Hello,for the past few weeks my team has seen strange scoping behavior using Jamf Pro. (on-prem, latest version, Windows host, managing iPads)We'll add a user or device to an app or profile's scope, and often times it will simply disappear after we hit "save," and takes three or more tries to actually stick.Has anyone else seen this or know of a fix?Thanks!

I'm testing the Mass Action Update on a couple of Mac's. One is an Intel and the other is M1. They both have the 12.5 available update, but when I deploy the command to both, I don't see any prompts where it gives you options when to deploy it. It does show up under their device as pending, but goes away. For the M1, have the bootstrap token on our devices. For the Intel, it looked like it worked, because the Mac is now showing 12.5. Is there a log where I can look up to see if the command ran successfully? 

Hi all, Somehow I am unable to install this driver from Apple website: https://support.apple.com/kb/dl1867?locale=en_US We use Papercut as our printer management, but we are unable to proceed due to the driver issues. Even the PPD driver from Ricoh website does not seem to work. Anyone using Ricoh MFP in their environment? How do you install printers on your users Macbook?

My client is going to be migrating from an in-house mail server (Kerio Connect) to Office 365 and I am trying to figure out how to leverage Jamf Pro for this project. The problem is that even though I have decades of experience with Mac administration and with using the VLA version of Office I have no experience with Office 365 and I am finding that some of the setup is frustratingly opaque. Take for instance the Exchange payload when setting up a User-specific Configuration Payload in Jamf: Is the Domain simply the organization's domain? More important, what do I enter for Internal/External Exchange Host, the Ports and the Internal/External Server Path fields?! I have looked at reams of documentation and I can't find a simple answer to those questions. I even asked the 3rd party company that is helping us perform the migration and they were not able to offer any suggestions other than "call Microsoft". If anyone here has any insight I would greatly appreciate it!BTW, this is spec

I remember being able to bypass all of the new user setup steps in macOS in the past, but I don't see how that's done now on newer versions of macOS. I remember there was a payload we could deploy in a configuration profile. We can do this during PreStage but if I setup a hidden admin account, and I later need to login using it, I would like to not have to click through all of the setup steps just to get in and do what needs to be done. Does anyone have a process for this to avoid the setup steps?

I have a LAPS solution running monthly to reset the local admin password but I also want to be able to trigger this after the password has been viewed.I have a custom trigger but without flushing the logs the custom trigger only runs monthly as well.Has anyone figured out a way to have a policy running on schedule but also be able to trigger it from a custom trigger on demand? The only way I see to do this is to create another policy which isn't best to duplicate things just for this.

I'm looking for a way to find out how many licenses I need for apps without having to note which smart groups are assigned to every single app. Ideally it would be a query (API or SQL, doesn't matter) to find an App Name and its license count, as well as the number of devices it is scoped to. In my mind it seems like such a simple thing, but I don't quite have the knowledge of what each table lists or even which is the correct table to pull that information from in the database. Does anyone have a script or query that they use themselves to pull this information? Any help is appreciated!

HIIm trying to setup a custom path on the inventory collection i want it to collect everything in the Users application folder but i dont know the syntax i need to use users/johndoe/applications ??

Hello,As of right now we enroll MacOS Devices in these steps.Depnotify -> Self Service opens -> Sign in with Microsoft account -> Click Register Device (This is a register to intune policy) -> Sign in with Microsoft again -> Keychain popup opens -> Sign in with Microsoft again -> Type local password to approve saving in keychain -> done.I already attempted to trigger the register to intune policy after depnotify ends, this should already prepare SSO so a login to the Self service is no longer needed. However, this seems to break the SSO. For some reason only triggering the policy from the Self service portal seems to work fine. Has anyone found a way to run the register to intune before opening the self service? And does that work? Additionally, any other tips to reduce the amount of times you need to sign in? Is there a way to automatically allow the keychain popup rather than having to type your local password? Thanks!Tobias

I have a client with no on-prem estate, all server infrastructure is hosted in Azure/GCP. Is it feasible to install Jamf Pro in Azure? I'm not seeing any documentation to support or not, and don't want to assume.

Hi all,We have Jamf ADCS Connector setup and everything is working fine. Certificates can be delegated and no issue there but..We have recently realised under PKI Certificates -> And under the Certificate Authority then under Active there is a lot more issued certs and a lot on "Pending Revoke" than there is devices. And so far we have only seen iPads on status "Pending Revoke".So we have a iPad and we tested this out - we added the iPad on the profile that delegates WiFi and the Certificates and the iPad is on and connected to a WiFi so it has internet but it is in locked screen. What we see is that Jamf asks the ADCS Connector for a cert while the iPad is on locked screen -> the Connector does its job and asks the CA for a cert and retrieves it -> and then i assume it ships it back to Jamf and then when Jamf tries to deliver the cert it cant because the iPad is on locked screen. It then waits and waits for the iPad to be unlocked but if it takes too long eventually the certi

Hi all,I've been working on the OneDrive deployment some time ago, but it wasn't something we want to use at that time.Things changed and now we want to look into deploying OneDrive and a nice config to a set of test machines.Deployed the standalone version to a machine from here.https://support.microsoft.com/en-us/office/onedrive-release-notes-845dcf18-f921-435e-bf28-4e24b95e5fc0#OSVersion=MacPushed our desired config to the machine and nothing happens... updated our plist to a very simple one:<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>OpenAtLogin</key> <True/> </dict> </plist>Still the app won't open at login.Does it require a user to initially sign-in first or missing something else??Thanks!

Hello everyone, We use JAMF School to manage our iOS devices. We are primarily a Windows environment when it comes to laptops and desktops. We currently have new and older MacBook’s(iMacs too) that are not in the domain. They are stand-alone. For security reasons we need to start authenticating users when it comes to macOS devices. I have read some documentation regarding authentication via Azure or LDAP. What would be the pro and cons of going with either one? Also, would it join the domain after the Device enrollment? If so, would those configurations be done in the organization settings or within the profiles? I also read about directory binding. Would this need to also be configured, or is it something not related? I have several questions to have a better understanding before moving forward. Any help would be greatly appreciated.

Jamf pro cloud - ipads/Iphones not updating using mass action command download, install, and restart devices.They have full battery. One is on wifi, one connected ethernet using an adapter, another device is using mobile data. Under the management commands on the device, the scheduleOS update command is just pending, and there's hundreds of them. Like it's trying every day, all day long for the last week.I saw some posts from a couple years ago on the jamf nation forum discussing this issue with no resolution. Has anyone else experienced this?

We want to be able to send notifications to our iOS devices.  We have about 50 of them enrolled in Jamf Pro currently.  We have not tried to use self service until now.  I went to the settings and under the Self Service section went to iOS and selected the "Automatically install self service app" option, then on the app options selected "no login" as we have several devices where there isn't one user and those are setup sort of like a kiosk but with more than one app available.  Of all the devices, the only one that immediately installed self service was an iPhone 6 running iOS 12 (which is the latest iOS it will install).  All other devices are on iOS 15 and have a command under the completed commands in management history that says "Install App - Self Service" but nothing was actually installed on the device.  What do I need to do to get the self service app to install on all the devices?

In preparation for the JAMF bind apocalypse... I'm looking to find machine certificate alternatives for 802.1x wired and wireless.Currently, for 802.1x wired and wireless, we use machine certificates requested from a Windows PKI server. It has worked quite well. However, in the future when we are unable to bind MAC's to AD... we are looking at alternatives.Has anyone been able to use the machine certificates generated from the JAMF PRO Built-in CA for 802.1x using configuration profiles??

I have 10 MAC device which i have already joined to Active directory. My question is how to control MAC device like windows PC which is mention below through Active directoryGroup PolicyPatchingSCCMPassword Sync with ADUser & Machine certificateI need help badly. Thank you

I want to take an exported list of SNs from jamf and run a command in terminal against it, what's the easiest way to do that?  

We are deploying and running a bunch of policy and scripts to computers, but if these run into errors you need to open the logs for that policy and look for any errors.Is there a way of creating dashboards which shows recent errors in scripts or a way to forward the errors to an external app for processing and dashboard creation.

Hello everyone. I use the script for passive update system:https://github.com/coleseph/IT/blob/master/JAMF%20Passive%20Update%20Prompt/JAMF_Passive_Update_prompt.shSee the next error: Stopping execution with error: Error! 1st JAMF input variable null. Please define the desired OS version. Exiting script..Can you please help me?

Hi, all!Saw some really cool presentations this year at JNUC 2020 and got inspired to share some scripting of my own. Here's a jamfHelper script that lets you scan machines to see if they're up to date with a particular OS version you've defined. If not, and if the machine has pending updates, send the user a customized jamfHelper prompt. Then, when they click "Ok," open them straight to the Software Update panel in System Preferences. We've found this really helpful for our own macOS patching efforts. All parameters have been written so you can copy-paste straight into your JAMF scripts section. You can also use the parameters to:- Choose not to open Software Update once the user clicks 'Ok'- Set a custom icon by providing a url to an icon file- Send them a prompt even if they have the OS Version you're looking for but have pending updates (Helpful for those supplemental updates where a user's OS version is up to date but their patches are not). The readme explains which param

Hi, We are trying to manage the macos application layer firewall from the mdm using either the built in settings to allow built in incoming connections and not allow downloaded signed apps.  We then want to add a list of exceptions by bundle Id as per the docs.  When we do this either through the mdm gui or a config profile pushed to the device the application appears in list of allowed applications but when the users open the app it still prompts ‘do you want to allow incoming connections for app.app’ even though it is already in the list. Has anyone any idea why this is or how to fix making things very difficult for us to manage the firewall on our devices? Thanks 

I circulate several 2022 MacBook Pros running MacOS 12.5.1 in an education setting. For security, every MacBook automatic boots to a default user that all patrons use. The MacBook then erases/resets after shutdown. So users do not use a password to login to the MacBooks. But sometimes users will push the power button on these MacBooks to put the computer to sleep, which locks the MacBook, logs the user out of the Mac, and requires my admin password to log them back in. Is there a way to disable the power button from logging users out of the MacBooks? 

Hi, I'm trying to Download the latest version of Adobe Express and while its listed in the App store with this name and we pushed out previous version called Adobe Spark its not updating on the iPads and Jamf is only recognising Adobe Sparc . It's a free App and have test the App sync with another Adobe App and it has synced in Jamf Pro without any issue. Any ideas on this would be much appreciated. Kind Regards, Ger Keane

 Jamf Management Commands are constantly prompting for Managed update despite the device being upto date, inventory recon done and restarting the device.This is incredibly annoying and I do not know what else I can do to stop itCan anyone help?