I need to get an inventory of VS Code extension in my enviromnent. I was going down the road of using Extension Attribute. I have this script created, and using Advnced Search to view the results.This script is returning the value of “Not Installed” for devices where VS code is not installed.Devices where VS Code do not report back any installed extensions. This is the code I am using#!/bin/bash# Define the location of the Visual Studio Code executable.VSCODE_APP_PATH="/Applications/Visual Studio Code.app"# Check if VS Code is installed.if [[ -d "$VSCODE_APP_PATH" ]]; then # List all installed extensions and their versions. # The output is piped to a series of commands to format it for readability in Jamf Pro. EXTENSIONS_LIST=$(/Applications/Visual\ Studio\ Code.app/Contents/Resources/app/bin/code --list-extensions | tr '\n' ',' | sed 's/,$//'

Hi All,I've never had a problem before using composer to package apps until version 10.28. When packaging a drag and drop app such as Krita or Blender, Composer has started displaying this error message during the 'Build as PKG' build process - Couldn't communicate with a helper application. I've never seen this before, it's doing it on a clean install of Catalina 10.15.7 and on a different machine with an upgrade to Big Sur 11.2.3. It will package VLC successfully but not Krita or Blender.It will create DMGs ok for all three. All three are given the same owner/group & permissions before creating a new PKG. Root, Admin and 755. Has anyone else encountered this issue and were you able to resolve it?Thanks for any info!

Is there any expectation that the Self Service+ icon will be Liquid Glass compatible when using custom branding? This would be helpful for consistent appearances across the new macOS UI. I created a .icns file using Icon Composer that contains icons using our own branding for Default, Dark, and Mono themes but, I’m unsure if there’s a preferred or supported method to deploy these icons in a way that ensures compatibility with Liquid Glass design standard. 

Hi! We finally upgraded Bomgar or BeyondTrust Remote Support to 24.3.2 to support Sequoia. The only issue I'm having is finding a way to allow standard users to toggle on, or allow applications in System Settings > Privacy & Security > Remote Desktop.I didn't see anything in the PPPC Utility tool and wasn't able to find anything in Jamf Pro under the Privacy Preferences Policy Control config settings.   Wasn't sure if it's possible to allow currently or not but thought I'd ask here.  

I got a request to have the Multitasking option to have the apps in full screen or windowed mode blocked. I’m not seeing a way in Jamf Pro to do this. Does anybody know of a way to restrict that or all of the multitasking settings or if it’s on the horizon to come at a later date?

I can’t login to account.jamf.com.

When will see Web Clips updated in Jamf Pro to include the TargetApplicationBundleIdentifier string so that we can set an app to open a Web Clip on iPadOS (e.g. set Google Chrome to open a Web Clip instead of Safari)?More information here:https://developer.apple.com/documentation/devicemanagement/webcliphttps://emm.how/t/ios-14-changes-in-configuration-profiles/1285/2 (scroll down to WebClip Payload)

HiDoes anyone know how to fully restrict an app using the safelist and blocklist payload in Jamf School? I added the path and it kind of works, but our students are Administrators on the computers so all they need to do Is click "allow once" and then use their admin login. this kind of defeats the whole purpose of blocking apps in Jamf. I also noticed that renaming the blocked app to anything else enables the user to use the app, is there any way around this? 

Creating a report of our Apple TVs you are able to include the wireless mac addresses but there seems to be no option to include the wired Mac Address. Has anyone found a way to include the wired MAC in a report?

Hi, I want to have a dynamically updating swiftDialog UI appear in the login window. Each disparate part of this endeavor goes fine: swift dialog works, my launchagent works in the loginwindow domain, I can even get swiftDialog windows to spawn in the login window! Success, right? No. As soon as you bring this commandfile business into it, it stops working entirely. I’ve captured error from the /usr/local/bin/dialog script, and it reports that the “loginwindow” user cannot open the specified command file. I understand this to be a symptom of the sandboxing inflicted on the loginwindow process. I cannot find a combination of file locations, permissions, and owners that would allow me to get this working. So… I just have to ask: is this possible whatsoever? Am I barking up the wrong tree here? Could using Outset maybe make this possible?

Hello,I am trying to make a LaunchDaemon that will run a script I packaged in composer when it sees that MDM profiles have been removed from the machine.The idea is to make it easier for our end users to be enrolled into JAMF from our past MDM. As I understand it there might still be some user interaction needed but we are trying to make it as seamless as possible given that wiping is not really an option on our side nor do we have the bandwidth among the team to be able to this. In essence we deploy the package and the plist files to the end users machines(using current MDM), and when the machine becomes unmanaged from said MDM, it kicks off the process of running the pkg which contains a script to renew MDM profile. I think if the pkg is signed then we should not see too much need for user interaction. Let me know if this is feasible. Our other thought was to create a swiftDialog that walks users through

Hey guys, Anyone know of a way to transparently do this on Mountain Lion or (pushing it) Lion? I've gone through the fdesetup options in Mountain Lion and nothing stands out.

Platform Single Sign On extension (PSSOe) is a framework built into macOS introduced in 2022 with the release of macOS Ventura.  Intended as an extension of the Extensible Single Sign-On extension (SSOe) for cloud resources, it adds the optional functionality of syncing a local macOS UNIX user account password wi

Hi everyone,Does anyone know if there’s a way to block or remove Google’s AI Overview feature when using Google Search on an iPad?Our customer is currently using Safari as the browser. I’ve seen that adding “&udm=14” to the search URL can disable AI Overview on desktop browsers, but as far as I know, it’s not possible to edit the search engine URL in Safari on iPadOS.Using a different browser or switching to another search engine could work, but that feels a bit excessive.Has anyone found a workaround for this?

So I posted asking for help on this here site with a script to automatically force log off users after 30 minutes and to wipe the desktop. A helpful soul provided me with something which does that and deletes the profile which does clear the desktop. Unfortunately that would not work for the people requesting this and they came back with a new wrinkle: they wanted 2 desktop shortcuts to a couple of websites which need to be preserved when the log out and wipe takes place.I thought I found the right way to go which works in Terminal as well as when the following lines are in their own script in Jamf.find /Users/libuser/Desktop -type f -not -name "Click Here to Open a Ticket with ITS.webloc" -and -not -name "Library Homepage.webloc" -exec rm {} \;killall loginwindowThe problem is, the find command doesn’t run even though the killall loginwindow one does. If I can just get the find command to run then I’ll be all set. I

Anyone else out there noticing an issue where updating iPad to 26 is logging users out of their Apple ID’s??

In our Jamf Protect tenant, we have a multitiude of devices that have been retired and no longer in use.  They still show in Jamf Protect unless we manually delete them and skew our results. Is the correct process to keep our Jamf Protect Computers inventory tidy to manually delete them from Jamf Protect?  Does Jamf Protect have any auto-expire policies?  For example, if disconnected for 6 months then purge device from Jamf Protect.

Is there any Jamf Pro API (not the Classic API) that allows retrieval of the membership of a given static computer group?I found the endpoint GET /v2/computer-groups/smart-group-membership/{id}, which returns the membership of a smart computer group, but I couldn’t find a corresponding endpoint for static groups.If there isn’t a Jamf Pro API for retrieving the current membership of a static computer group, what’s the recommended way to add a computer to an existing static group using only the Jamf Pro API?

Dear JAMF Support Team,We have configured NDES on our internal Root CA and verified that the iPad can reach the NDES URL (https://ip/certsrv/mscep/mscep.dll) — communication is working correctly.For testing, we created a new SCEP profile in JAMF School and pushed it to the iPad. The Root CA certificate payload was successfully pushed and is reflecting on the iPad.Issue: The client certificate is not being issued. There is no certificate request appearing in the Certificate Authority. Communication between iPad SCEP profile and CA is not occurring as expected. Steps already completed: Root CA certificate pushed to iPad via JAMF School → verified installed. NDES installed and configured on Windows Ente

Issue:Jamf Pro / Jamf Protect CIS Level 2 profile is blocking AirDrop on my MacBook.Profile:Sequoia_cis_lvl2-security.firewall Firewall: Enabled (incoming connections restricted) Stealth Mode: Enabled (ICMP responses blocked) Problem:With this profile active, AirDrop detects my MacBook but fails to connect. The firewall blocks incoming connections needed for transfers.Request:Looking for a way to allow AirDrop while keeping the CIS Level 2 firewall policy in place — ideally via a Jamf exemption or configuration tweak that preserves compliance.

Return to Service is working well for our loan devices, but unfortunately we can no longer use the Jamf Reset app as it destroys the necessary wifi profile.  The app has been a great time saver when returning devices, and we’d like it back in servic.We should be able to modify the app config with something like     <key>ReturnToServiceEnabled</key>    <true/>Tried that and it didn’t work.  Has anyone had success with this?

Hi,We’re using Jamf Radar and I created a group where internet access should be completely blocked except for a few allowed sites (internal tools and Jira, mostly).At the moment, full blocking works as expected. I then added some test domains under Custom Rules with "Allow" selected, but they’re still being blocked.What’s strange is that a domain like reddit.com, which is allowed via a custom rule inherited from the root level, works fine. But any domain added directly at the group level doesn’t work, even if the rule looks identical.Is there a known issue with group-level custom rules not applying correctly?Is there a better way to block all internet traffic for a group and only whitelist a few domains?Thanks,Michał

I uploaded the Protect plan to Jamf Pro configuration profile. I was wondering if Protect also works on devices? I tried to upload the same file to the devices but it ends up failing. If there is any documentation for deploying to devices, please point me to it!

We have a wireless network name with an underscore in the name which has not been a problem until now. We are unable to edit the scope for the configuration profile. The page does not load properly and when clicking the add button a spinning icon appears but the search input box and list of computers never appear.  

Got platform SSO working with Entra on 15 and now that 26 is out, trying to get registration during setup working.  Keep getting the following error during setup: Unable to Sign-InThe single sign-on extension could not validate the domain.  Contact your administrator to help get single sign-on set up.