After the October 13, 2026 cumulative update, our on-prem NDES started rejecting SCEP requests from Jamf Pro SCEP Proxy (Jamf Cloud). Each failure logs:Application log, source NetworkDeviceEnrollmentService, Event ID 60 (EVENT_MSCEP_REJECTED_SID_IN_SAN_URI): “…rejected a certificate request because the Subject Alternative Name (SAN) extension contained a URI entry with a security identifier (SID). SID values must not be present in SCEP request SAN entries when no custom policy module is registered to validate them.”Our profiles follow Jamf’s strong-mapping guidance: a URI SAN of tag:microsoft.com,2022-09-14:sid:$EXTENSIONATTRIBUTE_#, with the EA pulling objectSid. That’s exactly what NDES now refuses.Environment: Windows Server 2019 NDES, AD CS, NPS for EAP-TLS Wi-Fi Trigger: KB5126651 (the Server 2019 October update). Uninstalling it restored enrollment immediately. Impact: existing certs keep working, but new enrollments and renewals fail.Microsoft appears to accept a SID in a SCEP r

Recently (October 2026) Apple made some changes to their app purchasing UI and license management, has anyone else seem issues in their JAMF Pro instance with iPad error messages like “No license was found for app “com.clever.InstantLogin” ?My team and I have been trying to figure out what was causing this errors for a week now. JAMF suggested to renew our ASM token, which did not solve the issue. Apple’s changes seem to be relate to the app license numbers and if they are free or paid. If the app is free, it will show a huge available license number in JAMF, like "2,156,452,236" which somehow seems to cause the license issue I'm getting in my Jamf instance. The only solution I have right now is for the user to install apps multiple times before one attempt miraculously and randomly succeeds. JAMF support has our server and VPP logs, the issue has been escalated to a higher engineering team but have had no answer as of today.Have any of you seen this issue recently or had success in fi

We’re deploying MyViewBoard (free, Mac App Store) to Apple Silicon Macs via Jamf’s VPP “Mac Apps” distribution. The install reports success and a license is consumed, but the app won’t launch — [I get either no feedback when I open the app or I get a message telling me the app cannot be opened]. If a user instead opens the App Store themselves and clicks “Get,” it installs and works fine every time.The app is a Designed for iPad app but can work on Apple Silicon.Has anyone run into this with MyViewBoard, or with other App Store apps that are iPadOS binaries running on Apple Silicon Mac? Curious if there’s a known fix or workaround for getting this working with JAMF Self Service since our users don’t have Apple IDs with their macs unless they use their personal one.

When I try to delete an empty, no longer needed static group, I get the message: “The following items are dependent on this Static Mobile Device Group and need to be updated:...”Then there is a list of profiles, policies, and apps the group is scoped to.There are NO devices in this group, so why can’t I just delete it?  It appears that I will have to go to each item listed and manually remove the defunct group from its scope.  The group I am currently looking at has 12 items its scoped to.  12 items to click in to and remove the group from scope, BEFORE I can delete the group.  Others have 20+ item which will be very time consuming if this is what I have to do to get rid of EMPTY unwanted groups and clean up my Pro instance. Thoughts?  Am I missing something? Thanks!

Today we are releasing a maintenance version of Jamf Pro; highlights include:Changes and ImprovementsJamf Pro 11.33.1 includes Tomcat 10.1.60. Resolved IssuesJamf Pro Server: Security IssuesJamf provides the CVE-ID for security issues with high or critical severity when possible.[PI209200] Fixed: A known vulnerability in a third-party library (CVE-2026-41715).​​​ ​[PI214500] Fixed: A cross-site scripting (XSS) issue.​​​ ​[PI228082] Fixed: A broken access control issue.​​​ ​[PI230883] Fixed: A known vulnerability in a third-party library (CVE-2026-84939).​​​ ​[PI209383] Fixed: A known vulnerability in a third-party library (CVE-2018-14040, CVE-2018-14041, CVE-2018-14042, CVE-2016-10735).​​​ ​[PI232915] Fixed: A known vulnerability in a third-party library (CVE-2026-97687).​ ​[PI232918] Fixed: A known vulnerability in a third-party library (CVE-2026-101896).​ ​[PI232922] Fixed: A known vulnerability in a third-party library (CVE-2026-91777). Jamf Pro Server[PI-1577] Fixed: Inventory subm

I work for a school county and all our iPads have some apps in single app mode and they are not auto-locking and the battery is draining fast.

I’ve got a simple solution with dockutil.Package installs automatically after enrollment or recurring check-in Installs Password Manager.app in /Applications and to files in /usr/local/bin   Script for dockutil runs after the installation.dockutil --add "/Applications/Password Manager.app"All gets installed but the application is not put in the Dock. The details says: Script exit code: 64 Script result: Error: /var/root/Library/Preferences/com.apple.dock.plist does not seem to be a home directory or a dock plist Usage: dockutil [<options>] [<plist-location-specifications> ...] See 'dockutil --help' for more information.  Does anyone know what’s wrong? The Mac I’m tesing on runs macOS 27.0.1 and our version of Jamf Pro Cloud is 11.33.1.

We’re currently testing Jamf Setup Manager with Simplified Platform SSO.When Jamf Setup Manager is triggered and reaches the Preparing stage, the Mac restarts. After the restart, instead of continuing the expected setup/enrollment experience, the device comes back to the macOS login screen where only the local administrator account is available to log in.Has anyone experienced similar behavior when using Jamf Setup Manager with Simplified Platform SSO? If we remove Jamf Setup Manager from the enrollment workflow, the Simplified Platform SSO setup completes successfully.So the issue only seems to occur when Jamf Setup Manager and Simplified PSSO are both part of the enrollment process.Has anyone encountered this behavior? Are there any known configuration considerations or timing conflicts between Setup Manager and Simplified PSSO that could cause the Mac to restart and return to the local admin login screen?

The Jamf Nation User Conference is a special time for Apple IT folks. Some attendees are still recovering from the massive uptick in steps covered during the conference. Others are still buzzing over the Keynote and State of the Union announcements. And we Apple Admins got busy the following Monday implementing fresh Apples.As for me, I walked away with 10 random thoughts floating around in my head. Between BBQ eats, pho dives, and caffeinated drinks, I even rented a car to extend my stay through the weekend with a car rental for city exploration.Let’s jump into the list! 1️⃣ The JNUC experience gives everyone an excuse to explore new towns. Every city has its own DNA. I like to get to know a place through my stomach. So, which BBQ did I like best? I actually preferred Q39 over Joe’s KC BBQ. The meats were just better at Q39. The hour-long line at Joe’s didn’t thrill me. Though I loved the interior space. The meats were a tad dry and on the salty side. Am I going to get flak for this? 

Hi Nation,Product Office Hours #10 - Self Service Plus: Designed for Admins, Built for the End User ExperienceNext session: Thursday, 22nd Oct - 9 am CDT / 3 pm BST / 4 pm CEST Speakers: Sara Graves, Senior Product Manager and Mateusz Popialo, Principal Software EngineerRegister here: https://jamf.it/ProductOfficeHours 🧵 Got a question? Drop it in the comments below ahead of time if you want it on our radar, though you don't have to. We'll be taking questions live on the call! The Q&A transcript will be added to this thread post event.See you there!

Does anyone know if you can or there are plans to be able to make folders for Blueprints. A coworker and I were working on some and were talking about how it would be nice to be able to sort them. 

When Apple devices began appearing in your org what did you do? Was there an immediate reach for device management? Were conversations held? Were various teams corralled together to lay the groundwork?How did your org handle the various Apple requirements stretching across:Endpoint EngineeringNetwork EngineeringSecurity EngineeringIAMPKISOCArchitectureService DeskProcurementChange ManagementVendor ManagementBefore, during, or after implementing Apple device management.I want to hear your stories, please.

Hi,We have to renew any iPads fleet from our parc.Is there a way to massively remove devices, as iPads from Jamf?Also the same question in AppleSchool Manager? Thanks for your tips.Best Regards.

We are deploying beyond trust jump clients on all of our macs and following the instructions by setting up a configuration profile to enable all screen sharing, disk sharing other settings on the backend through jamf without users being notifiied however still some of the users are presented with this which is annoying for the user as well as IT team . what could have been missing in the configuration profile . any help would be greatly appreciated  

Hi Nation,Product Office Hours #11 - Platform API, Terraform and Jamf-CLINext session: Thursday, 29th Oct - 10 am CDT / 3 pm GMT / 4 pm CET Speakers: Hernán Romero, Senior Product Manager and Neil Martin, Senior Systems EngineerRegister here: https://jamf.it/ProductOfficeHours 🧵 Got a question? Drop it in the comments below ahead of time if you want it on our radar, though you don't have to. We'll be taking questions live on the call! The Q&A transcript will be added to this thread post event.See you there!

TL;DR: Okta Platform SSO enrollment with Jamf works on an existing account, but the Identity First (Simplified Setup) PreStage flow fails with "Registration failed" before any credentials are entered. Looking for the full list of PreStage requirements, plus best practices for recovery when the Okta and local passwords diverge.ENVIRONMENT- Jamf Pro (cloud), macOS Tahoe 26.x, Apple silicon, ADE through ABM- Okta Verify 9.59.0 (enrollment package), Okta Platform SSO with password authentication- Fleet currently uses Jamf Connect Login/AuthChanger; my test Macs are excluded from both- Local admin account created by Jamf's managed local administrator (LAPS-style) settingGOALZero-touch onboarding: ship a Mac, the user signs in with Okta during setup, the local account is created and linked to Okta, and IT has a dependable recovery path if the user gets locked out.TARGET WORKFLOW1. New Mac is added to ABM, auto-assigned to Jamf, and lands in a dedicated PreStage.2. During Setup Assistant, the

A full 24 hours before the opening keynote lights came up, a room full of admins had already rolled up their sleeves and dived into the Jamf Platform. That's Level Up, a one-day exclusive in-person training at JNUC, where folks can chat it up with other admins, jump right into the products, and walk straight into hands-on labs, all while earning a badge to prove it along the way. This year's sessions filled up fast, and having spent the day watching the classrooms in action, I'm convinced it's the best-kept secret of JNUC. I wanted to share what it was like from the inside and make the case for why you shouldn't skip it next year. Two tracks, one packed dayThis year, two training options were offered: Level Up Your Jamf Management and Security Workflows, and Level Up Your Automation and Jamf API Skills. Both were structured as hands-on labs, not lecture-and-slides sessions, which meant admins spent the day actually building, configuring, and troubleshooting rather than just watching a

I have Self Service (Classic) and Self Service + on a macOS 27.0.1 Created a new Blueprint and added Self Service+ information into it.The settings I’m managing are not being applied to the endpoints.Removed few sections, rearranged items on the left.I even changed scope to only two devies and made it simple to track (static group) deployment status.Ideas? 

Issue - Adobe Reader, when installed using the default “vanilla” method e.g., via Adobe’s public download, exposes users to In-app advertisements and upgrade prompts promoting Adobe Acrobat Pro features setting the expectation that all users are entitled to Acrobat Pro licenses. I created a plist file, but it isn’t working. Can anyone help me sort this out? I’d really appreciate it. Thanks in advance!

HI I am trying to connect domain and its hard to connect with JAMF .I have checked all DNS Servers but its not working . Server authentication we were getting . I need solution for this , please can anyone help on that.Thank you .Asha

With recent macOS updates introducing Declarative Device Management (DDM) controls for Migration Assistant (migration-assistant.settings)—allowing IT admins to restrict or allow selective file and folder migrations—I wanted to check how others are currently handling this payload.Jamf prides itself on Day 1 support for Apple features, but currently, Jamf Pro does not have a native blueprint component or UI option in the Blueprint Builder to deploy and manage migration-assistant.settings.While other MDM vendors have already integrated DDM support for Migration Assistant settings into their platforms, it appears Jamf relies on future roadmap cycles to surface these Apple DDM specifications.A few questions for the community:Is anyone successfully deploying migration-assistant.settings via custom DDM declarations/blueprints or custom profile workarounds in Jamf Pro today? Has anyone received updates from their Jamf Account Team on when this DDM payload might be officially added to the UI/Bl

looking to the community for recommendations on keeping tabs on Apple updates.My org is strict about keeping things up to the latest version within 30 days.What sites/ RSS feeds, etc do you use to track upcoming updates?

 On some of our managed Macs, users notice a screensaver password prompt that runs indefinitely with an  old interface —even after entering the correct password, the dialog reappears immediately. This doesn’t happen on all Macs, only on a subset of our fleet. Investigation:an affected Mac using:security authorizationdb read system.login.screensavervalue: authenticate-session-ownermy question : Can the authorization database change the Mac unlock interface?