I'm in the process of getting back to testing OneDrive. If I have the default folder set, does this prevent the user from choosing a different folder? I did create a couple of documents and put them in Desktop and Documents prior to deploying OneDrive and the config profile. I have the below plist set and it pulled down all my files that are currently in OneDrive from all of my other testing. The files I added prior to setting up OneDrive don't have the cloud icon next to it. Does the below plist look ok? <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>DisablePersonalSync</key> <true/> <key>DisableTutorial</key> <true/> <key>DefaultFolder</key> <dict> <key>Path</key> <string>~/OneDrive - Home</string> <key>T

During prestage enrollment, the Macs are bound to AD and members of an AD group, tier2-users, is specified to be administrators. Local accounts are Mobile account enabled. However users of the group, tier2-users are no longer recognized as local administrators. I think this was working fine in Ventura, but Im running Sonoma now and all the local accounts are just recognized as Mobile accounts. 

Hello,   I work for a large Fintech company and currently we have our macs enrolled in their JAMF with all their security endpoints. The company I work for is splitting off from the larger company. Me and another guy have been building out our JAMF and it's going well, it's looking to go live May 2025 with some of the first actual enrollments as the migration kicks off but obviously will be testing it more thoroughly first.   The discussion now is how to create the smoothest transition for the users. One method is to erase all the macs and have them enrolled clean in our JAMF. This is the one we want to do. The second method being pushed by the higher ups is to remove the JAMF framework, get all the security software uninstalled and leave no trace and make sure they all work. The issue with that one is we are not admins in the current company and do not have access to the removal of the security endpoints so we either need to ask for the all the passwords (not likely) or have

We are currently encountering a 500 Internal Server Error on the `/api/v1/computers-inventory` service, and the error is not detailed in the response. This issue is affecting five clients. When we query the endpoint: /api/v1/computers-inventory?section=GENERAL&section=DISK_ENCRYPTION&section=APPLICATIONS&section=USER_AND_LOCATION&section=HARDWARE&section=SECURITY&section=OPERATING_SYSTEM&section=EXTENSION_ATTRIBUTES&page=0&page-size=50 it works as expected. However, when we try to retrieve the next page: /api/v1/computers-inventory?section=GENERAL&section=DISK_ENCRYPTION&section=APPLICATIONS&section=USER_AND_LOCATION&section=HARDWARE&section=SECURITY&section=OPERATING_SYSTEM&section=EXTENSION_ATTRIBUTES&page=1&page-size=50 we are receiving a 500 Internal Server Error. Could you please assist us in resolving this issue?

I am hoping for a bit of guidance. I have used Jamf School in the past for iPad management but this didn't involve any integration with Entra or Platform SSO. I now have a provision that is entirely Apple, I know what I am doing with the iPads but they also have iMacs and we would like to be able to log into the iMacs with our Microsoft 365 accounts with SSO so that all Microsoft services sign in automatically, for example, Office 365, OneDrive etc. I have been recommended Jamf Pro and Connect for this purpose and currently have both on trial. I have an iMac that is enrolled into Apple School Manager and is managed by Jamf Pro. Jamf Connect is installed and successfully logs in using an Microsoft 365 account but does not SSO into portal.office.com, instead Company Portal appears asking for an email address and password. I have followed the following guidance https://learn.jamf.com/en-US/bundle/technical-articles/page/Platform_SSO_for_Microsoft_Entra_ID.html#concept-7900 Am I missing so

I've inherited a JSS from someone else and see steps detailed in link below to set up a JSS - GSX connection but in our case we will be renewing it — 1) are those same steps needed for that? Also 2) can the same GSX certificate once renewed be added to two JSSes? https://www.jamf.com/jamf-nation/articles/26/integrating-with-apple-s-global-service-exchange-gsx Thanks for pointing me in the right direction...

We have several policies, configuration profiles, and other objects assigned to a site. This site serves the same purpose as our 'Full Jamf Pro' and is therefore redundant.  We want to reassign all the objects in the site over to our ‘Full Jamf Pro’ (site set to ‘none’). What’s the most efficient way to transfer everything to Full Jamf Pro? 

Does any one happen to know how to structure a config profile for plist settings for Microsoft edge https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies   The aim at present, is to enforce safe browsing, prevent incognito mode and prevent deleting browsing history. As this helps curb miss use of web browsing as kids realise, they can't hide where they have visited.

Part of our Mac hardening, we have to have the BT icon show on the menu bar. All our Mac's are mostly Ventura with a handful of Sonoma. I don't see anything in to Jamf to allow this. I have a command that when ran locally via terminal, it'll add the icon, but if I create a policy using the Files and Processes>Execute Command, it won't add it, but the according to the log on the device, it was successful.  I've also tried using a script, but the script won't add it either.defaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist Bluetooth -int 2

Job posting: "... You can write production-quality code for automation in Python, Bash, or similar languages" I've written some scripts, but nothing significant like the open-source projects we all use. I can modify what I need from other sources to get stuff done. What sort of 'production code' have you used or written? Where would I start to write something?  Seems everything I can think of exists I'm not nearly experienced enough to contribute to nudge or super, etc. If you have a code repo, where'd you get the experience? I guess I'm having a rough day after being passed on job after job and the only factor I can figure is I don't have the programming experience as a sysadmin

I am having a little brain fart here, but I'm sure it's simple. When I run this jamf policy using the event flag from Terminal, it runs just fine (probably because it prompts for my credentials). But if I try to run it from self service, I get an error that a Terminal is required for the password. Script: #!/bin/bash #Find current logged in user loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) #Runs SysDiagnose as Current User su $loggedInUser -c "sudo /usr/bin/sysdiagnose -u -f ~/Desktop/" Error: I want users to have the capability to run SysDiagnose from Self Service, without it prompting for a password.

Good Afternoon All!I work for a school district, and I've kind of taken on the mantel of apple Sysadmin. We are a windows org, but we do have a chunk of apple devices managed with Jamf Pro/ASM.   I am having trouble getting our WiFi payload working the way I want. Our windows devices are on AD, so everything is automatic, but I want our apple devices to be on the WiFi using an AD credential we made for this. That technically works, but whenever you first push that payload out you have to make a "Trust Exception" to connect to the WiFi. At the moment we don't have a clear way of getting these devices on AD, and I'm wondering if there's anything I can do or a Certificate I can upload with it to make the device automatically Trust.I don't have a ton of experience on the networking side of things, and not many of us do, so we're trying to figure this out as we go.I appreciate any helpful tips!

Hey JAMF'ers- Is there a good way to bundle multiple .pkgs into one pkg file using composer? So like say I have a bunch of instrument packs I've downloaded the .pkg files from the vendor and I want to deploy to some of our machines, is there a way to bundle those dozen or so pkgs into one pkg file using composer? 

My district currently uses JAMF School and I am pretty familiar with the Teacher app and have several teachers using it consistently.  My question is if we were to upgrade to Pro are there added features within the teacher app that would benefit our teachers?  We are trying to gather as much information as possible from people actually using the product to make an informed decision on whether an upgrade to Pro would be worth it for our district.

I am a system administrator for a school in Germany. We have received a ton of IPads this Year where the MDM was an old version due to it still allowing the App Store and removal of the MDM.We have already tried many things like resetting it or contacting the City Administration but nothing had worked until now. If you could help me that would be very kind of you

We have a user who wants to run iMovie and Music on an iPad managed by JAMF.  They want to make promotional videos with iMovie and use Music to create playlists for events at our on-campus art museum. Both require the user to sign in with an iCloud account to launch the App (correct me if I"m wrong, I'm not a wiz at all this).  I don't want to encounter Activation Lock with this iPad so I'm wondering if a Managed Apple ID is the solution or if an email address that we create for the user (and know the password once they use it to create an AppleID and iCloud account) is the correct method. WWW research has not yet revealed this particular situation; can someone wiser than me offer help?

Hey all, got a question for you. We have recently been using Jamf on our clients' Mac devices. However, we have been using ncentral for years now. We love the ncentral agents' ability to monitor device statistics and the alert board for issues. My question; can we install the ncentral agent via Jamf Policy? The research I have done so far has indicated they are competing for products. I am still planning on testing this but wanted to see if anyone else had already gone through the process and can tell me if I am on a doomed quest or not.

There is a notification in the Jamf Pro console showing that the Push Notification cert will expire in x days, but I can't find the option to send me an email to prompt me to take action. I do not live in the Jamf console! If this does not exist, does anyone have any suggestions for implementing a reminder/alert/notification externally to Jamf?  Thanks! 

Today we released Jamf Connect 2.42.0. This release includes the following changes and improvements: Removal of Support for macOS 12.xJamf Connect no longer supports macOS 12.x. Computers with macOS 12.x or earlier will be unable to install Jamf Connect version 2.42.0 or later. Any automatic update workflows configured in your environment will no longer apply. Other Changes and ImprovementsThe Jamf Connect login window and menu bar now include Brazilian Portuguese as a supported language.   To access new versions of Jamf Connect, log in to Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Connect. Product Documentation For additional information on what's included in this release, review the release notes via the Jamf Learning Hub.  

Hi there,Does anyone have a working method of disabling FileVault maybe through a script? The FileVault user is not the prestaged local admin account but the users themselves. Most likely this will require input from the user which is completely fine.One of the ways of doing this I thought of but may not work is to enable FileVault on the prestaged local admin through a script and then turn off FileVault alltogether but I'm just checking if anyone else dealt with this issue in a more graceful way.

My district has been using Jamf School for several years now and we love it.  It is much better than the MDM we had previously, and made our transition to 1:1 very easy.  We are considering an upgrade to JAMF Pro to get access to possibly some more features.  I would love to hear some feedback from some who maybe have used or have knowledge of both and get your thoughts on whether we should do the upgrade.  What are some of the perks of pro that would make the upgrade worth it. Thanks in advance.

Hello community, currently having the issue that we have two different accounts (asm/jamf). for a better experience we want to consolidate these, but not sure what the correct way is and I can't find any relevant articles. all iPads on both accounts are DEP registered. 1. adapt the DEP registration from ASM account 1) to account 2) - then the devices automatically end up in Jamf? (if yes, can we do this on our own?) 2. remove the devices from an account (via ASM) and add them to Jamf via Mac and Apple Configurator 2 or is there another way? Thanks in advance.

I hope this guide proves as helpful to others as it has been for our organization! If you're looking to automate the creation of application restrictions, you're in the right place. Feel free to ask any questions—this process might not suit everyone, but I’m happy to share more about what we do here at the college. The community has been a tremendous help to me over the years, and I’m eager to give back in any way I can.# Jamf Restricted Software Automation Script # **Overview**This Powershell script automates the identification and restriction of unauthorized software in a Jamf Pro environment. It analyzes applications installed on managed devices, compares them to a whitelist, and restricts unauthorized applications exceeding a specified usage threshold. Additionally, it generates a log report and sends an email summary with details of restricted applications. **Features**Automated Restricted Software ManagementAutomatically identifies and restricts software not in the whitelist. **

I'm trying to add the $ASSET_TAG variable to a login window config profile payload and all I'm seeing on the lock screen is $ASSET_TAG. I can use other variables, but that one doesn't seem t work.

Hello Team, Need one info, we can see Flexera agent deployment working fine when we are running the installer command with enabling root account in CLI mode. But if I run the same command with another user account which is also an admin I mean having sudo privilege it doesnt work, now my question is, is it security violation to run the command with root account(sudo su, which switchs to root account with CLI prompt sh-3.2#)?  Apple doesnt recommend to enable root account in GUI mode, is it valid for root account in CLI mode or it is OK to use root account in CLI mode?