I used the “Defer software update” function so that our users could not upgrade to iOS 26 since it seems to be killing the battery on our phones. However, I wanted to send out iOS 18.7 for security reasons. I was able to send it out via Software Updates but if our users don’t catch the update prompt the first time it is sent to them, they will hit an error, and they can not install it other than going to General > Software Update which we have blocked.I was wondering if anyone has reached a similar obstacle and was able to find the best way to proceed. Thank you!

Hey all,Working on a script that prompts the user for information. Once complete, I set the script to ask the user if they would like to enter another response. If yes, a policy is triggered to call the script again. I seem to be getting an error. I believe it is because you can’t trigger a policy that is already running.I’m aware I can make the loop within the script. Just want to confirm that this is not possible. Has anyone run into this or found another option?

I recently spent some time working on a script to deploy AirPrint printers as we’ve got a few of them on our campus that don’t have driver support from the manufacturer, meaning AirPrint is the only option. I wanted to share what I’ve come up with in case anyone else is in need of this. All you have to do is change the details in the “Printer details” section at the top of the script to match your printer’s IP address, location, and display name. I’d also recommend modifying the PPD path slightly to give it a more specific name than just printer_driver.ppd. Example: break_room_printer_driver.ppd. Note: For this to work, the Mac needs to be on the same network as the printer since it queries the printer to gather the information to create the PPD file. The result is that you can deploy an AirPrint printer to your Macs via Jamf Pro complete with the icon and everything!   #!/bin/bash # Adds a printer via AirPrint. # Author: John William Sherrod - jwsherrod@mac.com # Version 1.0: 02

Students in our School figured out, that Widgets and Focus cancel restrictive Settings you set with Jamf. For example: With an other Focus you can change your Homescreen and use Widgets. If you lock the Screen with an App like Classroom you also can get around the Screenlock by clicking a Widget like the clock.Is it possibly to block Focus or at least Widgets on other Focuses?

Hey all,So I know we can use Jamf Connect or even just a script for elevation to admin for a standard user. Has anyone attempted to creating some form script that would require the user to enter a validation code provided for the admin rights before granting rights?The work flow would look something like this, SS policy that prompts for a code. The code would then verify against “something” - maybe an API call. Once it could verify the number it completes the script that elevates permissions temporarily.Im not sure where the script could validate the code from though. Maybe just a parameter that the Helpdesk could enter upon request?Thoughts?

Hello, looking for some help/advice.Has anyone successfully deployed the Dameware Remote Everywhere Agent?Does anyone have a working script they could share?We have created the bulk agent and have the ID, but no success.Thanks for any info.

Hi,Could any one guide on how we can migrate data between two managed macOS devices and same for iOS devices?

Hello everyone, you can probably help me with a request.I created a configuration profile for software updates in Jamf Pro, and I enabled "Automatically install app updates from the App Store" because I always want to have the latest updates for apps installed from the App Store.However, there is one app that I don’t want to update automatically, and that’s Xcode. This app must not auto-update, because newer versions of Xcode don't always work for our developers.I deploy Xcode via the Mac Apps - App Store section. In the settings, I disable "Automatically force app updates", but it still seems to update on its own.Do you have any idea what I could do?Jamf support told me that since it’s an app installed from the App Store, it’s not possible to block automatic updates for that app only.Any ideas?Thanks all

Looking at a JAMF instance that  has this policy that runs once a day on recurring checkin. (scoped to ALL 4K+ macs)it’s just a files and processes: softwareupdate -ad --verboseI feel this policy is totally unnecessary. OS X caches updates BY DEFAULT. I’m watching this in real time on a workstation using jamf policy -verbose and it’s just sitting there doing nothing but burning up bandwidth cycles and preventing software install policies that the customers actually want from ever running.  

Testing out GlobalProtect for our Mac users and running into this keychain issue. We are using a local Certificate for authentication but the machine wants to use the system keychain every time GP tries to connect. The goal is to have the users never have to authenticate or enter a password after the local cert is installed. I have already amended the ACL to include the GP app but the keychain still wants to be accessed. I am also using an administrator account, but still am prompted. If I manually unlock the System keychain from the keychain menu I am still prompted when I try and connect. Thank you for any help or tips someone may have.

A notice in “Other changes” in the 11.20.0 Release Notes mentionsApple deprecated the following keys in macOS 26*, iOS 26*, iPadOS 26*, and tvOS 26*. This change deprecates the Defer updates of settings in the Restrictions payload for computer configuration profiles and the Defer software update setting in the Restrictions payload for mobile device configuration profiles.This is not currently noted in the Restrictions profiles for devices or computers.  They mention using Blueprint builder to manage deferrals going forward.   Time to test Blueprints once we get past the last deferrals  or 26 apparently.  

Is there a better way to update Users chrome app via JAMF? I’ve been using Mac Apps and it’s working for the purpose, however the issue is with the force quit. Sometimes while users are in an online meeting, chrome just force quit to update. I want to force update but not while they are using chrome.

Hi all. AirDrop is enabled for use between our shared iPads. However, when transferring files, the iPads emit a beep, but no notification appears to accept the transfer. Do you have any insights into what might be causing this issue? The devices are running iPadOS 18.3.1.Thanks in advance for your help!

I have a Configuration profile to set the wallpaper to the corporate wallpaper, but that give error on MAC OS 26 Tahoe.Any one with the same problem?

Hi there,I'm looking for some assistance please in coming up with a solution to sharing organisation contacts to 100+ iPhones as read-only.In our current setup we're hosting the contacts on a Google account and have configured the Contacts payload in JAMF with the Google CardDav server which works great, however is NOT read-only, meaning end users are able to add/modify/remove these shared contacts which we do not want...I've faffed around with different solutions such as CoContacts, however am yet to come up with a solution that works. Any assistance is greatly appreciated!!P.s we have no allegiance to Google contacts and are only using it as a temporary stop-gap, but happy to switch to another platform if it will allow for read-only contact sharing that can be deployed via JAMF. Thanks again.

As the subject says, if I have auto update for a VPP app for iOS is set to disabled, new version comes out, app updated on one device, users verify the new version is good to go, how do I send the update to a thousand devices at once?  In our WS1 environment it’s simple, I just select the radio button next to the app and click Update.

I’ve tried testing a few times with Tahoe Beta and now Release and can’t get a Platform SSO to trigger an account creation. I’m tried just scoping profiles to target workstations, adding the profile as well as adding the profile to my Pre-stage.  What am I missing? PSSO works great once an account is created, however I can’t get the Tahoe specific options to occur. 

Hello , Is there any way to block all apps except the chosen ones? I saw on Apple developer that whitelisted app were deprecated whitelistedAppBundleIDs[string],but solution with allowListedAppBundleIDs didn't work for me. In my case I need to push policy to block everything except preinstalled apps and 5 chosen by IT. 

Howdy all, I am facing an issue that I can’t seem to solve with running Microsoft AutoUpdate via script from Jamf to keep our mac office apps updated. I have had this set up for several years and it had been working beautifully as a hands off solution. I am not sure exactly when it started failing, I recently noticed the problem and started digging into it. I am wondering if anyone is facing the same problem, or has advice on what to try.The setup is fairly simple, a policy that runs against a smart group of any macs with office apps that are not the latest version once a day. It runs a script to use the MAU command line msupdate to pull and install any available updates.Script is below, it only worked under user context originally so that is why it is set that way.The error I am seeing on every run now is related to the XPC connection, this happens on all clients no matter what, -reinstalled MAU with latest version, brand new mac build with latest install etc.  I have the original PPP

Has anyone had luck hiding the 4 slides that appear after an upgrade to Tahoe? 

Hey all,  Wondering if anyone has any ideas on this? I am wanting to utilise SAM to lock down our iPads to a specific app. Trying to scope this through a department group but the device isn’t showing in the logs for the configuration profile. There are devices in there, just not the two that I specifically need. Both devices that aren’t showing in the logs are supervised and managed institutionally so unsure on what the issue is here… I have also checked to see if I can manually add the two devices but they are not showing when I try to search for them? Getting increasingly confused as the devices that are showing scoped currently, and are in the profiles logs, are NOT supervised...

Morning,Despite my best efforts i haven’t found a solution online so my question is, can i deploy an automator workflow i’ve created via Jamf Pro as some sort of policy of which i can then distribute to selected machines?Thanks

Hi All,  We have setup Jamf Pro SSO and Cloud idP for to EntraID. We then tried to use the EntraID groups for the targeting of applications/configuration profiles but they wouldn’t scope correctly.  I logged a ticket with jamf support and their theory was that because we map UserPrincipalName (i.e. Full email address), this doesn’t match the username on the local account because it doesn’t support the @ symbol. Their suggestion is to drop anything after the @ symbol on the mapping but it’s not that simple as we use the full UPN for other configurations in Jamf.So i guess my question is does anyone else have iDP setup with Jamf and do you sync the full UPN and able to target users via EntraID groups?  TIA.

We use Jamf Pro Cloud with Jamf Connect (for account creation + Entra ID password sync).After enabling “Use Self Service+ as the default end user app” in settings:Old Self Service was upgraded to Self Service+ on existing Macs Jamf Connect was removed, menu bar now has Self Service+ icon instead On new enrollments, we install Jamf Connect 2.45.1 → now it’s there alongside Self Service+I can’t find clear docs on this — so:Questions:Is Self Service+ intended to replace Jamf Connect completely? If yes, should we skip installing Jamf Connect post‑enrollment? Or should we move to Jamf Connect 3.x? Any official migration guide for 2.x → 3.x with Self Service+?Any experience or official Jamf resources appreciated.

I’m trying to implement Jamf Setup Manager. I have everything aligned regarding the configuration profile and the Jamf Setup Manager PKG assigned as an enrollment package. But the PKG won’t install. I’m not seeing any logging or the app in the Utilities folder after enrollment. Any suggestions would be appreciated.