I am seeing a Keychain not found alert after I recently started enforcing OneDrive Desktop and Documents sync. This just happened on my newly enrolled test Mac after I registered platform single sign-on. The alert appeared as I was logging in to OneDrive. There is actually an entry in Keychain. I looked up the ID shown in the screenshot. Reset to Defaults is NOT the right choice. I found that unlinking the Mac from OneDrive and then signing in again helps, but this prompt came up as I was in the process of logging in. We use platform single sign-on so there is no password prompt. Has anyone else seen this and solved it? 

I have some MacBooks that are pre-stage enrolled that have stopped checking in and stopped inventorying.  I have others that are User initiated enrolled that stopped checking in but I just had them remove the profiles and redo the enrollment and they are working again.  These are all remote users so I cannot be hands on.  I had a few of the pre-stage enrolled devices attempt to run sudo jamf recon and sudo jamf policy from terminal but they are receiving "Device Signature Error - A valid device signature is required to perform the action"  Other postings I've seen that are quite a bit older mention unenrolling devices and reenrolling them.  Not really an option if they are pre-stage enrolled from what I understand.  Does anyone know what I can do get these devices reporting properly?

With Jamf Pro 11.26, session options configured in Jamf Account are enforced, computers with macOS 26 or later are automatically registered with the Jamf device compliance integration with Microsoft Entra ID during enrollment, and administrators can programmatically manage Jamf Pro user accounts with the Jamf Pro API!  Be sure to check out the Jamf Pro release notes for all of the exciting new features and enhancements.Thank you for your continued support and feedback!

Today we are releasing Jamf Pro 11.26; highlights include:Support for Session Timeout Settings in Jamf AccountJamf Pro now respects "Inactivity timeout" and "Session duration" settings configured in Jamf Account for environments integrated with OIDC-based single sign-on (SSO) through Jamf Account. Device Compliance with Microsoft Entra Supports Simplified Setup for Platform Single Sign-OnJamf Pro's integration with Microsoft Entra device compliance now supports automatic device registration with Microsoft Entra when using Simplified Setup for Platform Single Sign-on (Platform SSO). This eliminates the nee

We use Jamf Pro and have an integration with Conditional Access to register Macbooks within Microsoft Intune.We have recently started receiving this error message and have not been able to resolve it. Who can help me think about how we can tackle this issue?

Hey all - Ran into a thing that has been mentioned before, but it was a year ago and a few Jamf Connect login versions ago. We are now up to 3.6 Had a user who had their Microsoft Authenticator switch from sending them push notification to enter a number to requiring her to enter the 6 digit number. She would get the Jamf Connect Login window and enter her MS login, PW and the 6 digit 2FA code. The Jamf Connect Login window would stay up, but load her profile page. She would also see an error that password needed to be at least 7 characters, and contain one number and one alphanumeric character. It took me a VERY long time (and a computer wipe) to figure out that it looks like the Jamf Connect login window is passing that 6 digit number to the OS for login instead of the users Password.  Once we reset her Authentication Methods in EntraID so that the push notification workflow returned, her login issues on her laptop went away. 

I am a jamf admin working on getting our enrollment modernized. Within the last year we got our connection setup with ABM and Jamf so that our devices will have automated enrollment during setup. The issue we are running into is that our company requires all devices on internal network to be trusted (typically using a certificate)Since the enrollment is happening during the setup experience, I cant see how there would be a way to get the device the certificate before reaching out to our enrollment server. If we are on internal we get an immediate block. We have to connect it to an external network to enroll.  I put in a request with our security team and after some back and forth I asked if our specific enrollment URL could be allowed access on the network without being trusted. Understandably they are not too keen on this idea. I can’t find anything from jamf on getting around this, has anyone had a similar experience in their enterprise on anything like

Hey folks! Dropping in for another quick Self Service+ post on how to: determine available URL schemes for a macOS app (in this example, Self Service+.app) how to map policy URLs from Jamf Pro to the new schema and have the actions load within Self Service+ The Self Service app has historically supported URL schemes to automatically run a policy or open the app directly to a description of a given policy. Within the Self Service settings of an app policy in Jamf Pro there are installation and description URLs provided. Those URLs tie into URL schemes for the Self Service app, and can be launched in scripts and by sharing them directly via link.

Hi I’m trying to set a wallpaper for Apple Tvs in a school. I’ve set a configuration profile which locks the Apple TV in the conference display mode. I’ve also created a smart device group where i’ve uploaded a test jpg file, but it doesn’t want to pickup the wallpaper. Does anyone have have suggestions?

Hi, I want to deploy an initial default Dock layout after enrollment is completed, where the end user can later change it to whatever suits them.I’ve heard of multiple methods, such as using Dock items in Jamf Pro settings, scripts, Outset with docklib, and dockutil. I was wondering what the easiest and most hassle-free approach would be as an MDM administrator. Thanks in advance.

Mac Admins Europe is a new conference built by and for the European Apple Admin community, bringing together admins from education, enterprise, and beyond to share knowledge, swap war stories, and find their people closer to home. Organizers ​@mischavdbent , ​@rob_potvin, ​@Armin and me reflect on what's driving the growth of the community, why now felt like the right moment and what success looks like.When you look at the European Mac admin community today versus a few years ago, how has it changed, and what made you feel the time was right for a dedicated European event?A few years ago, the European Mac admin community felt more fragmented. There were gre

Before we get too far into this I want to say one thing. I am not a medical or mental health professional. I’m a Jamf Engineer who has thought a lot about this but by no means am an authority on the subject. The following article is my reflections and not any type of mental health treatment. Now that that’s out of the way…here we go! Nobody goes to school to be a Jamf Engineer or Admin. The vast majority of us ended up in this field because we like to tinker with things, eventually break them and are forced to fix them without any help or education. For a lot of us, we ended up in this field by doing other things in a job where we do have formal training.When you fix what you’ve broken, you feel great. But when you can’t fix it, some of us give up, others seek advice, some keep plugging along to find the solution.  But what happens when you end up in a corporate environment and you have to tackle things that you inherited, need an upgrade or

We are having problems with apps signing out  each time our students try to to use them on their iPad. They sign in with Google Single Sign on or use the QR code. As an example our students use the IXL app, sign in with google sign in and the next day they are signed out again. Does anyone have this problem or have solution on if something set in JAMF School would be able causing this problem?

Hi everyone i'm trying to understand the best way to configure Jamf Protect with our jamf instance. I set up a smart group in jamf to alert users about security issues and that works fine. Unfortunately the jamf protect documentation is a bit incomplete imho. What are the next steps i need to follow? Any suggestion or guide to suggest? Do i need to manually remove the mac from the smart group? Jamf Protect has some removing capabilities or i need to clean the mac manually?

Took me awhile to discover this and could not find a solution anywhere in Jamf Nation so thought I would post my solution I used. I have several Extension Attribute scripts that require a user to be logged in (including 2 provided by Jamf Onboarding, Jamf Connect First Run and Entra Registration statuses). Problem is if Inventory Update runs when no user is logged in (yes, this happens) the script does not detect current user so it cannot access current user folder to check plist file so it updates the EA to Not Found losing the Entra Registration completed or Jamf Connect First Run Completed (or any other EA that uses user directory).I created a script to detect if user logged in and if not to use a cached status created/updated from previous run when a user was logged in. Hopefully this helps someone else or someone else has an improvement to it: #!/bin/bash# 1. CREATE EA CACHE# Set this to match your EA name exact

With Apple recently expanding access to the ABM/ASM API, I set out to recreate the GSX experience. By leveraging Jamf’s new MCP feature, Claude Code, and MUT, I believe I’ve come very close. Additional details are outlined below.Please visit the following Github repo for the latest version of Warranty Wrangler: https://github.com/brndnwds6/Warranty-Wrangler/tree/main Warranty Wrangler — Setup & Usage GuideThis guide walks through everything needed to run warranty_wrangler.zsh, a script that pulls warranty and AppleCare+ coverage data from Apple Business Manager (ABM) or Apple School Manager (ASM) and produces CSV files ready for import into the Mass Update Tool (MUT).PrerequisitesA Mac running macOS Administrator access to Apple Business Manager or Apple School Man

Any on know how often is the built in Jamf External Applications repository updated in Jamf Pro?Also is Jamf pulling these from https://github.com/Jamf-Custom-Profile-Schemas/ProfileManifestsMirror?I noticed com.microsoft.autoupdate2.json was update on the github Feb 17 2026 but is does not seem to be updated in the built in Jamf External Applications repository (still says Revision: 2024-12-13)  

Hello all you Jamf Rockstars,I was building a new package and decided to add the script I needed to run at the end as part of the package instead of a separate component in the Jamf policy.  When I tried to deploy it I got “Installation failed. The package could not be verified.”Turns out this can happen when Gatekeeper rejects the package because the package is unsigned, and included a postinstall script.Composer has a setting for signing packages, I do not have that configured.  There is also a field for “Default Bundle Identifier” under the advanced tab. Is anyone signing their packages?  Do you use a third-party cert?Are you populating the “Default Bundle Identifier”?  Thanks in advance,-Pat

With the update of iOS 26.4 there is now a prompt for age verification in the UK for content. Most of our managed phones do not have apple id’s associated with them and all apps are distributed through self service. Is there a blanket way to say all the phones are with users who are over the age of 18 to avoid having to deal with many service tickets.

Hello,I am trying to update our method of deploying out the essential sounds for GarageBand through Self Service. In the past, I had leveraged the Carl Ashley AppleLoops script (it worked great!). After Apple removed Python from the base installation of macOS, I had been limping along with installing Python on the devices that were needing the sounds. This has posed other complexities.Currently, I am testing out installing all of the sound packages needed for the Essential Sounds from a cached copy of those packages on the laptop. This has not produced the desired results yet. The user is still prompted to install the sounds when launching GarageBand. All of the sounds that should be available from the Essential Sounds are present in GarageBand. The loops have also been reindexed in hopes that would resolve the issue.I would appreciate any help that anyone has to offer.Thanks!

Has anyone successfully implemented Epic Bedside using JAMF? I have the MyChart URL but anything after that I am lost. If so I could use some help with the AppConfig for Bedside. Epic has not been much help and our Epic team is not familiar with the values needed. Here is the only information Epic sent us. Work with your MDM representative to pass your MyChart server URL to hospital-owned tablets so the tablets can be activated with a numeric code. The MyChart Bedside application must be updated to version 10.9 or higher to receive the server URL. Pass your MyChart URL to the Bedside tablets. The exact setup to include the MyChart URL in the managed app configuration varies, so you should refer to your MDM system's documentation to determine how to provide the configuration value. Add the Configuration Key of MyChartURL to your sent configuration o

I'm trying to configure the app request for our iPad users but I'm not seeing the App Request option in the Self Service app.  I'm testing this on myself. So far I've... Created a static group and added myself to it In Settings > Self Service > App Request App Request Form > Checked "Enable App Request in Self Service for iOS" App Request Form > Added some request form fields and set the App Store Country/Region Requestors and Approvers > Set the Requesters to the static group Requestors and Approvers > Added myself as an Approver Email Address In Settings Self Service > iOS General > InstallType = Automatically install Self Service app General > Checked "In-house app updates" General > Landing Page = Home App Options > User Login = Allow users to log in to the login menu Signed into the Self Service app

Hello all,   I am working on deploying the updated company wallpaper.  Current attempt is using the script below, but it gives the user a that “Jamf wants access to control Finder...” (screenshot attached). Maybe there is a better way to do this. #!/bin/shcurrentUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}')sudo -u "$currentUser" -H osascript -e 'tell application "Finder" to set desktop picture to POSIX file "/Library/DesktopWallpaper/backgroundDefault.jpg"'exit 0 

Update your iPhones and iPads right now’'Darksword' exploit just went global: Millions of iPhones now wide open to hackersiPhone exploit DarkSword has been released in the wild | Mashable