Hi,I have had some issues with Jamf Pro 10.48 and had to revert back to 10.47. Unfortunately I am now stuck at the welcome screen at the welcomescreen at "Analyzing webhook_display_fields". I let it sit there for half an hour but it does not seem to do anything. When I try to restart anything it just breaks the database and I have to restore again.Has anyone had this issue and can tell me how to get out of this?Kind regardsAndreas Baumeister 

I (like others) use a smart group for students which lists devices that have “Apps Not In the App Catalog Are Installed”, in case some talented student is somehow able to download or sideload apps we don’t allow. I then use a configuration profile to hide all apps except those they downloaded/sideloaded, making their device near useless until they remove the offending app.Unfortunately with the iPadOS 26 update, Jamf Pro reports all the iPad default apps (camera, contacts, calendar, etc.) in the installed apps report. As these are default and can not be purchased through the app store, there is no way to add them to the app cataloge. So now every device that updates to iPadOS 26 will be considered to have unnauthorized apps on them. Not sure if this is a bug that Jamf will be able to fix, or if there is another work around to this.

How do we configure a computer smart group to show which computers have Touch ID configured/enrolled for locking/unlock? I’ve tried ChatGPT, Gemini, and Claude to help configure a computer extension to no avail.

Jamf School currently assigns users and devices based on the following premises:Each user is assigned a username, which Jamf School treats as a unique identifier. Devices are linked to users via this username.However, there is a design flaw in the current implementation:It is possible to create new users with an already existing username, either manually or via CSV import. Jamf School does not issue a warning or automatically adjust the username (e.g., by appending a number). The original user is silently deleted, and a new user with the same username is created. All devices previously assigned to the original user are now assigned to the new user. This behavior occurs across the entire Jamf School instance, including across different locations.Jamf School should enforce globally unique usernames across all locations.Since location managers can only view users within their own location, they cannot verify whether a username already exists elsewhere.Therefore, Jamf should implement a ce

I just found out that Pre-stage Enrollment Customization Panes do not work at all with Return to Service.  How are people getting authenticated users with SSO (Cloud IDP with Entra is already setup with the connector as is Jamf Account), which translates to SSO on the device itself, also working with automatically assigned Prestage Enrollment and Return to Service?  Are there good resources for best practices?  I've found the documentation is lacking and Jamf 100 classes are basic. Support has mentioned Jamf Setup but that looks like it requires Shared iPads and I’d like to avoid those and we’re 1:1 with thousands of devices already.  I see mention of Microsoft Authenticator with the SSO App Extension - I have this set up in Jamf School in our current implementation already but I don’t see how this works in Jamf Pro without the Azure webclip login if I can’t use a Customization Pane with Return to Service - the latter being one of the primary reasons for the move.  Thanks!

I wanted to see what are the options for example a user losing their password login and on the admin side resetting it. I’m aware there is FileVault and giving a recovery key but they messes up specific keychains and some other settings (portnox). I’d like to see if there is a way an admin can assist without that option. I’m planning to do a writeup after suggestions here and have documentation steps for a user.   

Hello- Let me start by saying that I am unfamiliar with VMs. We are a 1:1 Apple School. One of our HS student’s is taking a cybersecurity class online and has requested I install Virtual Box on their MacBook, along with Ubuntu. What sort of security, privacy issues am I looking at here? We have JAMF Safe installed on all our computers. Will they be able to skirt our filters?

Afternoon Im trying to deploy Zbrush which is dmg which has .app file wrap inside it.I have packaged this into temp location \\private\tmp Im then running a script to install it.Having all sorts off issue trying to get the script to mount the dmg.Seems to work fine through terminal using hdiutil attach /private/tmp/MaxonZbrush.dmgDoes anyone have experience with working with DMG or any good resources.Thanks in advance Tom

Updated to Jamf Pro 11.21 yesterday afternoon and have found that when enrolling iPads with a name set in Prestage and the “Enforce Mobile Device Names” option checked, the device record will have the checkbox unchecked when I click Edit on the general tab.  I see 11.21.1 is out this morning, perhaps need to update again and see if this was silently resolved?

Today we are releasing a maintenance version of Jamf Pro; highlights include: Platform SSO Reporting Functionality for the Jamf Management FrameworkJamf Conditional Access.app, which is part of the Jamf management framework installed on enrolled computers and used for device compliance with Microsoft Entra, can now report on Microsoft Entra ID Platform SSO registration status and provide additional information about the registration state, including device ID and user UPN. Resolved IssuesJamf Pro Server: Security IssuesJamf provides the CVE-ID for security issues with high or critical severity when possible.[PI141347] Fixed: A known vulnerability in a third-party library (CVE-2025-41249). [PI141349] Fixed: A known vulnerability in a third-party library (CVE-2025-41248). [PI141856] Fixed: A cross-site scripting (XSS) issue. [PI141857] Fixed: A cross-site scripting (XSS) issue.Jamf Pro Server[PI120484] Fixed: Jamf Pro's PreStage enrollment displays iOS 17.5 as an available minimum OS ver

We removed JAMF from a laptop but it failed to remove the MDM profile. Now, without JAMF on the machine, what is the best way to remove the profile?

Hi everyone,I’m currently exploring the world of cloud computing and container orchestration, and I recently discovered the Kubernetes and Cloud Native Associate exam. From what I understand, it’s a great starting point for anyone interested in Kubernetes fundamentals and cloud-native application development.I’d really like to hear from those who have already taken this certification. What are the main topics or skills covered, and how challenging did you find the exam? I’m also wondering if hands-on Kubernetes experience is essential before attempting it, or if studying theoretical concepts and basic commands is enough to build confidence for the test.My goal is to strengthen my understanding of modern deployment environments and gain practical insights into how Kubernetes fits into DevOps workflows. Any tips, study materials, or learning paths you could recommend would be greatly appreciated. 

Hello,We manage iPads in Jamf Pro and i have a question if its even possible to transform a native app like Files or Preview into managed app.By default native apps like Files or Preview are considered as unamanaged application even though a device is managed by Jamf Pro.Since we have a restriction “Documents from managed sources open in unmanaged destinations” se to “Restricted” due to possible data leaks there is no option to work with managed files in app like Files or Preview, that’s a real shame.Due to this behaviour we have to just rely on 3rd party apps like OneDrive or Adobe Acrobat Reader which we can make managed because the are installed via VPP.Is there any option to use native apps for managed documes even with the restriction turned-on? So make a native app mamaged? 

I just set up a new iPad for a teacher and after enrolment all apps that should be deployed are marked as Waiting for Licenses despite having hundreds available. Things I've tried to resolve: Restart iPad Refresh Apple VPP token Re-apply profiles Re-apply apps Reset iPad and re-enrol   Nothing works. Still stuck on "Waiting for Licenses". Does anyone have any ideas about what I should do to resolve this?

Issue:Jamf Pro / Jamf Protect CIS Level 2 profile is blocking AirDrop on my MacBook.Profile:Sequoia_cis_lvl2-security.firewall Firewall: Enabled (incoming connections restricted) Stealth Mode: Enabled (ICMP responses blocked) Problem:With this profile active, AirDrop detects my MacBook but fails to connect. The firewall blocks incoming connections needed for transfers.Request:Looking for a way to allow AirDrop while keeping the CIS Level 2 firewall policy in place — ideally via a Jamf exemption or configuration tweak that preserves compliance.

This article is based off of the presentation at JNUC given by ​@tommypatzius , ​@Jordy-Thery and ​@glennu  Our session at this year’s JNUC 2025 was designed to present a list of helpful tools available to Mac Admins of all skill levels and backgrounds. We know that everyone’s experience with Apple device management is different, so we’ve pulled together a collection of tools that are approachable, practical, and, in many cases, free. Many of them have a low learning curve, making them accessible whether you’re brand new to managing Macs or have years of experience. Our goal is that everyone walks away with at least one new tip, trick, or tool they didn’t know before. To make things clear and easy to follow, we’ve divided the tools into categories by function: Apple apps, Jamf tools, maintenance, setup & customization, notifications & support, and inspection tools. We took a closer look at a few specific highlights—Jamf Helper Constructor, Self Service+, and IBM Data Shift—befo

Simple suggestion: Could you please integrate Jamf App Catalog in Mac Onboarding so we can deploy Apps from the Jamf App Catalog? Many Apps we deploy today in Mac Onboarding would be available through the Catalog but we currently need to deploy them as Policies. 

We are experiencing an issue where a users, suddenly  get signed out of their Google account and unable to sign back in. When they attempt to log in, password is not accepted. The strange part is that no one changed password — not the user, nor either of our Jamf admins or Google Workspace admins. local Mac password (which is supposed to stay in sync with their Google password through Jamf Connect) still works fine, but his Google account password no longer matches. To clarify:  User was logged in normally and did not request or initiate any password change. Users unexpectedly signed out of their Google account. When attempting to sign back in, Google reports the password is incorrect. Their local password on the Mac still works and allows them to log in to their device. Jamf Connect is deployed, and their local and Google passwords had been synced properly before this incident. We verified that no password reset or forced password change was made from the Google Admin Consol

So as of recently, our iPad 5th Gens are not able to enroll after factory reset to 16.7.12. We’ve had to do factory resets on iPads that are out of space. Our 6th and higher version iPad’s (17.7.10 / 18.7.1) appear to fine at the moment. Jamf Pro still claims to be supporting iPadOS 16, where JamfNow supports a minimum of 17.x. Has documentation not been updated regarding iPadOS 16?Not sure where to go at this point as we have a plethora of 5th Gen iPads still in our school environment.

Hi, Has anyone yet figured a way to write an extension attribute to report whether a device is TouchID capable or not? bioutil does not seem to give any indication of capability regardless whether it's run on a TouchID capable device or not. There doesn't seem to be anything returned by system_profiler to indicate. Struggling to find anything that could be leveraged... CheersDan

I figured this would be helpful here. We use it to remotely grab logs from a Mac. Throw the script in a check-in policy and assign a computer to it. At next check-in, you will have their logs.This script will output the network quality. It then uses the API Role/Client 'Computer Attachments' (Update Computers, Read Computers, Create Computers) to pull the JAMF Computer ID using Mac serial number. It then runs sysdiagnose to create logs. It will then upload the logs to the Attachments section in the JSS portal. I set access token time to 300 because the file it uploads can be 400MB.Logs can be then downloaded from JAMF - Computers - Computer - Attachments.#!/bin/zsh --no-rcs## AUTHOR: Joshua Clark## DATE: 09/06/2025## PURPOSE: This script uses the API Role/Client 'Computer Attachments'## to pull the computer id using Mac serial number. It then runs## sysdiagnose to create logs. It will then upload the logs to the Attachments## section in the JSS portal.## NOTE: Client ID and secret

I’m unsure if this effects iPadOS 26.0 as I have just pushed out iPadOS 26.0.1 to devices this week.  We have a Single App Mode profile for TD Snap (though app doesn’t really matter).  After the device is rebooted it looks like on the home screen you can’t unlock the device.Swiping up just shows “No older notifications” but does not unlock the phone and take it to the Single App locked mode to TD Snap.Has anyone else experienced this?This iPad is on iPadOS 26.0.1.  Didn’t have this issue prior to the update.

Hello guys, i am affected by the MS latest security patch Microsoft Active Directory Strong Certificate Mapping Requirements. My devices cant connect to wifi via certificates after the latest patch. My devices are not in domain, also users are local , so when i tried the objectsid Extension attribute it didnt work even though i have cloud idp as azure connected and i guess its because  users are local. Do anyone have any idea how to tackle this :) Can we use UPN or some other attribute for macbbos that uses local user account and not in domain?

I had a few devices upgrade to iOS 26 and the homescreen layout is not working….has anyone ran into an issue with this? 

Hi So i’m working in school where we are setting up Apple Tvs we  wanted make slideshow, although github is a good shout it is too public to use, is there any private websites that follow GDPR that could be a good recommendation? I was thinking about sharepoint, but not sure if that would work