Skip to main content
Question

Scoping All Computers - with two new Mac Mini/Studio

  • Nov 10, 2026 11:43 AM UTC
  • 3 replies
  • 34 views
BookMac
Forum|alt.badge.img+16

Hello jamf nation!

In our current Jamf Pro instance, we have many policies, configuration profiles, apps (from the App Store or Jamf App Catalog), and blueprints scoped to "All Devices." We now want to set up a Mac Studio and a Mac Mini to act as "servers," which will require specific, separate configurations. Since many items are currently scoped to "All Devices," these two machines would automatically receive those configurations as well. Both Macs will be assigned to a new, dedicated PreStage enrollment.

We need a strategy to handle both our existing items and any new items we create moving forward.

I’ve come up with a few ideas:
1. Add two additional sites to the default "Site 0." Move the existing clients into "Site 1" and the two new Macs into "Site 2." This would provide a clean separation, though it’s not an approach officially recommended by Jamf.
2. Configure the new PreStage to be excluded from all existing items, as well as from any newly created items that are scoped to "All Computers."
3. Create a new Smart Computer Group (SmCG) that includes "All Devices" but excludes the two Macs, then scope all items to this new SmCG instead.

Have you encountered a scenario like this before, and what would you consider the smartest approach?

    3 replies

    PaulHazelden
    Forum|alt.badge.img+14
    • PaulHazelden
    • Jamf Heroes
    • Nov 10, 2026 12:34 PM UTC

    I have one device that cost me a day of work.
    I went through everything I could and set it as an Exclusion to all existing Policies and Configs.
    I was lucky with Blueprints, I have none sent to All devices, they might hit All but I do that through adding Groups.
    That is how I deal with “Special” case devices.
    My Special device is Managed but not managed. It is there in the Jamf Server, but it doesnt get all of the Controls we normally put in place. I trust the User to manage it on their own. If anything is needed on it, I can simply remove the exclusion.
    All new policies get made with it in as an exclusion, even if there is no possibility of it falling in scope.

      Chris_Hafner
      Forum|alt.badge.img+29
      • Chris_Hafner
      • Jamf Heroes
      • Nov 10, 2026 1:27 PM UTC

      ​@BookMac There may be even further possibilities than the three you list, however I tend to use your “Option 3”. A smart group that includes all of what I consider “Standard Devices”. Which is as you describe, all devices, with exceptions and exclusions.  It works very well and will keep you out of this situation with other blueprints moving forward. 

       

       

       

      justin_smith
      Forum|alt.badge.img+8
      • justin_smith
      • New Contributor
      • Nov 10, 2026 2:22 PM UTC

      On the PreStage question specifically — no, there's no second step after enrollment. If the two Macs enrolled through Apple Business Manager, they already came in via a PreStage enrollment; that's how Automated Device Enrollment works. The device is assigned to your Jamf Pro server in ABM, and in Jamf Pro it's scoped to a PreStage enrollment, which supplies the enrollment and Setup Assistant settings. You can see which PreStage they went through under Computers > PreStage Enrollments.

       

      Two things worth knowing: if you want these two on different enrollment settings than the rest of the fleet, create a separate PreStage and scope just those two serials to it — and a PreStage only applies at enrollment time, so moving a Mac to a different PreStage only takes effect if it's erased and re-enrolled. Also, the 'Automatically assign new devices' checkbox on a PreStage covers future machines as they show up in ABM, so you don't have to scope each one by hand.

        Terms & ConditionsAccessibility statement