Hi, is it possible to restrict Apple ID for users to only sign in with a Managed Apple ID?Currently we have blocked users from using Apple ID as we don't want them possibly moving data to their personal Apple ID but if we could allow them to only use a managed Apple ID that would work.Thanks.

Help would be appreciated. When setting up mobile device configuration profiles there is the ability to setup restrictions and within restrictions there is an app option to only display specified apps.Is this doable via the api? I know that creating  mobile device configuration profiles is possible but can you do it with implementing these restrictions? thanksSteven 

Hey Everyone, I work for a MSP and we are currently using JAMF to manage approximately 20 completely independent environments. In the past, we were using one JSS to manage all of our devices, until we were informed that Apple's EULA does not permit the use of a single Apple ID for multiple clients when setting up a push notification certificate. I was wondering if anyone had any workarounds or creative insight that might be easier than managing all of these JSS's independently. Thanks!

Have a set of machines that we're adopting and for whatever reason, pushing VPP apps to them, I get "Invalid Status Code" in Jamf Pro, and the apps don't install. These are running Monterey. I haven't seen this issue with other machines, but I'm not 100% sure if it's these specific machines or something else. Curious if anyone has seen this. I did see this community thread, and did disable this option. No change, sadly. https://community.jamf.com/t5/jamf-pro/fix-for-vpp-apps-not-deploying-in-big-sur/td-p/225620

Good morning allI'm newish to Jamf so bare with me if this is obvious.  Today I started prepping 2 new computers, one was pre-enrolled brand new out of the box and the other was an older MBA that I used a manual invite.Most of the usual policies applied except for 3, the same 3 on both systems.  When I check Inventory -> Management for the devices, they appear in the "Failed Commands"  section with an "Invalid Status Code" listed as the status.  I have tried removing these computer from the policy scopes, cancelling the commands and then re-adding them to the scopes.  Same result. Does anyone have any suggestions?  I don't know why all of sudden these are 3 (specifically) are failing.  They have worked for months, and I have not made any changes to them.Thanks 

Hi everyone, We have PreStage Enrollments and we now have 2 Macs which initially enrolled and I see them registered in Jamf. The problem is, they do not check in after the initial registration and does not get our standard apps (which deploy via smart group targeting a policy for installs). I see that the device does get the configuration profiles and it registers in Jamf but after that initial it seems to not check in any more.Any suggestions where to look?Logs from client:Wed Jun 15 12:21:43 MacBook Pro jamf[8170]: Removing existing launchd task /Library/Application Support/JAMF/tmp/com.jamfsoftware.task.startssh.plist...Wed Jun 15 12:21:43 MacBook Pro jamf[8192]: The SSL Certificate for https://XXXX.jamfcloud.com/ must be trusted for the jamf binary to connect to it.Enrolling computer...Wed Jun 15 12:21:49 MacBook Pro jamf[8215]: Skipping trustJSS command...Wed Jun 15 12:21:49 MacBook Pro jamf[8215]: JMFCommons.JamfKeychain.JamfKeychainSecurityError.failedToReadJ

Hi All, Is there a quick way to export all current Configuration Profiles that are in the JSS, rather than click 'download' on each individual one?

Hello Jamf Nation, We've built our own type of semi-automated software updates method in our JAMF Pro instance using Autopkgr. We've altered the recipes and templates to tailor our needs. Utilizing Autopkgr in conjunction with JAMF API has been extremely helpful. There is one issue we are having and I'm not sure if this is necessarily the correct place to ask for advice for this. But in the policies we run in AutoPkgr, we want AutoPkgr to automatically enable notifications for the policy in the Self Service Portal. For whatever reason, we can't figure this out and get it to work correctly. We've checked in the JAMF Classic API to see how it should be coded in the policy but it still doesn't seem to work. I'll post an example of one of our policy template's we use with our Autopkgr recipes and highlight the portion that's not working. Any assistance would be appreciated.   <policy> <general> <name>Updates - %NAME_TWO%</name> &lt

We've been using on-prem for years and have occasionally been taking a look at moving to Jamf Cloud hosting for Jamf Pro.  There's one item that just has me completely baffled though - Jamf Cloud allows anyone anywhere in the world to sign into your Jamf Pro instance with only a username/password.  Sure, you can set up SSO but just adding /?failover to the end of the URL bypasses that.  Am I correct in understanding that for every customer of Jamf Cloud, there exists a username and password which, if it became compromised, could be used to issue wipe commands to every Mac in the org (and given the potential fallout of data leaks, that'd be a best-case scenario?)  That just seems like an overwhelming risk given I can't even sign into Slack without using MFA but a system with all the power of Jamf will happily let someone in with just a straight username/password?The only potential solution I've heard is Jamf Cloud Premium to restrict access to Jamf Pro to specific IP

Did something change in a recent version that the devices enrolled via DEM and pre-stage enrollment are not getting the Jamf management account (with randomized password) ? My devices are coming out of DEP as "unmanaged", I know how to then set the local admin account but was wondering if there was either a change that requires an additional setting or perhaps an issue. I do not actually do much in my pre-stage enrollment since we are not attempting an OOBE for our end use, and have not changed anything in quite a while. 

Hi all, Ive implemented Jamf Connect 2.7 but its not working as i wish. I keep getting users that can not login anymore because with password issues. "Your network password does not match your local password. Enter your previous local password sync password" Then we have to run auth-reset to find out most of the time their password is expired or something else. Also when the local password is changed, they manually have to go to the menu bar to sync (click connect). I thought Jamf Connect checks every 15min standard but thats not happening. Which result user gets password issue again. What am i doing wrong here? 

Can I upgrade Connect without the app opening for the user? Right now, if I install via the profile (Settings > Connect > upgrade form profile), or via Policy or via patch management, all 3 will pop up connect guy to the user when it upgrades. Id like it to be silent.  going from 2.8 to 2.10. 

Is there a way to turn on Screen time and adjust the allowed times thru JAMF? that would be great if we could do that to some of our student ipads. I seen someone asked about this a couple of years ago but didn't see anything about it being available and I am not seeing it in a new configuration

Hello,All. I uploaded my file as a package to the jamf server, but "Availability Pending" is displayed and the upload of the package is not completed.* It was possible to upload without problems at 2019/08/28 12:00 (UTC). Is there a solution to finish uploading the package?

Trying to use Graham Pugh's erase-install process to upgrade (in place) Mojave to the latest version of Monterey. The process kicks off just fine, but hangs on preparing a preboot volume and eventually fails with "Could not create a preboot volume for APFS install." If I run the update manually either through System Prefs> Software Update or double-clicking on the Install macOS Monterey app in /Applications and click through the prompts, the Mac will upgrade to Monterey.Has anyone else run into the APFS preboot volume issue? Any assistance is much appreciated, thanks!

We are hosting the first Google-focused Jamf Customer Advisory Board (CAB) on Monday, September 26th, the day before JNUC. If your organization leverages Jamf with Google products or services, and you want to help inform us about what customers need to be successful, fill out this form to apply! Future CABs will be both in-person and virtual conversations. Let me know if you have any questions. Thanks in advance for your thoughts and participation!

We're in the process of setting up our 3rd party patching. We're using Installomator to update the applications. I did see an older post where somebody had Recurring checked, Once per computer and then had a time set in client-side, so I thought the same process would work. The update is running at the 5min check-in and not the time listed in the server. I also tried unchecking recurring and checked custom with a trigger to see if that would work.

Hi,I was tidying up my inventory and accidentally deleted a computer that I shouldn't have. My plan was to: run sudo jamf -removeFramework (to get rid of the profiles, etc) 2.turn off Filevault Re-enroll Turn Filevault back on (keys stored in JamfPro) Does that all sound like the right work flow? I hope I'm not the only ding dong that has done this.

Hi everyone,I'm a quite new mac System admin. We would like to manage properly identity on Apple devices. Because bind mac to AD bring some hassles and some are out of our network (don't reach AD).So we're looking a product that provides identity from our hybrid environment (Active Directory + Azure Active Directory). Most of our environment is Microsoft but some VIP and departments ( Graphic Designer ) use Mac. We saw that one of last version of Jamf Connect can manage hybrid identity.I found some feedback but not enough with hybrid environment. What do you think about this product ? Do you know an alternative because it's a bit pricey 2$ / month / Device. Our environment:- Hybrid (Active Directory + Azure Active Directory)- Office 365- Adfs 3.0 will upgrade 5.0 soon (may be not possible with 3)- MFA Azure- Active directory authority for local resources (Printers, file servers, wifi,...)- Intune- Apple Business Manager (just few Macs)- Couple Macs bound to AD others are "Free"&nb

I used $ sudo rm -rf /Library/Developer/CommandLineTools to uninstall Xcode CLI but after that when runningxcode-select -pI am still getting an output of /Library/Developer/CommandLineToolsI checked the Developer folder and its empty...even the info says 0 bytes but for some reason...I am still getting that output? Can anyone tell me why? There definitely is no folder there

Hi all, I have the following script which I would like to deploy via Jamf Pro at Enrolment: #!/bin/shrm -rf "/Users/$USER/Templates/PPT"curl "https://xxx.blob.core.windows.net/XXXX/XXX-PPT-Templates.zip" --create-dirs -o "/Users/$USER/Templates/PPT/XXX-PPT-Templates.zip"echo "Unpacking..."tar xvf "/Users/$USER/Templates/PPT/XXX-PPT-Templates.zip" -C "/Users/$USER/Templates/PPT/"echo "Cleaning..."rm "/Users/$USER/Templates/PPT/ADL-PPT-Templates.zip"The purpose of the script is to deploy Microsoft Office templates to end users Mac's.  For the Windows estate we have a tool called Upslide which works well however they dont have a MacOS version just yet.  This is why we would like to distribute them in this way.  Unless there is a better option out there in Jamf Pro? We are using DepNotify and are calling this script at Enrolment time using a custom trigger.  When the script runs I see the "Templates" folder is created in the /Users/root directory.  T

Today I checked that we have both items which do exactly the same thing. I believe configuration profiles are is the one thing we should stick to. Can we safely remove FileVault policy if it is was deployed already?

I have been getting large amounts of notifications regarding "LaunchDaemon created for persistence Highly suspicious persistence created". After doing some digging it appears that the issues comes up when the newest version of Chrome installs. Also seems like users are blocked from opening Chrome once its updated.Is anyone else seeing this? The install appears to be coming from Jamf as the binary says  "/Applications/JamfAppInstallers/com.google.Chrome/finalize"In protect the file is /Library/LaunchDaemons/com.google.Chrome.finalize.plist and the error is Error: code obiect is not signed at all (-67062), so is this an issue originating from Google or is it a custom installer that Jamf is pushing out?   

I'm new at this software and i'm lost in this mountaim of information, how can I add new computers or any device at JAMF PROTECT?

I am running the below script to autoupdate MS Defender. The script will run fine when I run it locally but will not run via Jamf #!/bin/shcd /Library/Application\\ Support/Microsoft/MAU2.0/Microsoft\\ AutoUpdate.app/Contents/MacOS./msupdate --install --apps wdav00 On most macs it looks like the script has run fine and Script error code is 0 but MS Defender does not update.A few macs give below error Script exit code: 139Script result: /Library/Application Support/JAMF/tmp/ie.tudublin.script.UpdateMSDefender.sh: line 3: 11274 Segmentation fault: 11 ./msupdate --install --apps wdav00Error running script: return code was 139.