Is it still the case that there is no way of allowing Location Services for a specific app, for non admin users? I don’t see a PPPC option for it, and it’s been stated that this is impossible in the past. Zoom soft-phone client wants location services enabled for 911 call routing. Users don’t have admin rights.I've seen someone say the below works for Big Sur, but even then I believe that just enables the general Apple location services, and not specifically for an app in particular.#!/bin/sh sudo /usr/bin/defaults write /var/db/locationd/Library/Preferences/ByHost/com.apple.locationd LocationServicesEnabled -int 1 sudo /usr/bin/defaults write /Library/Preferences/com.apple.timezone.auto Active -bool trueI need Location Services checked for Zoom specifically.

I am trying to prepare for our next semester.  I do not upgrade instructional machines until the semester is over.  In doing so, I learned that my older Intel machines could be moved up to 13.6.3 and started to do so.  However, for the Lab Instructor machine, this disables valuable features within Remote Desktop for non-admin users.   For my lab instructors logging in via AD, this would be the three options to the: Copy, Install, and Unix. Of all these Copy would be my critical loss for a lab instructor.  They can still observe.13.6.2 still allows my non-admin users access to all these features.Also, for machines running Sonoma (my M1 machines) I also loss the ability to login to all lab machines at once via my admin account.  This would be using the Send Unix Command of an osascript   The error they return is 143:162: execution error: Not authorized to send Apple events to System Events.So . . . if Apple Remote Desktop is still part of your

A profile called "whitelist during school hours" is setup with a time filter. It has a whitelist, so that private games and other unwanted apps will disappear from the students' home screen. Unfortunately, the profile works only for 60-80 % of the iPads automatically. We have to push the button "re-try" in the administration console, or we have to ask the students to open the app Jamf Student, so that their iPads asks the Apple Push Server for any updates (including updates on profiles).Have you experienced non-reliability with time filtered profiles?Any suggestions how to fix that are welcome. (We tried IP address based profiles that work a bit better, but they aren't reliably either.)

Found out today that some students have the "Private Wi-Fi Address" option enabled in the settings for their appropriate SSID.  We don't want this setting enabled on any of our iPads so we have it disabled in all of our wifi SSID config profiles.  I had one this morning that I was able to enable and disable it, I tried restarting but no change, also tried removing and adding that SSID's config profile but no change, I could still enable or disable.  All of our devices are running ~16.6 or newer, probably around half have gone to iOS 17.  I'm guessing it defaulted to off rather than on like an unmanaged SSID would normally due to the profile disabling it, some just found that they could enable it for whatever reason and have.

Hi allApologies if this has been answered already but we are trying to push an 802.1x LAN profile down to our macOS devices.We have managed to push the wireless equivalent down with a certificate etc however when we try and create the LAN equivalent the device doesn't pick the certificate defined in the profile. Has anybody come across this issue before? We've seen a similar issue in the past with windows devices where you have to start the wired auto config service but wasn't sure if something similar was required on macs?thanks  

NOTE: Okta Verify appears to have rolled back to 9.23.0 as the official release which is working in macOS 18.1 beta 6.  iOS SSOe support appears to be working in 9.24.1 with iOS 18.1 beta 6. Limitations and RequirementsApple has made two revisions to the PSSOe framework.  V1 allowed for Password authentication and can be used with macOS Ventura and greater.  V2 added functionality for authentication with PSSOe to include SmartCard and Secure Enclave credentials. At this time, Okta supports the V1 framework with limited support for V2 with Shared Device Keys.  The “Password”authentication method is available with Okta.  PSSOe support is limited to local account password sync only.  The PSSOe credentials are not used for authentication to Okta gated resources.  To complete the setup for the full expected behavior of PSSOe, an administrator must set up both the Extensible Single Sign-On extension (SSOe) configuration and the PSSOe configuration on the same device.  Okta uses a hybrid of t

Not a Jamf Pro issue, but Jamf Pro does hightlight it.  Four years ago when we got our first Silicon Macs, we occasionally found the odd machine which we couldn't log on with our admin account. Password wobble. We never found our the reason and just went into Startup Options, wiped the Volume Group and re-enrolled.  We now have more Macs, almost all Silicons now, so we see the problem more.  In order to ensure that our first admin account has Secure Token, we create it through Jamf Policy.  We've found that on Macs where we've flattened it with Erase All Content, or even Disk Utility in Startup Options (yes we definitely delete the Volume Group, not just Macintosh HD), we get the odd case where the Policy failed because "a folder with that name exists".So Erase All Content, and even Disk Utility says it has erased the Data Partition, but somehow it hasn't. Not knowing as much about Macs as I do about PCs, I'm guessing that the partition table is held in NVRAM,

Can anyone help with JSON script line to change the name of Managebookmarks?  "ManagedBookmarks": { "type": "array", "title": "Bookmarks",

Hi all,I've done a lot of work on creating a LAPS tool of my own which can be found here https://github.com/PezzaD84/macOSLAPS But with the release of 10.49 the JAMF LAPS solution is looking a lot better than initially. So I have created a couple of tools to help configure the LAPS settings and view the LAPS account and password.Check them out here:LAPS Configurator tool - https://github.com/PezzaD84/JAMFLAPS-ConfiguratorView LAPS Credentials - https://github.com/PezzaD84/JAMF-LAPS-UIPlease note these are very early release so there will be changes to come!All feedback is welcome😁

I suck at writing extension attributes... I need one that will determine the version number currently installed on a Mac. I have a Smart group setup to filter out current versions, leaving computers with old versions. I need the EA so when I pull a report, I can not only see what version is installed, but compare it to the macOS that is installed on that same machine. Is there a tool or something to help create an EA like this?

Just checking to see if anybody else is running in to this issue. When we started deploying Office updates, we were using Installomator, but we started seeing some issues where not all of the office apps were updating. We then switched to the package, but we're having the same issue, where some of the office apps aren't updating and it breaks the app, so we have to just rerun the installer. The other issue is, after it updates, it sometimes removes the icons from the dock, but not all it'll just remove one.

I had this extension attribute that will tell me if the mac had Office 2016 or 2019 installed, I need one now for office 2021, can anyone help me modify it? #!/bin/bashwordVersion=$(defaults read "/Applications/Microsoft Word.app/Contents/Info.plist" CFBundleShortVersionString)majorVersion=$(awk -F '.' '{print $1}' <<< "$wordVersion")minorVersion=$(awk -F '.' '{print $2}' <<< "$wordVersion")if [[ $majorVersion -ge "15" ]]; thenif [[ "$majorVersion" -ge "16" ]] && [[ "$minorVersion" -ge "17" ]]; thenecho "<result>2019</result>"elseecho "<result>2016</result>"fielseif [[ -d "/Applications/Microsoft Office 2011/" ]]; thenecho "<result>2011</result>"elseecho "<result>Not Installed</result>"fifiexit 0

This is for iPhone. I have enrolled some devices and i was wondering if its possible to password protect certain apps so the user has to input the passcode to open X app.  Thanks!

SSID discovery in macOS 15 Sequoia need not require excessive execution cycles Background One of the many under-the-hood changes in macOS 15 Sequoia of which Mac Admins should be aware is how to determine a Mac’s currently assigned Service Set Identifier (SSID), commonly known as the name of the user’s selected Wi-Fi network. Continue reading …

Hi All, I'm trying to automate the actual Computer to Site assignment via API as we keep on having Computers assigned to wrong Sites.. :) So far I have not had much success, does anyone maybe have an idea how to tackle this?

Hello,Previously, I was able to execute policy in Self Service from a Custom Menu bar in Jamf Connect, but it hasn't worked in months. When executed with Self Service closed, I get "Self Service quit unexpectedly" "Click Reopen to open application again. Click Report to see more detailed information and send a report to Apple." The command works fine if Self Service is already open though, so it seems like it's an issue just launching Self Service from the menu bar.Here is the section of the custom menu bar I'm talking about, if someone sees something that no longer works, please let me know:<dict>     <key>Action</key>     <array>          <dict>               <key>Command</key>               <string>url</string>               <key>CommandOptions</key

Hi all,   We have recently switched our LDAP integration from AD to OKTA. How do I bulk update user and location from AD based outdated info over to OKTA based. Any assistance is appreciated.    The MUT app looks like it would require alot of manual work to setup excel and is labor intensive.  

so it seem that the build it option JAMF Pro does not woke and i see the same problem others have posted the white brick when i try a ad login, so i suck with Mac scripting also now to JAMF looking to do is when the system runs in enrollment or first boot and it see the MDM setting and start to run that.   last step would be join AD.what i am looking to have it do is1. Join AD2. set the OU3. set the AD commuter name the the SN then reboot if needed4. this maybe a second scrip ( when assign a use set the Mac name that show up in mac info to the Users name)

Designed as a possible last step before a MDM “Lock Computer” command, FSWL.bash *may aid in keeping a Mac computer online for investigation, while discouraging end-user tampering Background When a macOS computer is lost, stolen or involved in a security breach, the Mobile Device Management (MDM) Lock Computer command can be used as an “atomic” option to quickly bring some peace of mind to what are typically stressful situations, while the MDM Wipe Computer command can be used as the “nuclear” option. For occasions where first forensically securing a macOS computer are preferred, the following approach may aid in keeping a device online for investigation, while discouraging end-user tampering. Continue reading …

I received this feedback from one of our teachers testing out Jamf Teacher- When I take control and lock them in an app, it literally clears their ipads from all other apps. Which is great! Except when I clear the locks on my end, all of their apps end up in different locations on their device. So I had a few angry students that spend hours organizing and categorizing folders and apps then suddenly I come along and clear things and then their apps are all messed up and scattered. That isn't a nice feature of this app for sure. I get it. I love having my iPad organized by apps I use and in folders. It's a shame that this developer didn't think of that aspect of things when designing the app. Just a little feedback for you. Are others experiencing this?

Hi All,I have a machine which is appearing in JAMF when searched for under the Inventory tab. However, it is not showing up in the Settings > Global > Automated Device enrolment menu, or in Computers > Enrollments > Prestage Enrollments. Can confirm that it exists in JAMF and is enrolled in the MDM in ASM.As it does not exist in 'Prestage enrollment' when booting it doesn't go through prestage enrollments.I can enrol the device using the online login https://ourjssdomain/enrol, however this is a specific use case where I need the machine to be enrolled through Prestage as the machine could be wiped whilst the user is on the go for security reasons.When running sudo profiles renew -type enrollment get the message: DEP enrollment failed: No device Enrollment configuration was found for this computer (MDMDeviceEnrollment:103)Which is obviously occurring because JAMF hasn't got it selected to run the device enrollment config, because it doesn't exist in there.Any idea on w

 Hi,I have managed to mostly create a configuration profile that will make our Sonoma Macs compliant with CIS Lvl. 2. But I have come across two problems:1. An Administrator Account Cannot Login to Another User's Active and Locked SessionIf I am not mistaken, this should be fixable in one of two ways:a) By executing/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1which I have done, and the corresponding check, whether this has worked,/usr/bin/security authorizationdb read system.login.screensaver 2>&1 | /usr/bin/grep -c '<string>authenticate-session-owner</string>'produces a result of 1, which is correct. But still that policy is failing in Jamf Protect.b) By setting values in /Library/Preferences/com.apple.PowerManagement.plist which I have also done through a policy. But this actually sets the values in /Library/Managed Preferencesand has no effect.Can you point me in the right direction?2. When I set

Jamf Protect hast baselines for CIS Lvl.1 and Lvl.2.Is it possible to use a different baseline, e.g. v8?

I'm unable to login to Jamf Pro after following the setup procedures.  I'm integrating Jamf with Google Workspace and got locked out. Google Error 403.Error: app_not_configured_for_userService is not configured for this user. I am the admin on the account and GWP.

I have two profiles setting proxies up in the com.apple.SystemConfiguration domain.Both work if I double click on the profile and install via system settings, neither work if I install them via Self Service or pushing them from Jamf.Running 'scutil --proxy' shows an empty dictionary and trying various websites that should work all fail.I've tried a few different version of Sonoma and none work. I'm running "11.1.1-t1701704198" Jamf Pro on-prem.