Yesterday, we mistakenly removed a number of devices from one of our device groups in Jamf. As a result, profiles and managed apps were removed from those devices. After re-adding the affected devices to the original group, the profiles were successfully reapplied. However, we've noticed an issue with some apps: in Jamf, several apps now display the status message "Removal Deferred. Will be removed on 17-06-2025."We've checked multiple student iPads and confirmed that this message does not appear to be associated with any specific app—it seems to vary across devices. We're currently unsure why this removal status is being applied or whether the apps in question are at risk of being uninstalled on the stated date.We also found that if we pressed 'remove' on an app that has this message it either puts it back onto the Jamf Student App or back onto their home screen if they had it installed. However doing this for all the student devices affected would be very time consuming! I have a

We've had a request to deploy Streambox Media Player to our video editors so they can use it on their M1 Max MacBook Pro's:https://apps.apple.com/us/app/streambox-media-player/id1329435619Despite this App saying it's for tvOS, iOS & macOS, when I purchase it through Apple Business Manager, it goes into the Devices App Store in Jamf Pro, meaning I can't deploy it to the Macs. I've tried scoping it to the User and logging into Self Service but still doesn't show up on their Mac Self Service App Store.Does anyone know how to scope Apps designed for iOS but work on macOS (Apple Silicon) to Macs in Jamf Pro?

Hello everyone,Is there a Terminal command to retrieve the email address used during MDM enrollment ?Context: I need it to automate the GLPI agent configuration, where the entity assignment is based on the user’s email.

I have been trying to setup a new Mac Studio and i am getting a Login but will not let me continue i have tried different user and password combinations nothing working i have even tried deleting from Jamf Cloud and readding to cloud nothing changed.Any ideas would be good.  

Hello, I would like to know if you know how to disable Web Filtering on Forticlient VPN, please? Indeed, we use Forticlient VPN in my company. We need to install a configuration profile to set up the Filter Socket; otherwise, without it, the user gets a pop-up asking to install the Network Content Filter. The problem is that we have just implemented Jamf Security Cloud, and we have deployed a Jamf Security Cloud profile on the computers. Most of the devices don't have the Secure DNS of JSC activated, and according to Jamf support, this is because Macs can only handle one filter at a time, and other filters need to be removed or disabled. But as I mentioned earlier, if we remove the Filter Socket from Forticlient, the pop-up appears every time Forticlient is used. Otherwise, if we cannot find a solution, we will have to stop using Jamf Security Cloud, which I find unfortunate. Thank you in advance, and have a very good day.

Hi all, I am trying to work on a solution to setup a splash screen at the login for our fleet. The idea is when users log onto macs, a splash screen pop up with a user agreement message that by "logging into the computer you abite with terms and conditions etc". I created a config profile with a Login Windows Payload and in the banner I copied the user agreement message, but since the message is too long you cant see anything unless you scroll down. I also created a little app using Script Editor and packaged it, then created a config profile to add it to Login Items. but I need a better solution. I am hoping if someone has done it.   Thank you

I'm trialling PSSO at the moment, appears to work well, and the workflows are fairly good in terms of steps to follow post enrolment.  There is a prompt after Intune registration to use passkeys and passwords from Company Portal - a toggle on requiring manual intervention, does anyone know if this is configurable with plist/other Jamf config?Also, we're only using PSSO to improve auth to Microsoft products, I'm seeing wholly conflicting statements around extending that to macOS logon itself - has anyone done anything with this, i.e. override and control OS sign in/password sync, etc.

At the moment, site admins are not able to create or edit any configuration profiles with the SCEP payload, when an existing one is selected or created by a Site Admin, the page just loads the spinning loading wheel and finally errors out after some minutes. Is there a permissions setting that needs to be selected for this to work for Site Admins? Full admins work without issue, thanks.

I'm sure there is something silly I'm missing, but I was doing a test of exporting our list of devices from our ACE agreement and then using that to populate the mut template to update jamf.  It seems to grab teh serial number and Coverage number and populates it, but it leaves the Coverage End Date (aka Warranty Expiration) does not populate.  It shows properly in the preview of what will change, but it doesn't update field in jamf.  I checked the verbose logs and it doesn't show any failures.  I did see in the field that it was putting a specific time into the csv field once I expanded the field to see it.  I've tried with and without the specific time.      

Back at it again with a (potentially) useful script.   This script is designed to extract all of the system scripts from your JAMF server. Why do you want to do this? Make a backup of your scripts in case your existing backup files is missing/corrupted (or you don't have one!) You inhereited a JAMF server from another person, and this can do a "brain dump" so you can review the scripts. Why not? It is another example of what you can do with API scripts.. Source: https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/BackupJAMFScripts   Welcome screen Process screen Errors screen if problems found:  

As many of you have requested, we have added the ability to change the benchmark mode (enforcement type) between Monitor only and Monitor and enforce, and also change the scope by selecting a different smart group. Editing of these settings works the same as managing benchmark rules - just open the created benchmark, make required changes, and click Deploy. Refer to the documentation if needed: https://learn.jamf.com/en-US/bundle/jamf-compliance-benchmarks-configuration-guide/page/Benchmark_Management.html Since compliance benchmarks is delivered into Jamf Pro as micro frontend, the new capability is available right away in all supported Jamf Pro instances!Looking forward to hear your feedback on the updates, and of course any general feedback on what is the next addition you would like to see.

Hi all,At System Settings -> Display -> Advanced -> Energy  you can this turn off or on  "Prevent automatic sleeping when the display" Any idea of this is possible to control this with Jamf? thanks  

As we deployed new AppleTVs we got the old AppleTVs back, some were not MDM enrolled (teacher donated). Now we are tasked with enrolling those OLD devices in our MDM. Mostly we were successfull in adding the devices to our MDM (via USB-C), but, we have a hard time with some Wi-Fi ONLY AppleTVs that were found in the mix. The apple instructions for enrolling the Wi-Fi only devices with Configurator 2 don't make any sence: Connect Apple TV HD using Wi-Fi   Apples instructions require the AppleTV to be reset/erased and left at the "Hello" screen, then, Configurator needs to PAIR to the device in order to process the enrollment, but, there is no Wi-Fi setup on the device...??? ... Anyone has any bits of advice? is MDM enrollment not possible on Wi-Fi only Apple TVs?

We have a handful of applications that are required to be on our laptops at all times. Currently, we have smart groups set with criteria for the app not being installed and a policy scoped to that group. The downside is it only updates when an automatic inventory update is done every day. Has anyone done something similar that runs more frequently?

saw this 3 times this week, pattern looks like a change in password, then MS authenticator shoots this up a few days later. using Jamf connect and entra integration,  reset MS office to complete deletion, no change, tried unenrolling, and re enrolling, cant do that at all... profile fails to install.    anyone else?    

I'm working with my mate AI, to write a clever script, to keep my kids in line from using VPN in the school, which will present them with any annoying re-petative pop up on their screen, when ever they engage the use of a VPN. it runs for 14 minutes on loop, running a 2 minute intervals check on if the local ip of the client, is within one of our networks subnets, and then checks for the reported current public IP from amazon, and if it doesn't come from one of our own, if it flags as being within one of our subnets and not with our public IP, it will proceed to prompt the end user, to turn off VPN, repetitiously, checking in every 3 minutes to see if the vpn has been turned off.basically they are using VPN to by pass, and play games in class, the constant prompt will ongoingly interrupt their games.its run every 14 minutes, so that next policy run, it will start over again. my issue is, I want it to run separately to the remaining polices, I want it to run the script seperate to

Hello, We are in the process of setting up Microsoft Defender for Endpoint on our Mac devices using Jamf PRO. We have been successful in doing so using the documentation provided by Microsoft. However, we are running into a few issues. We are unable to get the 'Valid User' and 'Configuration Status' to populate. See pictures attached.  

Hello all. When I use the following API point: --url $JAMFServer/api/v1/managed-software-updates/update-statuses/ I get a long list of info. This indicates I have permissions to access this data. However if I use "--url $JAMFServer/api/v1/managed-software-updates/update-statuses/filter=status=="installing" " I get a 403 error. Which is "Forbidden". It doesn't matter what filter I use, no go. Anyone know what permission needs to be set to get access to this info? Thanks.

Hey ya'll, I am currently in the middle of developing the process for converting my users over from using the Kerberos Extension to using Platform SSO on our Macs. I've got the profiles ready and all the local apps and such prepped to deploy, but when I perform the process I run into a few errors during the PSSO registration process. In particular I run into an issue at the end of the PSSO registration where it states that the "Sign in is currently unavailable", which does not happen when I enroll a device and have it go direct to the PSSO process and excluded from any of our KE profiles/policies. I was wondering if there is anyone here that went through the migration process and if anyone had any tips/tricks as to what they did to ensure a smooth user experience. I have every other piece ready to go and working flawlessly, just need to get my users in there and as we all know, the easier the experience is, the more likely users will do it quickly. Thank you!

Hello Teamwhile we expect inventory checkin to run every 15 minutes when device is On, this is not happening consistently for a few devices.Anyone observed this issue?

I have been doing some research into FV2 to see what it would take to encrypt all of my machines, but all of the information seems tailored for use in single user environments. What about multiple user environments? I have a lot of machines that are "public use," meaning that any faculty, staff, or student affiliated with my university can sit down and login with their AD credentials and get access. Given that many of these are part of a laptop checkout program, I would like to enable FDE in case they wander off. Is anyone else using FDE in an environment like this? How did you do the setup? Did you face any challenges along the way?

We are finding that when we run "Return to Service" on an iPad the location services is not turned on when it re-enrolls.  Because of this the date and the time is not set correctly.  Is there a way to force this to be ON, or a way to turn it on remotely?

hello all, I took advantage of Der Flounders excellent script to backup SS icons and made some enhancements to it.  This script is designed to extract all of the icons from all Self Service policies and store them on a local folder. Great for when Self Service starts to display generic icons...you can restore them with your backup. repo: https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/BackupSSIcons   Initial Welcome screen Progress dialog   Der Flounder's original script idea: https://derflounder.wordpress.com/2022/01/12/backing-up-self-service-icon-graphic-files-from-jamf-pro/

OK..this has been a couple years in the making, but I think I finally have something ready to distribute.  In our environment (probably like yours to), the users don't have admin rights (which means they cannot run Apple's Migration Assistant), so I had to come up with a method for an end user to backup/migrate their data to another computer if they want.  Designed to be run from Self service.... Source Code: https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/MigrationWizard   We use Microsoft OneDrive for our environment, but it can be used on SMB (legacy) networks as well...I used the tar method of backup, but can easily be adapted for rsync if you want to use that...   If you want to add/remove items from the migration list, it can very easily be done using the JSON blob construct (details on my website).  

Hello I am attempting to block the Mac OS Sonoma BETA my boss advised me that my restricted profiles i created are wrong i will post a picture of what i have done so far when i scope the restricted software to my test mac machine it always installs and downloads the sonoma beta not sure what i am doing wrong