? Or any other way to apply soft pressure?

Hey all, I have an issue where I'm trying to write some automation scripts that cross-reference Mac app restrictions with Mac end users' device app inventories.   I can query for the list of 'App Store' Mac apps and also 'Restricted Apps', but not the Jamf Catalogue/Software Catalogue apps that we have added to my company's instance. I've looked into this and apparently the deprecated endpoint "api/v2/patch-software-title-configurations" bears a list of applications that have overlap with the Jamf App Catalogue.    Are there any current functions/endpoints or even workarounds that are able to get me this software catalogue?

Hi I've created this script utilizing the jamf API to wipe some 2015 intel MacBook Airs, but it's locking the devices instead of wiping them. I using the existing json format since the classic api's erase command has been deprecated. What am i running into here? ` #!/bin/bash # Define credentialsresponse=$(curl -v -u "GVC4_API_Admin_Migration:Change2025" https://gvc4.jamfcloud.com/api/v1/auth/token -X POST)bearerToken=$(echo "$response" | jq -r '.token') # Device IDscomputerIDs=(2403 2636 2619 2595) for comID in "${computerIDs[@]}"doecho "Sending erase command to computer ID $comID..."#curl -X POST \\#-H "Accept: application/json" -H "Authorization: Bearer ${bearerToken}" \\#"https://gvc4.jamfcloud.com/JSSResource/computercommands/command/EraseDevice/passcode/123456/id/$comID"curl -X 'POST' \\"https://gvc4.jamfcloud.com/api/v1/computer-inventory/$comID/erase" \\-H "Authorization: Bearer $bearerToken" \\-H "Content-Type: application/json" \\-d '{ "pin": "123456" }'done `  

Hey everyone, I need to get a list of installed software on our ends users' macs .. the way I know of is by going to computers in Jamf Pro dashboard => Search => Export => I choose the file type => Applications then I get a list of software installed but this one also contains the build-in apps like Weather, Calendar .. etc I can filter it myself but thought to ask and see if there are better ways to get what I want. Thanks in advance

How is everyone handling making sure certain apps are always installed on macOS? For example, we have an emergency notification/management app that every computer has to always have installed. We have done this two different ways and I'm wondering if there's something better.   Option 1: Policy to install the app and then do inventory update. Trigger is recurring check-in and frequency is ongoing. Scoped to required groups and an exclusion set to a smart group with criteria that the app is installed.     Option 2: Policy to install the app. Trigger is recurring check-in and frequency is ongoing. Scoped to a smart group with criteria the app is not installed.    I feel like both ways create a lot of extra overhead on the server and the device with all of the inventory updates and if the app reinstalls itself multiple times before JAMF catches the inventory update, especially with multiple apps that are required on the device. I think option 2 with a frequency ch

Hi Jamf Nation,I’m reaching out to this great community for advice and suggestions as I prepare to launch a Jamf consulting business focused on macOS management, automation, compliance, and security. With over 10 years of experience in Apple IT and recent Jamf 400 certification, I’m looking to turn my expertise into a service that helps organizations streamline and secure their Apple environments. My goal is to support companies in areas such as: Jamf Pro setup and optimizationJamf Protect deployment and alertingJamf Connect integration with identity providersAutomation of routine tasks and workflowsCompliance reporting and endpoint security best practices I’d love to hear from anyone who has started a similar journey. Specifically, I’m looking for: Tips for setting up your consulting structure (freelance vs. LLC, contracts, billing tools)What services clients value the mostLessons learned from your first clients or projectsRecommendations for tools or templates you use (reporting, doc

I’ve implemented Jamf Trust in my test environment and would like to clarify its primary function. Could you confirm whether Jamf Trust is primarily used as an authentication mechanism, or does it serve a different core purpose?

How are y'all tracking and deploying these ever more frequent updates? For point releases we use Nudge, but have not found a way to do so for rapid security responses. Also, the following is not populating. we are on jamf pro release 10.47.0 in a cloud hosted environment. I had thought that this would be reported starting in 10.46 with declarative management (which is enabled). 

We have a configuration policy that requires all users to set a password. When a user forgets their password, the only option I have is to log in using the JAMF managed admin account to reset the user's password. However, when I attempt to log in with the JAMF-managed admin account, the configuration policy for password reset kicks in, prompting me to change the password upon first-time login. If I change the password, it will become static and will no longer be part of the rotation. What would be the solution to this issue?

I found this script very useful and extracting the list of application usage in the Smart Group.  #!/bin/bash # This script uses the api to gather all serial numbers of a computer group and then gathers application usage data for that mac. # each entry contains User data so, multiple lines will exist for each serial. one for each application. # exported report is stored in a coma sperated spreadsheet. # Please see end of script for terms ### # Environment Specific Variables can be left blank if passing parameters from jamf ### # hardcode here for testing api_user="" api_pass="" jamf_url="" # A Jamf Pro computer group (static or smart) that contains the client for which you want a report group_name='' # Number of days in report (using today as the end date...) days= # Check for passed parameters from jamf if [ "$4" != "" ]; then api_user=$4 fi if [ "$5" != "" ]; then api_pass=$5 fi if [ "$6" != "" ]; then jamf_url=$6 fi if [ "$7" != "" ]; then group_name=$7 fi if [

Hello all, Been busy lately...this time I created a system script to display nicely formatted Swift Dialog notifications that you can deploy to scoped users., includes timers, and images if you want. my Repo Link: https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/DialogMsg #!/bin/zsh # # Written by: Scott E. Kendall # # Created Date: 01/227/2025 # Last modified: 01/27/2025 # # v1.0 - Inital script # # Expected Paramaters: # #4 - Title # #5 - Full formatted message to display # #6 - Button1 Text # #7 - Image to display # #8 - JAMF policy to load image if it doeesn't exist # #9 - Notification icon name # #10 - Timer (in seconds) to wait until dismissal ###################################################################################################### # # Gobal "Common" variables (do not change these!) # ###################################################################################################### export PATH=/usr/bin:/bin:/usr/sbin:/sbin LOGGED_IN_USER=$( scut

Hello Jamf Community, My team is facing an issue where multiple managed Macs (running macOS 15.4.1 and 15.5) are unable to connect to the internet. This problem was first noticed around 10:00 JST on June 15th. We're using products from the Jamf Business Plan (https://www.jamf.com/products/business-plan/), although not all of them. We've observed that disabling DNS Settings under Network > Filters in macOS settings resolves the issue. Non-Jamf managed Macs are not affected, leading us to believe this might be related to Jamf's configuration. The issue occurs on both recently updated Macs and those that haven't been updated recently. Has anyone else encountered similar issues? We're looking for: Confirmation if others are experiencing this problem Potential causes Recommended solutions or workarounds Any insights or suggestions would be greatly appreciated. Thank you in advance for your help!

Hey Gang, Back again with some major improvements to my JAMF Admin tools.  The new v2 now supports API roles (not just ID & password), along with some other nice features: Now you can backup your Smart & Static groups (with natural language context) Smart group exports will show the conditions in the same way JAMF show the criteria Static groups will export the members of the group Create contact cards or compose emails to specific group members JAMF Pro API Token support As well as these existing items: Backup Self service Icons Retrieve / Clear failed MDM commands Backup System scripts Backup Computer EAs Backup Configuration Profiles Full details are on my GitHub site: https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/JAMFSystemUtilities

Hi All, We currently aren't using any tools like Jamf Setup Manager or DEPNotify. I was looking to implement these, but wondering what type of impact we will experience considering Classic Self-Service will be deprecated eventually. We aren't zero touch because we go through a pretty hefty onboarding with the user on their first day. We still will manually be touching the Mac quite a bit, so this hasn't been a priority. Can any of these tools work with Self-Service+? Any concerns I should have about setting this up considering classic Self-Service is going away? Thanks

One of our agents locked a macbook via the remote lock command from Jamf Pro and did not record the pin.  One of our other agents then deleted the macbook out of jamf before releasing the lock. Now we have a bricked macbook that we have no way of getting into since we dont have reord of what the pin could be.   We are back and forth between Jamf support and Apple support to get this resolved.  Jamf says they cant do anything and Apple is saying it's on Jamf to remove the lock.   Any help here would be appreciated. 

Hello, Since MUT no longer works with a JSS instance using SSO authentication, do you know of any alternatives, please? I admit I'm a bit uncomfortable with API scripts. I need to create a static group with more than 500 devices 😁thank you

We currently use Okta SSO with Jamf Pro. Filevault is turned on for all our devices, which requires the initial local login. Then the next login is network credentials with SSO. Meaning, our users have to login twice. This works well, however we recently purchased Okta Device Access with the understanding that we could eliminate all logins for a passwordless user experience. I've been researching the ODA setup using Okta as a SCEP auth. I've read this would require all devices to be re-enrolled?  Has anyone gotten this to work with Jamf Pro to be passwordless? I've love to hear your experiences. Thanks!

Work within a school and looking to upskill the team on Jamf, we receive education pricing for Pro licences but can’t see anything about training. Is education pricing available or are we out of luck on that front?  

Hey there,    we are currently using Jamf School with approximately 4000 devices. After using shared iPads exclusively we implemented a 1 to 1 configuration in a couple of locations.  Everything worked well until the devices needed to be transfered to a new user.  Previously i assigned the profiles beforehand and users just needed to login with their Jamf credentials.  The iPad updated the name via information given by their jamf Account (%firstname,%lastname) and so on.    But i cannot get that login window on a previously used iPad for the life of me.  Even un- and reenrolling the device did not work.    Is there no other way of assinging a user but to use placeholders or manually assigning a user?    Thanks for your input!