We're rolling out a couple of iPads in Single App Mode with a kiosk app and that's working well. However, we need to manage OS updates as well. Does anyone have a workflow that allows for automatic OS updates for devices in Single App Mode? I would also be fine with a process that be scheduled for an overnight maintenance window.

I recently installed Jamf Safe Internet on my device, I seem to be facing an issue that I'm hoping someone could help me with. I've been having trouble accessing certain websites. It's not all websites, but there's a handful that just won't load anymore. I've double-checked my internet connection, cleared my browser cache, and even restarted my device a couple of times, but the problem persists. Has anyone else experienced a similar issue after installing Jamf Safe Internet?

Is it possible to enroll macOS, but to not install SelfService app? For example, I want for some devices install only Jamf Protect app without any configuration profiles and apps.    Additionally, I see there is SelfService+ App, it is the same that default installed?

I've been following the directions as per https://school.jamfcloud.com/api/docs/#api-Devices-Assign_owner and PUT to https://{yourDomain}.jamfcloud.com/api/devices/:udid/owner with all the relevant information but no matter how I send the request with the user parameter, it returns a code of 400 with the message "UserRequired".I've spent a whole day trying every variation of submission and multiple programs and methods and the result is the same. Has anyone got any pointers?  

I have a computer that we created the user account with Jamf Connect. Once in the user account, we can't open self service. I removed self service and reinstalled it with Jamf policy command. It still won't open.  To clarify what I mean but not opening, I click to open it from the applications folder in finder. It shows in the dock then goes away. I get the report option. So it is crashing at launch. I deleted the user account and created it through system settings and still have the same issue with self service. I can open self service in the admin account.  I'm not sure what else to try. 

We have noticed that on some of our Macs the computer's name is getting added to /etc/hosts. This isn't having any negative effect on the operation of the Mac, but it does cause an issue with Tanium which queries the computer name as part of its data gathering tasks. These Macs display in Tanium as "localhost", not the name that is actually set for the Mac. We use the Mac's serial number for computer names. During initial setup, a policy runs "jamf setComputerName -useSerialNumber" I created an extension attribute that reads the contents of the hosts file and reports if the computer name is present. There have only been about 30 out of 1500. I created a script to remove the computer name, but on some of the Macs, the computer name has reappeared in the hosts file. Since this doesn't happen on all Macs, I'm not sure what could be doing this. Does anyone have ideas on what might be doing this?

I like Jamf Self Service+.  It's a clean interface.  Currently I don't see a way to rename it like the current version of Self Service.  We rename Self Service to Software Center to make it familiar to those that go between Windows and MacOS.  Also, while Self Service+ is nice, it doesn't seem to offer any current major advantages over Self Service at this time so we haven't been deploying it.  I don't really want to have two versions of Self Service to confuse our users. Is there any plans to make Self Service+ as an automated install like the current version of Self Service?  And will we be able to change the name of the app like we can do with Self Service? I'm also failing to understand what makes Self Service+ any better than Self Service other than the UI overhaul.  A recent email I received said it has identity management capabilities but you can also log into Self Service. I understand Self Service will be sunset at some point so would I be co

Hello We recently updated our Mac estate to MacsOS 15.I have noticed issues with taking screenshotsWe deploy two base profiles one for staff devices one for shared lab devices.Both have Allow screenshots and screen recording (macOS 10.14.4 or later) set under Functionality.The shortcut key just does't seem to do anything but works fine on staff devices using the same setting.I dont belive Im blocking it elsewhere.Any idea Thanks Capture a portion of the screen Press Shift-Command-4, then move the crosshair pointer to where you want to start the screenshot. Press the mouse or trackpad button, drag over the area you want to capture, then release the mouse or trackpad button.

Is this blog still accurate for version 16.3? Any changes or modifications needed for the newer version?Deploying Xcode on managed devicesConfigure Xcode post installation script with SDK download for Xcode 14 and 15 · GitHub

How can I enable two-factor authentication (such as SMS or email verification) after entering username and password on the Jamf Pro login screen?

It's strange that I've been dealing with this for the last 10 hours, and it's been completely unprofessional

After upgrading to macOS 15, all devices are unable to install offline configuration files (.mobileconfig or .profile). The system displays the error: "Could not install 'FileProvider' payload. Configuration profiles must be installed via a Mobile Device Management (MDM) server." Has anyone else encountered this issue? Any solutions would be greatly appreciated. Thank you very much!  

Hi All, I'm working with a vendor to deploy their PLM software plugins to our Mac users. The vendor says they can't create a better way to deploy their plugin because their clients "use different methods" to deploy and, essentially, they can't be bothered with it. Since upgrading to Sequoia, I've noticed that their custom .app's don't open without manual interaction in Privacy & Security settings. Does anyone have suggestions/advice whether a silent install is even possible? Thanks, R

I was able to get the Jamf Return to Service app working on an iPad, perhaps a bit too well... Once the iPad reboots, it self-enrolls fine, but it loses all Static groups it was in. I then have to manually re-assign the iPad to the Static groups it needs for proper configuration and app access.   Is there a way to make Return to Service work so that it wipes the iPad, but then puts it back into the Static groups it was in? I noticed the wipe and repair option with Apple Configurator does not have this issue (keeps static groups after resetting).

Since we upgraded to sequoia, we had to update our Nexthink version, because the install was failing on enrollments. After changing it and enrollig a sonoma device, it works and shows in nexthink. When we enroll a mac on sequoia, it looks like it installs on the device, but never shows in nexthink.

Hello :) because I'm still struggling with Jamf Connect for testing Onelogin. I'm using the latest version of Jamf Configurator (2.9.0) Please note, for my test instance, I didn't configure MFA for Onelogin. I don't know if it's the OIDCTenant or something else why it's not working but I tested already these things for OIDCTenant. Error message from Jamf Configurator: " Unable to load Identity Provider "Error message from Onelogin: "OIDC authorization code for Jamf Connect FAILED" Onelogin-Client ID<companyname><companyname><companyname>.onelogin.comlogin.<companyname>.onelogin.com/Client-ID <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>CreateJamfConnectPassword</key><true/><key>OIDCClientID</key><string>Onelogin-Client-ID</string&g

I have been busy at work lately with some more scripts!  This one is a dual purpose app. If you pass the word "info" in the 4th parameter of the script it will inform the users of their laptop battery status, if you pass the word "fail" in the 4th parameter it will let them know that their capacity is below 'x' amount (You determine failure by a smartgroup) #!/bin/zsh # # Written by: Scott E. Kendall # Created: 2025-01-15 # Last Modified: 2025-01-15 # # Prompt user if battery needs service # ###################################################################################################### # # Gobal "Common" variables # ###################################################################################################### export PATH=/usr/bin:/bin:/usr/sbin:/sbin JAMF_LOGGED_IN_USER=$3 BATTERY_CONDITION="${4:-"info"}" LOGGED_IN_USER=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) USER_DIR=$( dscl . -read /User

iPads generally do not go home with students so there is not a need for the Jamf Parent app. I want to see if there is an easier option for teachers to have their students assign themselves iPads for better tracking and management. We use most iPads for K-1 only.  I'm curious if there is something like this, similar to Clever where students scan their badge to access the app, but in this case, they scan the iPad to assign it to themself and the data is synced into Jamf School and goes away if iPad is wiped, etc.  This would also help with our asset management API.  Thank you

Hello there....We're migrating all our clients, windows and mac to microsoft defender for endpoint. For the mac clients id like to use the policies in the microsoft defender portal to keep them in the same place as the windows clients, which will hopefully make support a bit simpler.I've followed the instructions in the link below,  the mac I'm testing on shows up in the defender portal and I've created a mac endpoint security policy assigned to a group to apply. The problem is I cant add the mac to the group in intune as it doesn't exist.I'm sure I've missed something, i can see there are ways to connect jamf and intune but I'm not sure what is the recommended way, does anyone have any info that might point me in the right direction?Any help would be much appreciated  Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro - Microsoft Defender for Endpoint | Microsoft Learn

Dear All, First of all would like to thank in advance any help or advise regarding this.   To put you all in a little bit of context on our environment we are using a Configuration Profile including "AD Certificate" Payload and Network Payload to configure the connection via TLS Auth. We have been working for a while with this type of configuration without the need of binding our Mac fleet to AD , and indeed we are using Enterprise Connect (yes, I know this is kinda deprecated and we should be using like Kerberos SSO), so far this allowed us to get the AD Certificate (User Level Certificate) Payload in the past without any issue. So far since like 1 week ago it suddenly stopped working, So still figuring out what changed or if there was a change that I didn't get informed on our Infrastructure. We want to avoid any open external traffic like going through workarounds as SCEP > or any AD CS Connector... Would now to request your assistance , if at any point you have configured s

Hi everyone, I'm currently working on aligning our macOS fleet with the CIS Level 1 benchmarks using Jamf Protect and Jamf Pro. I have CIS18 compliance reporting enabled in Jamf Protect, and while it’s very helpful, I’m running into a significant challenge. I’m seeing up to 25 FAIL results in the Compliance report. I’d like to remediate these via configuration profiles in Jamf Pro, but here’s where things get tricky: The CIS18 report in Jamf Protect doesn't clearly state what exactly needs to be configured to fix each FAIL. I’ve referred to the official CIS macOS benchmark PDF, but there are many settings that can’t be implemented via configuration profiles or are labeled differently in Jamf. There’s no consistent ID or reference number in Jamf Protect's report that I can use to match it back to the CIS benchmark document it which makes it very hard to find the right section and remediation. Has anyone dealt with this mapping issue before?How did you go about creating your

Hi  I have some issues to get the upload to Jamf working from autopkg Does any one have a general upload template for Autopkg? thnx in advance

Trying to set up a config profile for this new feature set. I have used Jamf's example and Apple's example as starting points, but the radio buttons for the items I have set to be managed are still able to be turned off and do not say they are managed like the Jamf apps are. Has anyone else had success in getting a config profile to work for this yet?

Hi I am looking for a best practice way to move from a MS Office Mac App Store Installation to MS Office PKG Installation. We have currently some Clients with MS Office from the Mac App Store, those Clients shoul get MS Office via PKG Installation in the future. Can we simply remove the MAS MS Office Apps from the Clients and replace them with the PKG MS Office Apps? Thanks in advance.

Hello everyone! Since 12/14/25 we have been receiving the message “The VPN client agent was unable to set up monitoring of the VPN profile files” every few seconds. It doesn't matter whether VPN is connected or not. It feels like the message only comes when you open the Finder and then you can't get rid of it. Reinstalling the same version fixes the problem. Since Friday we have activated version 5.1.7.80 for the zero touch deployment. So yesterday I activated version 5.1.6.103 again. When you connect to the VPN for the first time, the app is updated to 5.1.7.80. Today I have the first client installed with version 5.1.6.103. Since it was connected, it also automatically updated to 5.1.7.80. So it can't be my newly created 5.1.7.80 pkg. maybe it's because of macOS 15.3.1? Have you ever seen this?