I have run into a problem whereby apparently no users have a Secure Token, and there appear to be operations you can't perform unless you are Secure Token-enabled.All the documentation says that the admin user created during pre-stage enrollment should get the secure token, but it just flat-out doesn't. Multiple reinstalls, never does.I have found other people saying that they have the same problem, but that if they use a JAMF policy to create another user (as admin) and check the box to say that it's eligible to receive the secure token, they find that that works. It doesn't for me.And of course I can't use command line utilities to enable secure token because nobody is enabled.Secure Token-wise, our machines appear to be basically orphaned.Anyone have any ideas about how to fix this?Thanks,Lisa.

Testing installing this app https://github.com/root3nl/SupportApp and something isn't quite right that I can't figure out.  1. I have a Policy with this package where the Scope is my test computer.2. I have a Configuration Profile using Application & Custom Settings > External Applications using this json file.The Scope is a Smart Computer Group.3. The Smart Computer Group uses Criteria where the Profile Identifier "is" the Value of "149694A2-D63C-4195-94C6-26B778EFA58D" which is the Identifier of the application. The app is installed on my test computer but it is not picking up any of the settings from the json file. Any input would be appreciated. 

I am looking for a solution to disable/hide the ability to activate Airplane Mode on iPadOS. I work in a K-12 school district and we have lots of devices around for various needs. Some offsite as well. Students and/or parents are turning on airplane mode and not allowing us to communicate with the device. I understand they can just disconnect from their own network but I'm trying to mitigate possibilities for no connection. If there is a way, pleas let me know what you got. 

This is slightly alarming. Our lab Macs are set up with AD authentication (thru NoMAD) ; network users get a local home created at first login on any given computer. Network user accounts get standard permissions. Today I noticed that user homes are created with wrong permissions on some (but not all!) of the lab Macs. I would expect user homes to be owned by [some_user]:staff with default permissions 700. On some machines this is the case; on others I'm seeing 750 or 755.  Especially weird because I just nuked & paved the whole lab, so configs should be identical. Am I overlooking something obvious? Where does the umask get set? I don't see anywhere in NoMAD to control it; is it coming from the AD server? [Intel iMacs running 13.6.7, highest os version they support]

I am in the process of installing Sophos using a policy. Sophos has several PPPCs, and Kernels that need to be put in place. These are being pushed by a configuration profile.I do not want the install of sophos to happen before the configuration policy is on the system, yet I do not see any option when creating a smart computer group to determine if the configuration policy has been applied.  How do I verify the policy is in place before the install? Thanks in advance for your help!

Hi, I would like to check if anyone is still able to use the Energy Saver Profile in JAMF school?I have a Energy Saver Profile setup for all computer but seems like it not working anymore. Thank you

Hi, folks. We have some users who use their mobile hotspot on their Macs from time to time while traveling. Their mobile data is metered, so they enable "low data mode" under System Settings > Network > Wi-Fi > Details. Does this affect Jamf policies in any way? We deploy app updates with Jamf, which could quickly hit the data cap. I'd like to defer some/all policy downloads until Low Data Mode is disabled. Does anyone have a clever solution to avoid Jamf policies downloading large packages over metered connections? 

Has anyone recently packaged and deployed Read & write  (Text Help). Having some problems with PPPC profile which should be turning on accessibility for the software. Despite creating the profile using jamf ppc tool and deploying to the device Im still been prompted for admin rights to turn on the setting.   Has anyone had this issue?    

I recently had our Dev instance of Jamf Pro reset and I'm the process of rebuilding it. I added Entra as our Cloud IDP. Running 'test' with a few usernames, I was able to look users up and I have been successfully able to add 'Directory Service Users's into the 'Users and Groups' list. My only problem is, when I try to login to Jamf Pro with my Entra details it tells me 'Invalid Information Provided'What am I missing?

In Settings -> Automated Device Enrollment and via the API call "device-enrollments" you can view "deviceAssignedDate" which is the date each device was enrolled in your orgs JAMF. Assuming DEP machines that should be relatively close to the purchase date of those machines. The date is already in JAMF and it seems silly to have to run an api call to write it back as a searchable field assigned to each machine object. Both ADE and Computer objects have serial numbers so I can't imagine the match would be that hard. Seems it would be a way to get that information without needing GSXIs anyone already using "deviceAssignedDate" via the API and writing back?Is it already a searchable field and I'm missing it?

Hi,We've recently noticed that many of our users are missing the roster tab in jamf pro. We suspect there was some an issue when they were originally imported from ASM. This has since caused problems with the EDU profile installing which affects Classroom working.I'm interested to know if there was a way I could search for users with the roster tab missing? I've tried using the advanced searches and attempted "Roster User Status" but didn't have any luck.I'm hoping there is a way to search for this as I can then focus on all of these specific users rather than wait for them to contact us. Thanks in advance!

Is there a way to control notifications settings for apps deployed from Jamf Pro via something like a Plist file?

I am having issues updating a classic API script with the bearer token. Testing the script below I seem to have an issue somewhere as the variable will not propagate accordingly. I am getting "MBA-1" every time I run the script.   # Getting the computer's serial number to make the API call serialnumber=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') # Decrypting the string above function DecryptString() { echo "${1}" | /usr/bin/openssl enc -md md5 -aes256 -d -a -A -S "${2}" -k "${3}" } string=$(DecryptString $EncryptedString $Salt $Passphrase) model=$(system_profiler SPHardwareDataType | grep "Model Identifier" | awk '{print $3}' | sed 's/[1-9].*$//') case $model in MacBookPro) short=MBS ;; MacBook) short=MB ;; MacBookAir) short=MBA ;; iMac) short=IMC ;; *) short=UNK ;; esac # A basic API Call that's getting information for the computer. # computerxml=$(curl -s -H “Authorization: Bearer ${token}” -H ${jamfurl}/JSSRes

Hello everyone! We currently use DUO MFA for our 2nd way to authorize who you are, the first being your password. DUO MFA has glitched too many times and it is NOT JAMF, and not Apple MacBook Pros running Sonoma 14 fault. I am wondering what MFA products are you using, if any. I am also wondering if there is a script out there that forces the user to use the fingerprint reader after they enter their password which would suffice MFA? If yes, I could dump DUO MFA program for once and all. When I reached out to DUO Tech support about the app glitches, you wouldn't believe the steps the end user has to take to get past DHO MFA. The steps are not for novice Mac users at all. Any suggestions greatly appreciated as always. 

The new interface lacks a proper 'storage' column.While it does have one, the column only shows the capacity of the device, not the remaining capacity.

Could i please request the effort to implement the below Jamf Cloud engineer activities? Jamf Pro cloud tenant configuration & build- Pre-configuration of all settings for certificates, user accounts, enrolmentmethods, sites, buildings, and department groups.- Create policies and configuration profiles as required.- Support with the linking of Apple School Manager devices with resellers / Appleas required.- Configuration of pre-stage enrolment policies.- Configuration support of Jamf Pro distribution points and caching servers.- Upload of existing packages (20).- Audit and recreation of existing and new scripts, respectively.- Configuration of sites, buildings and departments in Jamf Pro with categoryassignation to all items.

Hi JamfNation,since the update to macOS 14.1 the Microsoft SSO Extension does not work anymore. Machines with up to 14.0 are doing fine, but 14.1 just breaks it. It doesn’t work anymore in Self Service, in Safari, in the Office Apps (here it goes so far as displaying an error when for example connect to a Data-File, lying on a sharepoint, we had to deactivate the SSO Config Profile there), it seems to be completely broken.The same goes for iOS / iPadOS 17.1. Did I overlook something I have to adjust with the updates? Is anyone to reproduce this? Is it a bug?Thankful for any input. RegardsDaniel

Hi Quick question in regards to why I cant see any FV personal recovery keys in Jamfpro when FV encryption is fully enabled. Seems rather a critical piece of info to not have available no? Any advice or help greatly appreciated

Hello everyone.As a Jamf admin for 9 months, I can't find a solution to my problem. I allow myself to present my problem / reflection.I am in charge of setting up an iPad lock system outside of class hours. The plan that was chosen by our management is that from a certain time of day, the iPads in question will switch to Single App mode on the clock and unlock the iPad in the morning before resuming classes. On this part, I have no worries, I will set up a crontab with two intelligent groups.My problem is rather in the shell to make the changes. I expose to you what I thought, and the code which unfortunately is not functional in order to have your help.In order to be able to make the rotations, I created an extension attribute named Lock_Etudiant (ID2) with which I insert two values (Lock or Unlock). Regardless of the values, the iPad will travel between my two intelligent groups in order to set up this Single App or remove it.Unfortunately, I can't change the values in this attribute

Each week we go through and find the machines that have a 'Filevault 2 Individual Key Validation' of 'Unknown' and reach out to those users to resolve (via check in, reboot, etc). My confusion is why they validations becomes 'Unknown'. I imaged a machine recently and the validation was 'Valid' and everything was fine, but after turning it off for a few days it later became 'Unknown'. What causes Jamf to no longer recognize the key is valid? The machine was imaged and had a valid key then only a day or two later it became 'Unknown'.Did it try to rotate itself and the new key just needs to be validated by Jamf? If that's the case, how can we change the rotation frequency?Does it regularly need to check-in with Jamf to validate the key even though it hasn't changed? If so, how can we tell it to validate the key less frequently?We have a smart group enabled and use the 'Issue new FV key' policy on it but we aren't sure if that's helping at allhttps://learn.jamf.com/bundle/jamf-pro-doc

I have found some information from a Jamf Pro system on creating a temporary Admin through Self-Service and would like to do the same using Jamf School but can not find any documentation if it is possible and how to get it set up.  Our teachers are standard users but there are times it would be beneficial for them to have admin access.  We are specifically having an issue with standard users not being able to update Chrome.  

I am seeing this issue with Macs running Sonoma and Connect 2.27.0. I am not sure if Connect is actually causing this but it is currently my prime suspect.What is happening is this. The Mac boots up, asks for a PW to decrypt the drive and then opens to the Finder no problem. I can also log in using the Local Login option. If I then log out, it brings up Connect and I can log back in no problem.But (you knew this was coming) if I lock the screen or put the machine to sleep from the Finder, when it wakes up and asks for a password, it will not accept whatever I enter. It acts like I'm entering the wrong password and I can't get past this and must reboot the machine to get back in.Anyone else seeing this? I have't seen it on any of my machines before Sonoma.

Hi all,Hopefully someone can give me some pointers on this one.  I've been tasked with getting the firewall enabled on our macOS devices and I was running a basic config profile for while and couldn't trigger any in-bound alerts but as soon as we enabled it on the wider estate there was one specific .app that was asking for in-bound communication which I thought was strange as all signed apps should be enabled and all apps need to be signed to run on macOS, right???Anyway, I tracked the binary down to..."/Library/Application Support/projectstore/nwjs.app/Contents/Frameworks/nwjs Framework.framework/Versions/87.0.4200.88\\Helpers/nwjs Helper (Renderer).app"Running "codesign -dv" against that app give me an identifier of "io.nwjs.nwjs.helper.renderer".  This is the Bundle ID, right?I've added the app name and Bundle ID to our firewall config profile and verified it's taken on a sample endpoint but I still get prompted for firewall access when I log in.I can't help but feel I am

Hi everyone,I'm looking to update all our Macs and establish a sustainable maintenance plan. Ideally, I'd like to leverage the ScheduleOSUpdate command with the InstallLater option.My questions are:Can these Apple commands be used within a configuration profile deployed via Jamf School? I'm struggling to find specific examples or guidelines for this approach.Are these commands strictly for Mass Action Commands, as suggested in Jamf Pro's technical paper on macOS updates (https://www.jamf.com/resources/technical-papers/deploying-macos-upgrades-with-jamf-pro/) and therefore not applicable in Jamf School?Has anyone used S.U.P.E.R.M.A.N. or anything similar in conjunction with Jamf School? Every single guide or example I can find is for Jamf Pro...If anyone has experience using ScheduleOSUpdate or has alternative suggestions for managing macOS updates in Jamf School, I'd love to hear them!

Howdy!I need some clarification on how Configuration Profiles interact with macOS. Specifically, when managing password policy via a Configuration Profile, should I expect to see output if I run the pwpolicy command locally on a managed Mac?I have an Extension Attribute that checks the output of that command, but I'm not sure if the output of pwpolicy should contain the controls set in the config profile or not.Thank you!