We’re using Return to Service to wipe a group of iPads with the Return to Service option enabled under ‘PreStage enrollments’.  Now seeing iPads that have Software Update blocked with this message.   Unable to Check for Update   These settings are not available while this device is configured for Return to ServiceThis message shows on iPads even after an erase using Apple Configurator.Two questions. This now the default for all devices that support Return to Service even if not used on all iPads? How do we install any Software Updates if blocked? Jamf’s AI answers are telling me the fix is to unmanage these devices.

heres what i wrote up https://ideas.jamf.com/ideas/JPRO-I-2200 please vote if you agree, or are like me and are just simply terrified that you're going to accidentally hit the delete key….

Morning, I’ve recently upgraded our Logic Pro from version 11.2.2 to 12.3I’m concerned about our students downloading additional sounds/loops via the sound library (and filling up the hard drive) as it seems they can now download sounds without an admin password Has anyone got anything setup that will prevent users from either being able to open the sound library or prevent users from downloading sounds?  Thanks 

In Acrobat Pro and Adobe reader the Generative AI upload is enabled by default and you have to opt-out if you don't want to do that. Here for more: https://helpx.adobe.com/acrobat/using/generative-ai.htmlFollowing script can be deployed with a policy and creates two plists which disables Generative AI in Adobe Reader and Acrobat Pro. #!/bin/sh # Adobe Reader /usr/libexec/PlistBuddy -c "Add :DC dict" /Library/Preferences/com.adobe.Reader.plist /usr/libexec/PlistBuddy -c "Add :DC:FeatureLockdown dict" /Library/Preferences/com.adobe.Reader.plist /usr/libexec/PlistBuddy -c "Add :DC:FeatureLockdown:bEnableGentech bool false" /Library/Preferences/com.adobe.Reader.plist # Adobe Acrobat Pro /usr/libexec/PlistBuddy -c "Add :DC dict" /Library/Preferences/com.adobe.Acrobat.Pro.plist /usr/libexec/PlistBuddy -c "Add :DC:FeatureLockdown dict" /Library/Preferences/com.adobe.Acrobat.Pro.plist /usr/libexec/PlistBuddy -c "Add :DC:FeatureLockdown:bEnableGentech bool false" /Library/Preferences/

Microsoft has announced plans to move storage of the Workplace Join Key out of the user’s Login Keychain and into Apple’s Secure Enclave:    Microsoft Enterprise SSO plug-in for Apple devices - Microsoft identity platform    Announced in March 2024, Microsoft Entra ID will be moving away from Apple’s Keychain for storing device identity keys. Starting in Q3 2025, all new device registrations will use Apple’s Secure Enclave. There will be no opt-out of this storage location.  Applications and MDM integrations that have a dependency on accessing Workplace Join keys via Keychain will need to start using MSAL and the Enterprise SSO plug-in to ensure compatibility with the Microsoft identity platform.    In the same document, Microsoft provides guidance on how to test the Secure Enclave today to ensure the change will be compatible with your environment when the change goes live:   If you would like to enable Secure Enclave based storage of

It would be extremely beneficial if there was a “automatic log-out” feature with JAMF Setup/Reset for iOS.We routinely have staff that do not logout with JAMF Reset and the iPhone is locked to their unique passcode. Can JAMF create the ability to initiate JAMF Reset automatically after 20 or so hours?  This will be a huge quality of life improvement if JAMF could implement this.

Hello Everyone while i am trying to registry any mac device with company portal it is saying get the app popup even device already have the latest company portal app installed, If anyone can help me to fix it  Note - it was working as expected two days back 

Today we are releasing a maintenance version of Jamf Pro; highlights include:Resolved IssuesJamf Pro Server: Security IssuesJamf provides the CVE-ID for security issues with high or critical severity when possible.[PI144208] Fixed: A cross-site scripting (XSS) issue.Jamf Pro Server[PI-1394] [PI-1471] Fixed: The Jamf Pro API returns IDs instead of human-readable display names when the following criteria are used: Computer Group, Mobile Device Group, User Group, Assigned User Group, Assigned User. [PI-1404] Fixed: Jamf Pro fails to create a Jamf Pro Summary when backend activation code services are nonoperational. [PI-1429] Fixed: Directory services sync may fail when the directory service is very large. [PI-1430] Fixed: When Jamf Pro attempts to sync with directory services and the database goes offline, Jamf Pro fails to complete the sync or restart the sync when the database becomes available again. [PI-1441] Fixed: Directory service groups fail to sync when the database contains dupl

Hey Jamf Nation 👋🏼, Welcome back to our Jamf Nation Development Series! 🚀 Next up - we have a free learning workshop on Human - Centered AI Implementation. Register now → https://jamf.it/JamfNationEvents  Here’s what this session is about:  Most AI talks aimed at technical folks skip the part that actually matters. They obsess over the tools and forget the humans running them. This session does the opposite.You're likely already using AI in your environment, so this session won't cover the basics. What's worth talking about is the harder-to-Google stuff: how to use this technology responsibly, what it's quietly costing us, and how to get real value instead of just more to manage. It'll stay practical and honest, with room for your questions and your war stories.Here's what we'll dig into together:Keeping humans at the center, even in a highly technical shop, and why the people side of AI is always harder than the technology The environmental footprint of AI, the part almost nobody's

• Apple link:  https://support.apple.com/en-us/125615In macOS 28 and later, the Mac OS Extended file system format will be supported only for volumes (disks and other storage devices) that aren't encrypted. For future macOS compatibility, either decrypt or reformat any encrypted Mac OS Extended volumes.

Does anybody have a solution for teachers with managed iPads to mirror a Netflix Video from their iPad to the Classroom ATV ? Netflix account is a personal account, as the school does not have any.Thanks for your helpger

Hello everyone,we are experiencing an issue with our Apple School Manager / Jamf School environment and hope someone can point us in the right direction.EnvironmentApple School Manager Jamf School Privately owned student iPads Automated Device Enrollment (ADE) Current iPadOS versionConfigurationOur student iPads are managed using Apple School Manager.Each student has a Managed Apple Account. The devices are assigned in Apple School Manager and synchronized with Jamf School. Devices are enrolled using Automated Device Enrollment (ADE). In Jamf School, each device is assigned to the corresponding student as the Owner. The devices only receive: one general profile ("All iPads") without any restrictions configured two Wi-Fi profiles As far as we know, there are no additional restrictions or App Store policies configured.The issueAs soon as a student signs in with their Managed Apple Account under Settings, the same account is automatically used for the App Store.There is no option in the

On Saturday, August 8, 2026, Jamf Cloud Infrastructure will be patched. During this time, you will be logged out of your Jamf Pro instance. The purpose of patching is to ensure that Jamf Cloud infrastructure and the database service are up-to-date, stable, and safe from security threats. Please see the times for our regions below. Hosted Data Region Date Start Time End Time us-gov-west-1 August 8, 2026 0800 AM CT 1200 PM CT

Hey everyone! Quick question. We are deploying MacBook Air’s in a school setting. The devices will be connected to school WIFI with a configuration profile. Do you think it is necessary to manually set WiFi at the top of the network service order? 

Hi, we use a pretty basic blueprint to keep our devices up to date to the latest MacOS , we force it to install within 30 days. Without having to edit this Blueprint and redeploy, will the regular “Block” for the New MacOS Golden Gate work and only keep the updates coming for Tahoe until we unblock Golden Gate (usually for us is 90 days after it comes out.). 

Is there any good way to do this? I have some icons that were replaced with higher quality ones and I would like to remove the older ones, but there is no interface I know of in the JSS. I realize I can go into the icons table if needed but would prefer not to.

Our company has one app that we must defer updates for, and it absolutely cannot be allowed to update during normal hours. We keep automatic updates off and have a script for pushing updates for this app overnight. Recently I had to rewrite this script due to endpoints being deprecated, and it ended up being a bit of a pain. So, I decided now might be a good time to provide some insight here in hope that someone experiencing the same situation might stumble upon this.   The workflow that works with the new endpoints is: wait until scheduled time (and wait between most of these steps) > get necessary device info > send restart command to devices > change app setting to force updates > send INSTALLED_APPLICATION_LIST command to devices > send blank push to devices > revert app setting   However, there is a catch. You may want to use the “/api/v2/mobile-device-groups/static-group-membership/” endpoint to get the Management IDs for devices. Currently, this endpoint has a

We are currently using Jamf Setup & Reset on our student devices. Setup is used to select a teacher classroom and set the appropriate role. We then have the students use a soft reset in Jamf Reset before the next student gets on the device.When the next student gets the device it has the Jamf Setup app on the screen. But it comes back with the All Set page even though the EA was successfully cleared. Is there a way to force Jamf Setup to open to the first selection screen other than forcing a reinstall of the entire app?

I read somewhere that with iPadOS 26 we will have an option to manage Safari like set Bookmarks and other staff. Unfortunately when i want elaborate this more further i am not able to find any offical documentation from Apple or from Jamf on this topic. Has anybody experience with this? Does Jamf already implemented into console tools to manage Safari via DDM?

Is it possible to Install Matlab R2020a silently? I have a registration key and a license.dat File.

Districts buy a lot of apps. Some get used every day. Others quietly gather dust after the first semester. The problem is that most IT teams don't find out which is which until renewal season, by which point it's too late to make a good decision. That's the gap RapidIdentity Insights is built to close.What Insights actually shows youInsights is the analytics engine built into RapidIdentity. It doesn't just tell you an app is licensed. It shows you how students and teachers are actually using it, down to the individual login. That includes:A full inventory of your SSO applications, including their status, security controls, and who has access to what Usage stats by user type, school, grade level, or location, so you can see exactly which apps are catching on and where Trend analysis and forecasting, so growth or decline in adoption shows up before it becomes a budget surprise Individual application launch events, if you need to drill down that far Engagement tracking, including which us

We have Jamf-enrolled macOS devices integrated with Microsoft Entra and Microsoft Intune for office and conditional access. Currently, a single compliance group in Jamf sends the device compliance status to Entra, where it's used for Conditional Access policies.Our client now wants to expand the compliance requirements by adding several new criteria. I'm wondering what the best approach is:Should we add the new compliance criteria to the existing compliance groupOr would it be better to create a new compliance group, validate it, and then switch Entra reporting to the new group once it's readyI'd appreciate any recommendations or tips.Thx

I have 3 devices in my org that when they hit the JAMF Connect Login screen to MFA into the device it auto-reboots.  I do not have a chance to choose local login since it is instant. I'm not sure if it's a pending policy or JAMF connect causing the issue since it has not checked in since the reboot has started. I do not see any pending policies in the logs. I can't apply any current policies or check-ins since it reboots too quickly to check in to JAMF and or post a boot up trigger. 2021 M1 Macbook ProJamf Connect 2.45.0

I know this has been asked before, but has anyone been successful using Jamf Pro to accomplish either of the following on managed iPads?Prevent students from deleting their Chrome browsing history. Prevent students from signing into Chrome with personal Google accounts (either allowing only our managed Google Workspace accounts or disabling personal sign-in altogether).If you've gotten this working, would you mind sharing how you configured it? Was it done through a Chrome managed app configuration, Google Workspace policies, Jamf restrictions, or a combination of the three?  

Written by Diane Meza The demand for skilled Apple IT professionals isn't slowing down. As more schools and businesses build their operations around macOS and iOS, they need people who know how to manage, secure, and support those devices at scale — and the talent pipeline hasn't kept pace.Mesa Community College is helping close that gap. Through the Maricopa Information Technology Institute (MITI), in partnership with Jamf, the college offers the Enterprise IT Professional Apple Technology course series: a hands-on iniative built to turn students into job-ready Apple IT professionals.Learning by doingUnder instructor Carl Cortez, students get more than lecture time. The initiative combines classroom instruction with real device management experience, covering how to work with macOS and iOS and how to manage them in both business and education environments. Along the way, students earn Jamf 100, Jamf 170, and Jamf 200 certifications, credentials that carry weight with employers already