Is the management account in each config (one that works and one that doesn't) different? I'm wondering if somehow the management account on the non working one is messed up, and when any installs or other commands run, it tries to use the account, but can't due to it being messed up.
The message your users are seeing is very similar to when a Mac isn't using the proper management account and someone tries to install something from Self Service. They'll get prompted to enter credentials.

@mm2270 - everything looks ok but the password is *'d out so hard to say if there's a typo there. I'd think if it was that though the software wouldn't install though?

I'm not sure about that, but it is a reasonable assumption. Just not sure what else it could be. As a test, you could try resetting the management account password on one of the Macs that's having this issue via the JSS, and then deploy a package to it and see what happens.

Seems like it's because of a configuration profile, not the config itself. I don't know if that's worse or better.

I narrowed down the OSX prompt to the restrictions profile setting to require authentication on disk images.

This is something we set with MCX previously without issue.

I would think that JAMF's package installers would be running as root to bypass this, no?

Hmm. The mounting process may not be running as root. I have no real insight into what they even use, but my assumption is its calling hdiutil to do the mount of the disk image. Since mounting a disk image doesn't require root privileges, it may not be doing that in a root context. Not sure.

Glad you tracked it down at least.

Was there any resolution to this? or alternative options?