Good morning.This is my situation:I have about 60 macs already in use by my colleagues, but they have recently been added to ABM from the our reseller.I would like to enroll them and I know that with sequoia the need of admin rights to perform "profiles renew -type enrollment" has been removed.However, to be able to send an email containing a "one click" process for the end user, there is still a problem: Gatekeeper.I tried to create shell script with Automator, a .command script or an app with AppleScript.Nothing, Gatekeeper intervenes anyway.Any alternative method?...other than having to sign the script with a developer account?Thanks

Hey Everyone, In my organization we are looking for a way to allow users to update some specialty apps without having admin access. There are specific apps such as Kemper, Ableton 11 Standard, Slate Connect, Autotune central, native access, etc.. that only 2-3 users out of about 100 need to update. However when the apps need updates they need to be done ASAP because of how the apps interact with each other. We have uses Make me an admin as a temporary solution but want to move away from that for security reasons. I know that some of the apps are built in to jamfs patch manager section but for the others what can I do to allow the user to update them without giving him full admin access?Thanks in advance

I'm still fuzzy on how to force Chrome to restart after an update without having the user have to do it. I understand that I can use Mac Updates to automatically push updates, but I don't see how to force a relaunch. We run into this pretty often where there is an update, but the users don't relaunch their browser. Any suggestions? What am I missing? 

I'll be coming into Minnesota from Dallas on Sunday. No way I will miss watching the Cowboys play and they will be playing the Vikings that night. What better than to watch it at Brit's? Anyone interested in football and beers?

Hello,   I'm deploying a picture for lock screen.  Now i need to deploy picture as a screensaver. How can i do it ? I couldnt find any guide for this.   Can you help me?   Thank you.  

I've been playing with Self Service+ and don't see anywhere for branding. There's not really anywhere to configure it. We're on Jamf Pro 11.13 where support was supposed to be added. I'm just not seeing it. Anyone else?https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/Self_Service_plus_for_macOS.html

Noticed this popup in Jamf promoting this feature. Its an eventual replacement for Self Service classic (which is set to go EOL in 2026) Its an APP that needs to be installed by Jamf. Any one using this? I see it does not seem to have the ability to run polices (only patch management ones) More info here: https://learn.jamf.com/en-US/bundle/self-service-plus-documentation/page/Jamf_Self_Service_Plus_for_macOS.html

Hi folks, i want to rollout the new self service+. Actually we are using the "old" one with branding. I have two questions: 1. Where do i change which self service is rolled out to the clients? I can download theSelf Service+ .pkg from Jamf. But where can i set in in Jamf pro? I cannot find any options.   2. I downloaded the installation file from Jamf. The branding already works on my mac. Only the app Icon is another (Left old SS - right New SS+). this will probably be correct when i roll out the new SS+ via Jamf?   Greetings Frank

I am trying to create some saved searches to find devices that havent updated to the latest version of an app. We have two apps that both start with the same name. When I search based on Name it only offers the "has" option and it find both apps instead of the one with the base name.When I try to add a app short version regex matches or does not match, it shows me devices with the other app. I tried using the app identifier and that doesnt seem to find it properly either.   How do I properly structure the criteria to find devices with an exact app that isnt running the latest version? For reference I have used chatgpt and the github script for generating the reg ex. I am fairly confident that isnt the issue but the selecting of the particular app that I am having challenges with.

Greetings Jamf Nation!   I have been woking on a more comprehensive Falcon repair script to assist in detecting and/or trying to repair any potential issues found in the sensors.  This is strictly a WIP and I would love to get everyone's feedback on ideas or items that I might have missed.  This script is borrowing heavily from Dan K Snelson, so kudos for him creating the original concept...I just want to take it a "one step further"... #!/bin/zsh # # Written by: Scott Kendall # Date Created: 01/21/2025 # Date Last Revised: 01/23/2025 # # Borrowed heavily from @snelson: source code @ https://snelson.us/2023/03/crowdstrike-falcon-kickstart-0-0-2/ # ###################################################################################################### # # Gobal "Common" variables (do not change these!) # ###################################################################################################### export PATH=/usr/bin:/usr/local/bin:/bin:/usr/sbin:/sbin SUPPORT_DI

For those who don't know, MacOS 15.3RC changes the behavior of Apple Intelligence and no longer provides an opt out during setup assistant. Users can either enable, or click go back, the option to setup later has been removed.    If you are an organization that does not yet allow AI, I urge you to check your beta seed documentation and submit feedback to Apple. Making changes like this in an RC release does not provide prior time to identify, evaluate and implement solutions. Thankfully we are in a good place, but others may not be.   https://developer.apple.com/documentation/macos-release-notes/macos-15_3-release-notes

Hello everyone, I'm new to Jamf but I tried to read and watch all the documentation before asking questionsSaying that, something puzzled meI want to set up "Jamf Protect" and select the "automatically deploy the Jamf Protect PKG with plans" optionHowever, I cannot click on the optionI do see this next to the download button "latest Jamg Protect version: 5.0.1+10I did fill out the info on the "Jamf Protect Registration" with API url, ID and secret keyAnd it shows: Jamf Pro is allowed to access your Jamf Protect tenant at https://fjlabs.protect.jamfcloud.com/graphqlI also uploaded the Jamg Protect version 5.01+10 on the cloud server (just in case)I don't understand why I cannot select the button "automatically deploy the Jamf Protect PKG with plans" ?Tx in advanceWilliam

We have tried to set up device compliance multiple times and it keeps failing on registration.  I currently have a ticket open with jamf support but its going nowhere.I have upgraded my cloud to version 10.46.1Here is part of the log from the company portal app.2023-05-25 13:37:31.279 | workplaceJoinSdk | 344229 | INFO: -[WPJBaseKeychainAccessor getRegistrationInformationWithTenantIdentifierInternal:domainName:error:] [Line 190][2023-05-25 13:37:31 +0000][WPJBaseKeychainAccessor] getRegistrationInformationWithTenantIdentifierInternal - check for incomplete registration or no registration.2023-05-25 13:37:31.279 | workplaceJoinSdk | 344229 | ERROR: [errorCode:-400][2023-05-25 13:37:31 +0000][WPJBaseKeychainAccessor] getRegistrationInformationWithTenantIdentifierInternal - tenant is unregistered!2023-05-25 13:37:31.280 | workplaceJoinSdk | 344229 | ERROR: [errorCode:-400][2023-05-25 13:37:31 +0000][WPJDecisionHandler] retrieveKeychainAccessorForTenantInternal - unable to retrie

Hi Jamf Community,I have been scouring the internet and developing my own script to pull the installed browser extensions from Firefox.Does anyone have this working in their environments?Problems I'm running into in my scripts/Users/USERACCOUNT/Library/Application Support/Firefox/Profiles/* is profile driven, so there could be multiple profiles with different addonsaddons.json file is problematic to work with. Formatting of the output is frustrating, looking to pull just the extension name and version in CSV formatI was able to achieve this using the jq CLT command, extensions=$(cat "$addonsJson" | jq -r '.addons | map({name: .name, version: .version}) | .[]')However I dont want to install this CLT on every system for an EA. Any help would be appreciated. Hoping there is a recent solution available that i missed. 

Hi folks,we have a policy available in Self-Service, which executes a script that opens Microsoft Outlook and set some settings.#!/bin/sh #Get current User currentuser=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }') echo $currentuser #Runs Apple Script with current User sudo -u $currentuser /usr/bin/osascript -e 'tell application "Microsoft Outlook" to set properties of exchange account 1 to {ldap server:"xxx.xxx.local", ldap use ssl:true, ldap port:"xxx"}'When executed from Self-Service we are getting a pop-up asking for "Jamf wants to control access to Microsoft Outlook".We've created a mobileconfig with PPPC but still get the pop-up.Can someone give us a hint how we can solve this?thx and regards! 

Hi everyone, I have the problem that I need all UUID of the clients from Jamf Protect in a bash script. Unfortunately, pages are always limited to 200 entries. Unfortunately I can't get it to move to the next page to query another 200 clients. Maybe someone has an idea how to do this.   API Call from Bash Script #Read Out all UUID from JAMF Protect protectuuid=$(curl -H ‘Content-Type: application/json’ \\-H ‘Authorisation: $jamfprotectapitoken’ \\-X POST ‘$jamfprotectapiurl’ \\-d ‘{’query‘: “query {listComputers {items {hostName, uuid }}}”}’ | jq -r .data.listComputers.items | grep uuid | awk ‘{ print $2}’ | sed ‘s/^.//;s/.$//’ | tr ‘[:lower:]’ ‘[:upper:]’)

testing Google Secure LDAP integration (Cloud Identity Providers) I can lookup a user and it returns the user, but not the groups associated to the user. I can lookup a group, but no users are associated.  Everything is configured as per this https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/Google_Secure_LDAP_Integration.html LDAP is configured for the domain in Workspace Can someone who has this working shed some light!   

Hey all!   I just had a user send me the attached screenshot. I was wondering if anyone else had seen this, and, if you did, did you find a way to disable it? Our leases terms are three years, but we try to run our Macs for three years at least or "until the user notices they should probably get a new machine" at most. These pop ups send a very clear signal to the user of "hey, your computer is old". Any thoughts?  

I'm having a really hard time consistently getting forced updates to work through Jamf. I finally was able to get a upgrade via packaged policy to work yesterday but I'm not having a lot of success using the Software Update payload within the policy for minor updates. I need to figure this out because ensuring that our computer operating systems are up-to-date are the whole reason why we upgraded to Jamf Pro in the first place. I'm currently testing computers going from 13.0.1 to 13.1 and 12.6.0/1 to 12.6.2 It says the policy executes correctly, but it's not installing the updates on the computer

We set up Edge using an App Configuration within the Mobile Device App to force InPrivate mode and it was working until the most recent Edge update to version 131.2903.54. Now when Edge is installed on a newly Jamf enrolled iPad or uninstalled / reinstalled on an existing managed iPad the app immediately closes after opening. When I removed the configuration to force InPrivate mode the app opens but is not in InPrivate mode which is a requirement for our company. This is the configuration we were using that no longer works.  Has anyone else run into this issue?  <dict><key>InPrivateModeAvailability</key><integer>2</integer></dict>

 To renew a SCIM (System for Cross-domain Identity Management) token in Apple Business Manager, you will need to follow these steps:Log in to your Apple Business Manager account using your admin credentials.Click on "Settings" in the lower-left corner of the screen.Click on the "Integration" tab in the upper-right corner of the screen.Find the integration for which you want to renew the SCIM token and click on it.Scroll down to the "Authentication" section and click on "Renew Token".A pop-up window will appear, prompting you to confirm that you want to renew the token. Click "Renew" to proceed.The new token will be displayed on the "Integration" tab. Copy the token and use it in your SCIM-enabled identity provider to update your integration.Note that you will need to update your SCIM-enabled identity provider with the new token before the old token expires to ensure uninterrupted SCIM provisioning. The expiration date for the token is shown on the "Integration" tab.To update the S

I know this appears to have been partially answered in an older post, but it's a nearly 10 year old post. Does anyone have any idea how to disable the "Enable automatic connection" for 802.1x in Network Settings? Very similar to that post, the networking team has enabled 802.1x on our network switches before we were ready to implement it with the expectation that "well, Windows will ignore it until its set up". MacOS will not unless the toggle/checkbox for "Enable automatic connection" is turned off. My users are getting repeated popups telling them 802.1x authentication has failed until we get around to sending at tech to toggle that choice manually. I'm hoping there is any other way, rather than doing it manually. Any help is appreciated!

I am testing moving users from Admin to Standard and I am running the command below in Files and Processes in a policy and it works and makes the user Standard, but when I reboot it reverts back to Admin. The machine was bound to the domain (we are working to get away from that), so I thought maybe that had something to do with it, and I unbound and ran the policy again and when I rebooted, I was back to Admin again. I have no policies applying post reboot and none of my profiles appear to be doing anything in terms of user rights. Does anyone know what I may be missing and how I can keep this from happening? dseditgroup -o edit -d myusername -t user -L admin

I have an iPad that has a boogered charging port with no charge. I want to bring back the license for a $250 app. I am un-managing the iPad, but since the device has no power to check in with the JAMF Pro server, it is never considered un-managed.I have un-managed the device & released it from Apple School Manager.   Any help is appreciated.   Bill

Just started using Installomator and was curious if it's possible to create a single policy that installs multiple apps.