As you’ve probably heard, Declarative Device Management (or, for less of a mouthful, DDM) is making significant changes to the way in which managed devices go about their business in some key ways - most notably how managed software updates work. We’re going to take a look at this in detail, as it’s been a particularly hot topic in the Apple Admin community over the last couple of years.   What is DDM, anyway? Firstly, it’s not a typo of ‘MDM’! In a nutshell, gone is the notion that the MDM server needs to constantly check-up on how a device is getting on with a certain command it’s been asked to do; instead, the device has much more independence and tells the MDM server when something has been done. This majorly cuts down on the stream of commands issued to devices (particularly when performing remote software updates, which we’ll loop back to shortly) and means that a growing number of attributes, such as OS version, can be updated on the MDM without an inventory update command

Hey ya'll -Newish to managing Jamf here! Our team is looking to force notification previews for the Self Service application, even if the end user has "show previews - never" enabled. Is there a script or option to do this?Thanks, Mike 

Hi folks, I am looking for a way to prohibit enabling of Internet Sharing since it can be a pretty serious security risk. I was able to do it with Quest's QAS group policies, but we've stopped using that product. Is there a way to granularly disable Internet Sharing permanently using managed preferences? Thanks!

Hey Jamf Nation! We're excited to announce with Jamf Pro 11.14.0 Beta the compliance benchmarks capability is available for testing. A full version of compliance benchmarks will be available in a future release of Jamf Pro. The Jamf Pro 11.14.0 Beta also features ADCS certificate deployment using SCEP, App Installer support for External URL downloads and more! How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Once you enroll you'll receive an invitation to join the Beta Forum, click "Join this group Hub" to gain access. Email beta@jamf.com with questions.The beta program is covered by the Jamf non-disclosure agreement; please do not share any information regarding your testing on any public forum, including the non-beta areas of Jamf Nation. Use the Jamf Nation Beta Forum or contact Jamf via beta@jamf.com with any questions. Thank you to all who participate in this program! 

Hi everyone, I'm currently exploring ways to enhance our mobile device management (MDM) strategy and considering the integration of Jamf Pro with other third-party MDM solutions. Has anyone successfully implemented such an integration? If so, could you share your experiences, challenges faced, and any best practices? Thank you!

Looking for a way to disable notifications, either by a script equivalent to option clicking or using DND from 7am to 2am, something like that? ThanksDave

Hi, We want to set corporate wallpaper for managed MacOS. Guide me the steps how to complete that task.

I'm currently testing Jamf and have everything working as I want with with the exception of figuring out the best way to rename computers after they are setup.  Currently I'm using Jamf with Jumpcloud pushing the user accounts for staff to an employee's computer however I'm stuck with the default computer name of Macbook Pro. I'm trying to figure out the best way to script this or use a policy that runs after the user is setup  to that a machine can be renamed for username-Macbook Pro.I'm wondering what the best way is to accomplish the renaming task so it can be automated and not have to be done manually each time a computer is deployed . Thanks for any suggestions. 

I added Self Service+ to our Self Service "classic" portal today to test out. I noticed when installing Self Service "+" that "classic" quits suddenly, but seems to install "+". Anyone else see this?   Jim

So I enrolled a test Apple TV... After I confirmed that it received all of the desired configuration profiles, I sent a wipe command to it. Out of the corner of my eye, I saw the screen go black so I then deleted its record from the JSS. With the screen black, the Apple TV sat there with no light on the front of it. After 2 or 3 minutes I got impatient and unplugged it - I thought it would have rebooted after the wipe. When I reconnected the power cable, I see that it has my “Conference Room Display” payload still on it, which means it’s still managed and never got the wipe command from the JSS!The “Conference Room Display” restriction does not allow me to get to the main tvOS screen so I can perform a system reset. To make matters worse, I can’t send any management commands to it because it’s no longer in the JSS! Is there any magic command I can do to this thing to get it back to factory?

Good morning.This is my situation:I have about 60 macs already in use by my colleagues, but they have recently been added to ABM from the our reseller.I would like to enroll them and I know that with sequoia the need of admin rights to perform "profiles renew -type enrollment" has been removed.However, to be able to send an email containing a "one click" process for the end user, there is still a problem: Gatekeeper.I tried to create shell script with Automator, a .command script or an app with AppleScript.Nothing, Gatekeeper intervenes anyway.Any alternative method?...other than having to sign the script with a developer account?Thanks

Hey Everyone, In my organization we are looking for a way to allow users to update some specialty apps without having admin access. There are specific apps such as Kemper, Ableton 11 Standard, Slate Connect, Autotune central, native access, etc.. that only 2-3 users out of about 100 need to update. However when the apps need updates they need to be done ASAP because of how the apps interact with each other. We have uses Make me an admin as a temporary solution but want to move away from that for security reasons. I know that some of the apps are built in to jamfs patch manager section but for the others what can I do to allow the user to update them without giving him full admin access?Thanks in advance

I'm still fuzzy on how to force Chrome to restart after an update without having the user have to do it. I understand that I can use Mac Updates to automatically push updates, but I don't see how to force a relaunch. We run into this pretty often where there is an update, but the users don't relaunch their browser. Any suggestions? What am I missing? 

I'll be coming into Minnesota from Dallas on Sunday. No way I will miss watching the Cowboys play and they will be playing the Vikings that night. What better than to watch it at Brit's? Anyone interested in football and beers?

Hello,   I'm deploying a picture for lock screen.  Now i need to deploy picture as a screensaver. How can i do it ? I couldnt find any guide for this.   Can you help me?   Thank you.  

I've been playing with Self Service+ and don't see anywhere for branding. There's not really anywhere to configure it. We're on Jamf Pro 11.13 where support was supposed to be added. I'm just not seeing it. Anyone else?https://learn.jamf.com/en-US/bundle/jamf-pro-documentation-current/page/Self_Service_plus_for_macOS.html

Noticed this popup in Jamf promoting this feature. Its an eventual replacement for Self Service classic (which is set to go EOL in 2026) Its an APP that needs to be installed by Jamf. Any one using this? I see it does not seem to have the ability to run polices (only patch management ones) More info here: https://learn.jamf.com/en-US/bundle/self-service-plus-documentation/page/Jamf_Self_Service_Plus_for_macOS.html

Hi folks, i want to rollout the new self service+. Actually we are using the "old" one with branding. I have two questions: 1. Where do i change which self service is rolled out to the clients? I can download theSelf Service+ .pkg from Jamf. But where can i set in in Jamf pro? I cannot find any options.   2. I downloaded the installation file from Jamf. The branding already works on my mac. Only the app Icon is another (Left old SS - right New SS+). this will probably be correct when i roll out the new SS+ via Jamf?   Greetings Frank

I am trying to create some saved searches to find devices that havent updated to the latest version of an app. We have two apps that both start with the same name. When I search based on Name it only offers the "has" option and it find both apps instead of the one with the base name.When I try to add a app short version regex matches or does not match, it shows me devices with the other app. I tried using the app identifier and that doesnt seem to find it properly either.   How do I properly structure the criteria to find devices with an exact app that isnt running the latest version? For reference I have used chatgpt and the github script for generating the reg ex. I am fairly confident that isnt the issue but the selecting of the particular app that I am having challenges with.

Greetings Jamf Nation!   I have been woking on a more comprehensive Falcon repair script to assist in detecting and/or trying to repair any potential issues found in the sensors.  This is strictly a WIP and I would love to get everyone's feedback on ideas or items that I might have missed.  This script is borrowing heavily from Dan K Snelson, so kudos for him creating the original concept...I just want to take it a "one step further"... #!/bin/zsh # # Written by: Scott Kendall # Date Created: 01/21/2025 # Date Last Revised: 01/23/2025 # # Borrowed heavily from @snelson: source code @ https://snelson.us/2023/03/crowdstrike-falcon-kickstart-0-0-2/ # ###################################################################################################### # # Gobal "Common" variables (do not change these!) # ###################################################################################################### export PATH=/usr/bin:/usr/local/bin:/bin:/usr/sbin:/sbin SUPPORT_DI

For those who don't know, MacOS 15.3RC changes the behavior of Apple Intelligence and no longer provides an opt out during setup assistant. Users can either enable, or click go back, the option to setup later has been removed.    If you are an organization that does not yet allow AI, I urge you to check your beta seed documentation and submit feedback to Apple. Making changes like this in an RC release does not provide prior time to identify, evaluate and implement solutions. Thankfully we are in a good place, but others may not be.   https://developer.apple.com/documentation/macos-release-notes/macos-15_3-release-notes

Hello everyone, I'm new to Jamf but I tried to read and watch all the documentation before asking questionsSaying that, something puzzled meI want to set up "Jamf Protect" and select the "automatically deploy the Jamf Protect PKG with plans" optionHowever, I cannot click on the optionI do see this next to the download button "latest Jamg Protect version: 5.0.1+10I did fill out the info on the "Jamf Protect Registration" with API url, ID and secret keyAnd it shows: Jamf Pro is allowed to access your Jamf Protect tenant at https://fjlabs.protect.jamfcloud.com/graphqlI also uploaded the Jamg Protect version 5.01+10 on the cloud server (just in case)I don't understand why I cannot select the button "automatically deploy the Jamf Protect PKG with plans" ?Tx in advanceWilliam

With Jamf Pro 11.13, configure single sign-on with Jamf ID, enhance user experience with Self Service+, and enjoy more screen space using the collapsible sidebar! Be sure to check out the Jamf Pro release notes for all of the exciting new features and enhancements. Thank you for your continued support and feedback! https://learn.jamf.com/en-US/bundle/jamf-pro-release-notes-videos

We have tried to set up device compliance multiple times and it keeps failing on registration.  I currently have a ticket open with jamf support but its going nowhere.I have upgraded my cloud to version 10.46.1Here is part of the log from the company portal app.2023-05-25 13:37:31.279 | workplaceJoinSdk | 344229 | INFO: -[WPJBaseKeychainAccessor getRegistrationInformationWithTenantIdentifierInternal:domainName:error:] [Line 190][2023-05-25 13:37:31 +0000][WPJBaseKeychainAccessor] getRegistrationInformationWithTenantIdentifierInternal - check for incomplete registration or no registration.2023-05-25 13:37:31.279 | workplaceJoinSdk | 344229 | ERROR: [errorCode:-400][2023-05-25 13:37:31 +0000][WPJBaseKeychainAccessor] getRegistrationInformationWithTenantIdentifierInternal - tenant is unregistered!2023-05-25 13:37:31.280 | workplaceJoinSdk | 344229 | ERROR: [errorCode:-400][2023-05-25 13:37:31 +0000][WPJDecisionHandler] retrieveKeychainAccessorForTenantInternal - unable to retrie

Hi Jamf Community,I have been scouring the internet and developing my own script to pull the installed browser extensions from Firefox.Does anyone have this working in their environments?Problems I'm running into in my scripts/Users/USERACCOUNT/Library/Application Support/Firefox/Profiles/* is profile driven, so there could be multiple profiles with different addonsaddons.json file is problematic to work with. Formatting of the output is frustrating, looking to pull just the extension name and version in CSV formatI was able to achieve this using the jq CLT command, extensions=$(cat "$addonsJson" | jq -r '.addons | map({name: .name, version: .version}) | .[]')However I dont want to install this CLT on every system for an EA. Any help would be appreciated. Hoping there is a recent solution available that i missed.