Hi Jamf Nation Guru, We managed to block extensions in Chrome and Edge on our Macs by configuring custom settings in JamfPro.However, we couldn't find a similar solution for Safari. Have you had any success with blocking extensions on this browser? Thanks

Hello everyone!Need to know something about Intune integration with Jamf. What part, Jamf or Intune, will be the master service when you do it? Can it be any of it depending on how you choose to set it up? Or is it always Jamf?Do you need to install a Intune app on the Apple devices? I heard that if a device (iPhone or iPad) is too old it will make the device unusable because of a loop in the Intune app. Or can you skip it?Do you still use School/Business Manager connected to Jamf and not Intune?Right now I'm gathering so much information about this that's impossible. Later on in the fall we will convert our platform from eDirectory to AD and integrate Intune with Jamf. We'd like it to result the best possible way.

Wondering if anyone has a work around for this issue we're encountering.If I set up a new user in Okta and set a temp password and the user has never logged into a machine it pops up a window and walks them through setting a new password and MFA, however once that user exists on the machine and they forget their password if I reset the password and specify a temp password the temp password doesn't allow them to log in at all

I have been asked to block peer-to-peer sites on the devices campus-wide. Is web content filtering on macOS devices possible? What would be the best way to do it, if possible?

Super quick question you guys may know...  I'm having trouble finding documentation on this, but I ran into a JAMF nation post that suggested that JAMF Lock Commands can be issued to devices that are no longer checking in with our JAMF instance or have expired MDM profiles because it leverages APNS and just needs an internet connection (connection to my specific instance is not required, based on the post). So, some of these devices that are in still my instance and had profiles that expired months/years ago, would in theory, be able to be locked by the JAMF command. Is this true? Can I lock devices even if I seemingly have no other management over them? This doesn't seem right... in my experience with JAMF, once the MDM profile is expired it's basically gone from my management abilities until it's re-enrolled.

Need help with "JAMF Connect pulling wrong username when trying to change password". I have a user who is unable to change her password every time when her password is nearing expiration. When she opens Jamf Connect and clicks change password she puts in her old password and then her new one and immediately is presented with this error (screenshot attached).This is not the right username and it has omitted the C in her last name.  We don't see this account anywhere...not in AD, not in Okta our IDP.  Her local account is correct.  We cannot find out why it keeps pulling up this name.  We have removed the MDM profile and deleted Jamf Connect and re enrolled her machine..  We have set up an entirely new Macbook and it is doing the same thing.  We know that Jamf pulls from Okta our IDP but her account is right in Okta and AD.  If anyone knows why this is happening,  please let me know. 

Hey all! I used to be able to create Mac Admin events in the event board but it seems I no longer can do this. How do I add a local Mac admin event?Edit: I actually just noticed on this page that there are actual user group pages. How does one create a local group there? Specifically the Greater Philly Mac Admins :)Thanks!

We have started to move all of our macs from Jamf School to Pro and we have run into a few odd issues. Just curious if any organizations have done Jamf School to Pro migrations on macbooks? How smooth is the process? Is it easier just to backup and reimage and then do an enrollment in Jamf Pro?

Hello!In the Jamf Connect documentation it suggests that some scenarios require scoping a config profile solely during enrollment:Best Practice: Jamf recommends maintaining settings that only should be used during enrollment in a separate configuration profile. This allows you to remove the settings after enrollment without impacting other Jamf Connect settings.My question is this:What's the best way to scope machines into a config profile only during enrollment then immediately remove them from that after? Background: we use prestage enrollments and have an "enrollment only" configuration profile for the Notify Screen to install necessary apps, but that requires resetting the authchanger. We do so in the config profile, but one it's enrolled we no longer want to run the config profile with that authchanger reset. Thank you!

Any suggestions for troubleshooting computers that are checking in on a regular basis but not running policies (or collecting inventory?) I have looked at the jamf.log and I see a boat load of network change triggers, but no policy triggers. It appears the LD is not loaded either. Anyone else have this issue and any suggestion on how to fix? Right now, about 3% of my fleet is having this issue.

Hi all!Those of you in a K-12 setting, how have you handled subscriptions within iOS apps? I have an app that is going to be installed on 8 iPads that needs a monthly subscription, and previously I had created individual Apple ID's to create the subscription with but I was wondering if anyone has a more practical solution. Thanks!

My Big Sur workflow was great.Erase and Reinstall the OS either using Recovery or StartOSInstall, leave it to do it's thing, restart at the end of the build script and users can log in.I tried the same process on Monterey and every time it restarts after installing its config profiles.I had to do:  sudo profiles renew -type enrollment sudo jamf policy  for the EnrolmentComplete triggered policy to kick in.Has anyone got a fix for this?

We recently started to deploy apps based on location instead of sharing the apps from one single location. We have notice in several locations that when we go to a specific device under manage apps. Certain apps say "pending or installing" In the actual device the app in grayed out and it says "waiting". This does not happen to all the devices but enough to be notice. Is never the same app. We have already done the following: -make sure we have enough licences -gone under apps for that location in jamf and resync licences,retry installing on missing,delete deferred items.We contacted support and after a few emails back and forth they tell us to check our network. The thing is that the moment I long press the app that says "waiting" and cancel download and reinstall the app from jamf school it downloads and installs the app. They suggest that that is the only way around this situation but you are talking about 200 devices with around 20 apps each with the same issue. Wondering if anyone

Hi,I uploaded dmg file to Jamf Pro -> Package for Libre Office. Created new Policy with the DMG file and enabled it for Self Service. And Scope only for those computers that should be able to install it.In Jamf Policy Logs it shows that´s installed, but when checking on the machines. Libre office is not there, what is going wrong ?How can I find more information why this installation fails ?[STEP 1 of 4]Executing Policy Libre Office 7.5.3 for Intel Mac[STEP 2 of 4]Downloading.. (URL...)Verifying DMG...Verifying package integrity...Installing LibreOffice_7.5.3_MacOS_x86-64.dmg...Closing package...[STEP 3 of 4][STEP 4 of 4] 

Hey there, I edited a /bin/bash script that automatically checks the devices uptime and tells the user to restart his computer after 2weeks uptime (with the help of https://www.jamf.com/jamf-nation/discussions/17336/user-has-not-restarted-in-x-number-of-days) The following part generates the ""jamf" wants access to control "system events"" message for end users: #!/bin/bash # Discover logged in user user=`stat -f%Su /dev/console` #Execute code as logged in user (instead of root) sudo -u $user /usr/bin/osascript <<-EOF tell application "System Events" activate set question to display dialog "The device has not been restared for [...]" with title "RESTART YOUR COMPUTER" buttons {"Shut Down", "Restart", "Cancel"} ¬ cancel button "Cancel" with icon caution set answer to button returned of question if answer is equal to "Shut Down" then tell application "System Events" shut down end tell end if if answer is equal to "Restart" t

Is there a way to suppress these annoying Screen Sharing dialog boxes. No, Screen Sharing, we don't have FQDN set up for many thousands Macs. #makeItStop

After a reboot, my Macs are not connecting to a wired network connection until a user with physical access logs in. After the user logs out the machine remains connected to the network until the next reboot. It causes issues because we have a couple of machines that are only used occasionally so, after reboots occur, they can go quite a while without checking into Jamf until someone logs into them.Is this expected behavior? Are there any MacOS settings I can change to prevent this?

I have an Extension Attribute that reports back the expiration date of a PIV Authentication certificate on a Yubikey.When inventory runs and a user has their Yubikey inserted it reports <result>YYYY-MM-DD</result>.This works very well. If the user does not have a Yubikey inserted when inventory runs the EA does not report any result back to the server.My issue is the EA then ends up being blank. I would prefer it to keep the old results if no result was reported.Is this the expected behavior?

Jamf Cloud: I deleted the ipad object out of Jamf but the actual ipad still has mdm profiles on it. How do I add it back to Jamf? I don't know the activation code so I don't want to wipe it.

I know there's quite a few different ways people have tackled macOS Updates.  In the past I've general leaned into the "encourage" users camp vs trying to brute force them.  I've done a number of methods all to varying degrees.  This week our CSOC identified CVE's that needed patching by getting everyone to macOS 11.6.3 or 12.2. Instead of guiding users to update, I'm actively trying to force them at certain actions (login/logout is my goal).  That being said, I checked with Jamf about best practices and was pointed to this article -> https://docs.jamf.com/technical-papers/jamf-pro/deploying-macos-upgrades/9.96/Running_Software_Update_Using_a_Policy.html (we don't have any M1's so the article applies).  I built my policy, applied it to some test boxes and, well, hit or miss.  Specifically I'm running into this running software update locally: Last login: Thu Feb 3 11:22:11 on console Ed@TestBox ~ % softwareupdate -la Software Update Tool

My apologies if this post is redundant but I'm looking for a method of naming Macs as they are enrolled from a list. For example ORG-MAC-001, ORG-MAC-002, etc using the names sequentially and not allowing them to be used again. TIA

Hi Team,After enrolling to JAMF, the Apple Icon -> System Settings -> Apple Sigin. the page is empty and shows as data is not available. I tried re-enroll [remove JAMF and enroll back] & remove the user profile from /var/db/ConfigurationProfiles then again enrolling back. Finally, reset the Mac and then enroll the mac. but no improvement. Note: before enroll the mac its showing, but after enrolling to JAMF it's showing as not available. Only this mac having this issue. other all Macs showing correctly.could you guide me. 

I am importing data from jamf into ServiceNow using the REST API (not using the graph connector because we are not licensed for it) and for some reason the Storage Section is not expanding so I can add those fields, other ones like userandlocation and hardware work and can be expanded,  any ideas why this would be? You can see in my screenshot that the section is specified but the pill on the right the storage one is a string not an object...

Hello all,Question, Has anyone come across JAMF Pro blocking some system settings options such as User Groups, Network etc? If so, how do I remove it and still have MDM installed? Once I removed JAMFcompletely from the PROFILES option in System Settings, everything comes back normally. Here's a screenshot of the block. - Thanks.

I apologize as I am very new to the area of MDM. We are deploying iPads and iPhones to our employees, but while setting up the config profiles, I can't find a way to restrict which apple ID's are used. When checking the settings menu, I would like to remove or deactivate the ability to sign into icloud because these are for business use. Is there a way to make this happen or is there a way to force it to only accept managed AppleID's? Thank you in advance!