We are retooling our 802.1x and Network profiles in response to some forthcoming network changes in ISE/RADIUS. We are reevaluating all our payloads and settings.When configuring SCEP payloads, one of the options for both iOS and Mac is the Subject Alternative Name.Jamf recommends the RFC 822 type on Mac (not the DNS type), and they recommend leaving the RFC 822 Subject Alt Name BLANK on iOS. See links below.However, we have been using DNS type on both platforms for a couple of years - per a Jamf tech’s recommendation when we first set up 802.1x. We dont recall why. Examples: $COMPUTERNAME.my.domain and $DEVICENAME.my.domain.Any ideas on why Jamf recommends RFC 822 type?Thus far, using DNS type doesn’t seem to affect us in production, How do you all have your SCEP Subject Alt Name set?Any ideas on why the Subject Alt Name should be blank on iOS?Background: We are using our on-prem JSS as a SCEP proxy to our MS Windows NDES server. We use Cisco ISE for RADIUS.For Reference, Ja

I am trying to find a way to deploy VNC and Visual Studio Code. Was wondering if anyone has a way to do it and would be able to help me on this. Thank you in advance.

I came across this article recently about how to use Github to manage and push scripts and configuration profiles to Jamf however it seems a bit out of date:https://www.pixngeek.com/jamf-pro-use-github-to-deploy-scripts/ Does anyone have more current resources, references or recommendations to utilize Github to manage script updating in Jamf? Something that hopefully takes into account the latest version of Github actions so it doesn't generate any Node.js errors? 

We have all our printers in Active Directory when computers were joined to AD they could see and add them. How do I connect to the Print Server and add printers on a Mac?

We are using Jamf Pro and are setup as shared devices using Setup and Reset. and microsoft authenticator.What is involved in switching over to user assigned still using reset for a device format and logging into a device with Azure creds?Is Jamf connect required for this?I am trying to achieve a shared device that users make their own for their shift and reset and wipe at the end, during their shift they can use outlook/teams/word/onedrive etc with app protection policies and conditional access.

Here are the direct Apple CDN download links for the Safari 16.4.1 update released today (2023-04-07) for macOS Monterey and Big Sur:Monterey: https://swcdn.apple.com/content/downloads/13/10/032-71505-A_VXEPHZXHA7/cceqmuarwutena64ohro71ydpukpip72i9/Safari16.4.1MontereyAuto.pkgBig Sur: http://swcdn.apple.com/content/downloads/47/23/032-72735-A_HUFOGBJPRZ/580izn9uc683ima5tc9fykya8lkbhkji4t/Safari16.4.1BigSurAuto.pkgThe macOS Ventura 13.3.1 update contains the Safari 16.4.1 update for macOS Ventura, and there is no standalone updater for it.

I am testing no-touch app installs and configuration with DEP Mac devices in JAMF.I have a DEP Mac that I registered with JAMF and initially the device info did note that YES it was enrolled via DEP. After testing many settings I wiped the MAC and deleted the entry in JAMF so it can be configured as a new machine. However, thereafter, in the JAMF computer info, the info states that NO it was not enrolled via DEP. The thing is I have a smart group to add devices enrolled via DEP so now this workstation cant be added and the policies i have created that are tied to the smart group do not apply to this machine.What is the trick to get JAMF to recognize that this mac was enrolled via DEP?I also have one error come up: Command requires DEP enrollment: UserList <MDMClientError:74>Thanks!

Does anyone know if and when Okta will be added as a Cloud Identity Provider in Jamf Pro? 

Been searching around in integration, company portal, and azure documentation but the specific item I am trying to figure out is when it prompts for Admin elevation, is it possible to configure to use an Admin group from Azure AD to use Azure AD Admin Credentials? That way we aren't using a local account or logging into an Admin account each time. Similarly as we would do with UAC on a Windows device. Similarly if you were AD bound with an on prem, you could designate an Admin group so could use your credentials. 

Hi there,  When setting up a new laptop for someone, what's the best practice for what Apple ID they should use? I know this all depends on what the user wants etc. But would it be possible for them to just create an Apple ID using there work email for example to sign in? It's just they want to stop using there personal ones.If they have a laptop that is being used by 2 or more people what Apple ID should they use, or is that not a problem as when they sign into the other account it will prompt them to sign into another apple ID?  Thank you!

Our Macs are now coming in NOT added to ABM. So I need to spend a little extra time adding them in to ABM first, before setting them up. No big deal.However - about half the time I am having a problem getting the "Fuzzy Bubble" to appear so I can point my phone at the Mac and add it to ABM. It just never shows up on the Mac, or, if it does, the phone doesn't recognize it to add it in to ABM.Todays blog post talks about how it is supposed to work when everything goes smoothly:https://www.jamf.com/blog/use-configurator-2-with-apple-business-manager/But here is where it breaks down:"5. After the Mac restarts, you’ll be presented with the Setup Assistant. Click Continue on the Mac, then stop at the Country or Region pane.6. The mobile device host must be paired with the Mac to proceed. Bring the host close to the Mac and scan the image that appears in the Setup Assistant or select Pair Manually to pair the two devices."I have tried:On the Mac: rebooting, wiping and reinstalling the OS, dis

Hey Everyone,I'm looking to make an app available for employee's to use when their disk is getting full and to help them easily identify what is taking up space. I see a lot of people on the internet suggesting OmniSweeper or DiskX. I'm used to using TreeSize on PC, and that works really well. There is a macOS version, paid version but for something this lightweight I really don't want to shell out cash for something like this. I'm wondering what all of you use 😁. Edit: I suppose the cleaning portion is not 100% necessary, more so the ability to have visibility what is taking up all the space. 

Hello All,I just wanted to get a way to restrict the Office 365 activation for company devices only, I dont want user to use their company license on their personal device after installing the office 365 app from https://software.macadmins Is it possible to use conditional access in Azure AD, so that only registered company device will be able to activate the office license else no, if yes then still user will be able to register their mac in Azure AD what I think, please clarify me. Thanks in advance.

Simple modifications to enhance your users' experience when using swiftDialog and Installomator with Jamf Pro's Self ServiceBackgroundAs a self-proclaimed swiftDialog evangelist, I was especially excited when Installomator v10.0 was released earlier this month with Jamf Pro-specific examples from Armin Briegel and Søren Theilgaard.This article presumes you’ve successfully implemented Installomator with swiftDialog into your Jamf Pro Self Service policies and then builds on Armin’s, Bart’s and Søren’s work by adding some so-called “racing stripes” based on previous posts, which we’re still testing out in our lower-lanes.Continue reading …

We have some internal websites that are http only.  Without getting into the history: iOS 16 the website launchesiOS 15 or below they get "This Connection is not Private".  I've asked if they click Show Details and the option to continue to the site what happens but haven't heard back yet.  Is there any way with supervised devices to allow Safari to skip this message?  I do have this site on a allowed content filter.

Is there a way to automatically enable location services for the Jamf Connect app?

Hi, someone is selling Mac book pro in fb marketplace and the price is very reasonable and in my price range. Seller added a note saying that the device is jamf locked. I really don’t know what jamf means and Is it okay to buy the jamf locked Mac and is there away to unlock the Mac?

Hello,I am dealing with this issue where a user has these icons on their managed iPad. I am not sure if they are apps or shortcuts but nothing happens when I tap on them. Anyone have an idea of what they are and how I can remove them without having to wipe the device? Thanks in advance.

Since the new version of JAMF Pro has been released we are having issues with categories.2 main issues:When we create a new policy the policy does not display correctly in self-service - shows fine in Admin UIUpdating an existing policy with different category does not update in self-service - shows fine in Admin UI Wanted to see if this was happening for others before raising a support ticket. 

If you are using a decrypt string like the one below, you will encounter an error on macOS Ventura when attempting to decrypt. See below:#!bin/bash ## Decrypt string using salt and phrase. function DecryptString() { echo "${1}" | openssl enc -aes256 -d -a -A -S "${2}" -k "${3}" }bad decrypt4370875948:error:06FFF064:digital envelope routines:CRYPTO_internal:bad decrypt:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/crypto/evp/evp_enc.c:521: SOLUTION:You will need to add "-md md5" to your enc string. This will work across macOS versions 13 back through at least 10.12.#!bin/bash ## Decrypt string using salt and phrase. function DecryptString() { echo "${1}" | openssl enc -md md5 -aes256 -d -a -A -S "${2}" -k "${3}" } 

I was able to do the pre-requisite for Falcon, The install appears to be fine however the script to license doesn't appear to be working and i know why i use a script from the older version and i guess the structure has changed does anyone have the license script for falcon Here is the log detailsScript result: Executing Policy Install CrowdStike Falcon SensorDownloading FalconSensorMacOS.MaverickGyr.pkg...Downloading https://use1-jcds.services.jamfcloud.com//download/0e4976be1fe242abb3ce80e8556253bd/FalconSensorMacOS.MaverickGyr.pkg?token=cdf519ed75c141bea4937d44500440715ar4dxxmrcbdr8m9y5e95veg10tvlnij...Verifying package integrity...Installing FalconSensorMacOS.MaverickGyr.pkg...Successfully installed FalconSensorMacOS.MaverickGyr.pkg.Running script License Falcon...Script exit code: 0Script result: /Library/Application Support/JAMF/tmp/License Falcon: line 2: /Library/CS/falconctl: No such file or directory

So here's something weird - I have a Mac running 13.3, it enrolls just fine - get through the setup screens and to the desktop and DEPNotify launches, and my policies run.  I upgrade to 13.3.1, erase and reinstall because I'm testing...and the machine gets stuck at the Time Zone screen during setup.  Meanwhile, the system is enrolled in Jamf Pro, all the policies run successfully...it just never progresses past that screen and to the desktop.  Wipe, install 13.3...and it works.  Anyone else having anything odd going on with 13.3.1 enrollments?

Hello there, does anyone have experience integrating CI/CD tools with Jamf Pro on prem? Thinking of tools like Jenkins, Bitbucket etc. Specifically looking to establish if it is even possible to interface between Jamf and the CI/CD application, and if so, is there a guide to go about establishing the integration?Thanks in advance.

Is it possible to use the API to install a configuration profile on to a device? We have a network profile that has to be manually installed by our techs as they're setting up the machines. If I can run a policy that has a script that runs an API call to install it that would cut down on some workload. The profile is scoped to domain membership of the device, and it can't be an automatic install since right now the AD cert inside the profile only lasts 1 year and we need to let techs remove it in Self Service and reinstall it to get a new one every year (don't get me started on this, this is being worked on already). I looked at /v1/mdm/commands but got "[ ]" returned when I ran it. And /v2/mdm/commands gives me a 400 error.

tl;dr - Getting an "MDM-enabled user" and user channel for configuration profiles has become unobtanium.  Pretend that macOS is like i[Pad]OS where all configuration profiles and certificates are scoped to the whole machine."Managed Users"A user who is "MDM-capable," "MDM-enabled," or in the Apple MDM spec a "managed user," can be achieved in a few ways:First user created by Setup Assistant when machine is first set up via automated device enrollmentA user with administrator rights initiates a user enrollment via an enrollment URL or renewing the automated device enrollment with a profiles commandMobile accounts (aka bound to a directory service) where during login there is a token registration with the MDM.For reference, see Enabling MDM for Local User Accounts and from apple.com Prepare for changes to kernel extensions in macOS High SierraFor a configuration profile or a certificate to be issued to a single user account on a Mac, the user must be a "managed user" as of macOS Cat