Hi,I've installed the Ripple Tool extension on several devices, but I'm having trouble getting it to turn on automatically. Whenever a user logs in and opens Safari, they get a pop-up asking if they want to enable the "Ripple Tool" extension.I’ve tried using a script to automate this, but it keeps failing because it can’t find the com.apple.Safari.Extensions.plist file in preferences. The Ripple Tool was downloaded and installed from the Apple Store.I also tried using a configuration profile to enable the extension, but that approach didn’t work either. #!/bin/bash# Define the extension's bundle IDEXTENSION_BUNDLE_ID="com.ripple.tool"# Safari’s extension preferences filePREFERENCES_FILE="/Users/$USER/Library/Preferences/com.apple.Safari.extensions.plist"# Check if the plist file existsif [ -f "$PREFERENCES_FILE" ]; then# Add the extension to the plist (this approach might vary depending on Safari version)/usr/bin/defaults write "$PREFERENCES_FILE" "ExtensionsInstalled" -array-add

The Jamf Pro 11.12.0 Beta Release features new restrictions including support for bypass screen capture alert, the ability to restrict Apple Intelligence features and more! How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Once you enroll you'll receive an invitation to join the Beta Forum, click "Join this group Hub" to gain access. Email beta@jamf.com with questions. The beta program is covered by the Jamf non-disclosure agreement; please do not share any information regarding your testing on any public forum, including the non-beta areas of Jamf Nation. Use the Jamf Nation Beta Forum or contact Jamf via beta@jamf.com with any questions. Thank you to all who participate in this program!

for a device which has jafm Manuel enrollment payroll MdM, would the administrator be able to see if a file was airdropped from said device to another device?  I’ve seen conflicting information as some stuff says that airdrop is encrypted and not allowed because of apple’s privacy, but also seen other stuff.  in any case, would there be a log of the file that was sent and the device it was sent to?

Hello, Jamf is running on my MacBook although its not part of any MDM system. I also don't have any profiles installed. How do I get rid of Jamf altogether? Removing it from Applications/LaunchAgents/LaunchDaemons doesn't help, it just reinstalls itself and starts up again. I can see that there is something when I run `sudo protectctl info` but I don't know what that is? Can this be a left over from migrating from an old mac that had a MDM running?  Any help is greatly appreciated as the jamf security extension is using all the network bandwidth which is extremely annoying when tethering. Thanks and cheers, Karsten

So, with new Opt-In to Beta versions on iOS and iPadOS 16.4, how do you disable this option on your managed iPhones & iPads? 

Hi Team, I'm working on deploying EndNote 21.4 to multiple devices, along with configuring the "Find Full Text" feature via script. My approach involves modifying the $HOME/Library/Preferences/com.ThomsonResearchSoft.EndNote.plistfile to include the required settings. However, when I deploy the script and launch the EndNote app, it doesn’t appear to recognize or pick up these configured values. For context, I’m setting up the "Find Full Text" preferences as described in the following guide: weblink: https://guides.library.uq.edu.au/referencing/endnote/find-full-textThis includes: Enabling checkboxes for Web of Science, DOI, PubMed, and OpenURL Setting the OpenURL Path to xyx.com Leaving the "Authenticate with URL" field blank Could you advise on why the app might not be picking up these settings from the plist file, or if there’s a recommended alternative approach to automate the setup of these preferences?

Hello All - we're experiencing an issue with the Kerberos extension asking users to log in again and again. Seemingly this is the same issue as this below linked discussion -- the extension is asking to verify "user presence" as per our settings in JAMF. https://community.jamf.com/t5/jamf-pro/kerberos-sso-extension-help/td-p/252043 We have two concerns by solving this issue by setting user presence to "skip" - one, is there is a security concern we are not thinking of by asking it to skip, and two, if we do set this to "skip" will this prevent the extension from updating the keychain without the user signing in and / or prevent the users from accessing shares? Does anyone know? 

We are using the Kerberos SSO Extension, and every time a user logs in, a Mac centric box appears that says "Kerberos is trying to authenticate user" with an option to put in their password.  If they cancel that box, another box appears having them put in my password to connect to the domain.  This happens after they originally synced their local and AD passwords and got confirmation that it was successful and after testing, it was successful.  The first time they synced their passwords, a box appeared that stated "Would you like to automatically sign in from now on?" and they chose yes, but obviously that's not working.  I would rather not have my end users having to log in multiple times (Once to get into the device, and then another to validate password syncing).  Thanks in advance for any help.

In WWDC Apple announced the ability to set a minimum OS version during the ADE process. This was in their "What's new in managing Apple devices" presentation Now I know Apple Configurator was specifically mention, but are we able to utilize this feature set? 

Hello everyone, I'm having a problem with self service. When I download an app, it takes a long time to load and finally I get the message 'operation could not be completed' When I don't get this error message, I get this one: no license was found for the app "xxxx" I have this problem on all of my iPads (gen 9 and gen 10) iPadOS 17 and iPadOS 18 (kCFErrorDomainCFNetwork erreur -1001.)  I use JAMF PRO V.11.10.2 Do you have an idea ?  THANKS

Can anyone clarify what happens if our server is not connected to the VPN, but all other devices are connected to the GlobalProtect VPN? Currently, I have content caching enabled, and it works for devices on the local network that are not using GlobalProtect. My settings: Content Cache for: Devices using a custom local network (with all IP ranges added) My local network: Using a custom public IP address and added TXT record in local DNS.

Need to whitelist / blacklist some URLs.. for all browsers.. toying with Parental Controls.. which now invokes ScreenTime... while it kinda works.. the user is presented with this dialog... and they can 'add' the site.. and even get a dialog that its now allowed.. but.. its not.. all rather clunky..  Any way to disable this dialog?  Any other suggestions for blocking / whitelisting..  trying to not add another product / cost / overhead      

I am having a handful of systems with Configuration Profiles stuck in pending state. Does anyone know of a fix for this? These systems are all Automatic Device Enrolled, they are checking regularly to jamf. I have tried having them reboot, sending blank push from management commands.  These commands have been pending for months. 

Happy Monday all, is anyone having any luck resolving the outlook issue of Error 1001? noted and acknowleged here "https://support.microsoft.com/en-us/office/error-something-went-wrong-1001-signing-in-to-microsoft-365-desktop-applications-6f63238d-d83c-437c-a929-de72fe819793#:~:text=Some%20of%20the%20scenarios%20that,to%20Microsoft%20365%20desktop%20applications."  MS says its ONLY affecting macOS 14.1, but we're seeing it on all versions at this time.  the root cause, in my opinion and tested as well, is that theres an issue when connecting to the MFA portion of the outlook authentication. taking away that MFA in testing resolves the issue, but certainly not a risk anyone wants to take! office online is aour current workaround, but I'm hoping someone has had better luck.  FYI we're on the current version of office for mac and using Azure/entra to authenticate. 

Can we enable location access to specific app on MAC if yes what is the best way. Can we deploy a code on MAC using Jamf or Mosyle. Or any config profile, any help would be appreciated.

Hi, Is there a plist or config I can manually push to devices that allows me to defer an update for more than 90 days? When Apple releases a new major OS, we typically wait until they are in the 14.3.or 14.4 version since I started working in a company with Apple enviornment as we have see many bugs popup for various apps. Some of the apps we use on company level take couple months as well

Tried resetting the dock, reinstalling self service but the icon is always larger than the other icons in the dock. Any reason why? Theres no magnification enabled or anything obvious I can see, the icon uploaded to Jamf is 512x512 as per the recommendations, even the stock icon appears larger than other dock icons.

Posting this for anyone experiencing an Office 365 login loop (Usually happens with Outlook). If reverting to legacy Outlook doesn't resolve your issue, run the keychain removal script below. It will restart the device. (The script is sourced from Scott Feit on the MacAdmins Slack channel and has resolved the issue multiple times for me)  #!/bin/bash# Define the target directoryTARGET_DIR="$HOME/Library/Keychains"# Function to log messageslog_message() { echo "$(date +"%Y-%m-%d %H:%M:%S") - $1"}# Close the Keychain Access applog_message "Closing Keychain Access application."pkill -x "Keychain Access"# Check if the target directory existsif [ -d "$TARGET_DIR" ]; then log_message "Starting cleanup of directories in $TARGET_DIR" success_count=0 fail_count=0 # Find all directories within the target directory and delete them, logging each action find "$TARGET_DIR" -type d -mindepth 1 -print0 | while IFS= read -r -d $'\0' dir; do rm -rf "$dir" if [ $? -eq 0 ];

Hello,As you know, some applications have separate installation files for Intel and Silicon. For example, I write 2 separate policies for Android Studio.1 - Android Studio for Silicon2- Android Studio for IntelBy creating a single policy instead of these two policies. Is it possible to distribute this policy according to the processor model of the machine in scope?In short, I want to design 1 policy and 2 packages.Thank you.

I'm trying to create a smart group of our labs (static groups) but its not working, it can only take one at a time. I've tried re-creating the static groups, still no luck, it will only show one (7 devices or 43 device but never 50).  i did add the site location and the "(" ")'' & "and".  Is anyone else experiencing this? our current instance is 11.10.2

I’m looking for advice on how to integrate Apple Configurator into our workflow to streamline the setup process for new iPads. Here’s some background information: we receive iPads purchased from Apple that are already enrolled in Apple School Manager, with Jamf Pro designated as our MDM server. Our goal is to minimize physical setup time and reduce network strain from updates. Ideally, I’d like to prepare new devices using Apple Configurator with minimal touchpoints. However, I am encountering issues with Configurator, as the setup consistently fails at some point in the process. iPads that have already been set up connect without any problems, but I am facing challenges with new devices. Is anyone else using Apple Configurator in a similar setup? Any tips, best practices, or troubleshooting advice would be greatly appreciated. Thank you in advance for your help!

Today we are releasing a maintenance version of Jamf Pro; this release addresses the following product issue: Jamf Pro Server [PI122414] Functionality for distributing in-house apps and books that were uploaded to a cloud distribution point prior to Jamf Pro 11.11.0 has been restored.   For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. To access new versions of Jamf Pro, log into Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Pro.   Cloud Upgrade Schedule Your Jamf Pro server, including any free sandbox environments, will be updated based on your hosted data region below. Review this guide if you need assistance identifying the Hosted Data Region of your Jamf Cloud instance. If you would like to upgrade manually, log in to Jamf Account and select Jamf Pro Info >; click Upgrade on the appropriate instance. Note: This capability is not

Hi all, I was wondering if anyone had any experience setting up a configuration in Jamf for computer cert auth using freeRADIUS. I am in the planning stages of moving our Macs over to cert based wireless auth and have a few questions regarding the deployment to Macs. Should I be using the X.509 Certificate payload for the computer certs created by freeRADIUS? If not, will the AD Certificate payload work to fulfill this? I will be using pfSense to host the freeRADIUS server, and we are using Ubiquiti APs.

Recently, my organization's Compliance and Security Operations teams requested visibility into how macOS apps are patched. They needed a report showing deployed apps via Jamf and their version status. After two manual reports, I knew there had to be a better way and developed a Python script for automation. Initially, I didn't plan to share the code publicly, thinking it might not be helpful to others. However, a friend, Chris Ball, encouraged me to release it—leading to the creation of Patcher. Manual reporting takes time away from critical tasks like CVE remediation and policy setup. Automating these processes allows MacAdmins to focus on more pressing matters. The time saved with Patcher has been invaluable for myself, and I hope others will benefit from it too. What does Patcher do? Patcher leverages the Jamf Pro API to automate patch management reporting, transforming data into actionable insights. Designed as a Command Line Interface (CLI), it integrates easily with LaunchAgents

Have have been testing the removal of admin rights for some of the users in our environment running on MacOS. One issues that has come up is the ability to change the password for Keychain "login". For a standard user that options is greyed out. If we grant them admin rights again that option returns. I know they could just use the Users and Groups option in System Prefs to change the password, but some of our users change their password using a windows box and then want to come sync up the mac after the fact. Just doing a logout and log back in using the new password doesn't always prompt the sync. Is there a plist file or some system file we can change permissions on to allow a standard user to change the login keychain. It seems strange that that would be locked down as its not really a system change. Also just incase anybody wonders, yes the "lock" icon has been unlocked already, but the menu item still shows as greyed out. Thanks for any help!