We have access to JAMF Safe Internet due to buying the EDU ultimate bundle for some of our devices.  Is there a way to only apply it to devices when they are offsite?  I do think you could do this with a configuration profile that only applies when the device is not onsite in JAMF school, but those don't always change quickly and it sounds like when the profile is applied and removed it would disrupt Internet activity on the device.Here are some secondary questions and thoughts from my testing so far: Privacy - While I understand why some places would want this, in our environment we tell the students they should have no expectation of privacy when using our devices.  We really need to be able to see which students accessed what sites when something gets passed the filter that should not have.  Local DNS - Having to create an entry for every local DNS resource will be time consuming and hard to maintain.  I wonder if they could allow you to do a domai

So I have a configuration profile set up, and configured Require Passcode to Unlock Screen and I have it set to never. But when I log on to the machine, it doesn't seem to be correct. When I look in the system settings, it is set to "immediately", which is the complete opposite of what I want. Why are these settings completely contradicting each other, am I completely missing something here?    

This might be more of a rant than anything.I've spent my day just simply trying to get a script together for our Cart devices to rename the devices to the Bar Code 1 value since those don't change through restores and would enable my techs to just restore the device and put it back in the cart. Zero touch beyond actually restoring the device.For completionist sake I did get it to work fully as expected!Come to find out the bearer token you need to generate only lasts for 30 minutes meaning that hard coded credentials either get passed via the script or in the $4 $5 fields.I kind of get the idea behind only having a 30 minute token but you really can't make it any longer? For instance doing the restores on the carts only take about 2 or 3 days. I can't just set it for 5 days then just regen a new token every summer?Am I just looking at this the wrong way?

With basic auth going away in the next release, has anyone been able to find a way to connect PowerBI and Jamf?  

We're trying to scope smart groups based on Patch Reporting: {Application} Less than Latest Version. Currently we only have Patch Reporting: Google Chrome in there. How do we add more for other applications, or am I mistaken and Google Chrome is the only one supported by JAMF?

We had a macbook with activation lock with find my mac with personal account, we use the erase device option on Jamf School and request a pin, we set up.After the erase or before, I didn't know if make the erase, stop the process with the activation lock screen on recovery assistant.We try to write the bypass code at activate with MDM Key but didn't work too.Any idea, we use normally the bypass with iPads but normally with Macbook didn't had problems until now.Thank you

I'm trying to remove all Office 365 applications and any file with the word Microsoft in it from all our Macs. I wrote a .sh script and it is installed with Composer. Then a I have a script run that is sudo sh /path to .sh command. The Composer package will remove all the applications after a while but most of the rest of the files aren't removed. If I copy one line and paste it into Terminal it will run and remove the file(s). Why will the Terminal commands work in Terminal but not when I run them in Composer. My .sh script is setup like this but with a lot more paths listed: Thanks!sudo rm -R /Applications/Microsoft\\ Excel.app;sudo rm -R /Applications/Microsoft\\ OneNote.app;sudo rm -R /Applications/OneDrive.app;sudo rm -R /Applications/Microsoft\\ Outlook.app;sudo rm -R /Applications/Microsoft\\ PowerPoint.app;sudo rm -R /Applications/Microsoft\\ Word.app;sudo rm -R /Applications/Microsoft\\ Teams.app;sudo rm -R /Applications/Microsoft\\ To Do;sudo rm -R /Applications/Office.app;su

I'm trying to set up and test LogCollection. I created a Jamf user account and want to give it the barest privileges, only what is needed to connect and upload the logs. The only privileges I have configured for this account is create/update Attachment Assignments and create/update File Attachments. When I run the policy, I get the error "The request requires user authentication". What else do I need to provide this account to be able to connect and upload the log files?

Hi Team,Does anyone know how to enforce the screensaver after 15 minutes of inactivity and require a password to unlock in Sonama?I've been trying through a script but it doesn't seem to work, and end-users are still able to change the settings through System Settings., even after the screen lock Password is required need to unlock the screen

Hello, I am trying to package an application, specifically Charles Proxy, and I am able to get it to deploy fine, but the application requires admin rights to access the Mac proxy settings after the install. I can't seem to figure out how to grant these rights to the application before I deploy it to the users. Is there any trick to this or will this application now require admin rights to use? I am just getting into application packaging so sorry if this is confusing, if there is anything I can clarify, let me know.

JAMF newbie here...Our K-12 school is looking at a hybrid approach in terms of technology and I'm wondering if somebody could share their experience or thoughts around this.Current situationTeachers are all assigned a laptop device (Microsoft OS) and we use Microsoft as our primary platform in the school.We have a BYOD policy for students and they are opting more and more to bring iPads to the school.  As a result, we considering rolling out JAMF to manage the iPads.  The majority of the apps we use are Microsoft (e.g. Teams, OneNote, etc)From a management perspective, could the teachers still engage with JAMF features such as lock screen, etc from their laptops or would they need an iPad as well to do this?

I need a way to force logout the user after FileVault2 has been enabled. I see some old post from 2014, but nothing new. Any ideas how to force log out the user which would be the local admin account once FileVault 2 has been kicked off. I tried this didn't work #!/bin/sh # # Step 1: Log out Active User command. CurrentUser=$(stat -f%Su /dev/console) OtherActiveUsers=$( who | grep -v _mbsetupuser | grep -v ttys000 | grep -v "$CurrentUser" | sed 's/console.*//' ) loggedInUID=$( echo "$OtherActiveUsers" | while read userName; do id -u "$userName" done ) echo "$OUsers" | while read userName; do echo "$loggedInUID" | xargs /bin/launchctl asuser "$loggedInUID" sudo -iu "$userName" "/usr/bin/osascript -e 'tell application "loginwindow" to «event aevtrlgo»'" done exit 0 and this #!/bin/sh ## Get the logged in user's name loggedInUser=$( ls -l /dev/conso

We have cloud Jamf Pro and both an on prem DP and a cloud one. Most packages need to be available to users on or off campus, but there are a few which are used only in the campus computer labs and which are too big for the cloud DP to accept. In order to not attempt to sync those ginormous packages every time, I've got the cloud DP set to sync specific files instead of the full contents of the master, and the biggies are unchecked. The big downside to this is that each time I add a new package that DOES need to be in the cloud, I have to remember to go into the settings and add a checkmark for it. Assuming there is no way to change the default for new packages to "yes" from "no", is there any other clever scheme I could use to ease the administrative overhead?

Hi Guys,I've been following the documentation and training videos for setting up a limited access DMZ deployment of Jamf Pro, which for the most part has been easy to follow. I've updated web.xml to block access to the api servlet, but wanted to remove the documentation as well. The relevant step in that training instructs you to remove the API directory from the web root to stop the API documentation being accessible... only there is no API directory on my deployment. If I access: https://jamfproserver:8443/api I'm presented with a page that allows me to choose between "classic API" and "JAMF Pro API" pages. I've removed the classicapi directory, so it 404s, but the JAMF Pro API link takes me to active documentation. I assume this folder has simply been moved and the training / documentation is lagging behind, in which case I'd love to know where it's now located. Any help appreciated!

Writing a extension script to use the API to get some LDAP info on lastuser.Even thought API will only have read ability to Jamf LDAP setup the API call will be running daily on every endpoint and I do not want the API password in the script.Any ideas on how to get around this?

Hi friends,I am new at Jamf and appreciate your help.We use Jamf Pro in the cloud and we have a local Microsoft CA server.My goal is to install certificates from the local CA using Jamf pro cloud on the mac devices.I understand there are two ways to do this:1. Using Jamf ADCS Connector2. Using Jamf SCEP with local NDES serverAm I right?What is the right and secure way to do it?We also have Azure and Intune if that can help. Thanks  

Our previous Jamf admin showed me how to package Citrix Workspace for Jamf, but at that time it was a PKG file. Now it's a DMG. The Installer PKG (in the DMG) bundles Citix Workspace and something called "Citrix Enterprise Browser". There's a way to install just Citrix Workspace, according to https://docs.citrix.com/en-us/citrix-workspace-app-for-mac/install-uninstall.html (search for "Install only Citrix Workspace app" on that page). You need to download an XML file and then can run a Terminal command line that installs the Citrix Workspace.app file in your desired location.So my bright idea was to take that .app file, drag it to Composer, then build a PKG to get just a clean install of Citrix Workspace that I could then deploy via Jamf, but it doesn't work. The app installs, but when I attempt to connect to Citrix, the cursor just spins forever and doesn't connect. But when I launch the app using the build instructions from Citrix, I can connect just fine.I'm not sure

I have a bit of dilemma where I need to remove Jamf Framework and enroll many devices at once. I was thinking we can do something with a script:#!/bin/bashsudo jamf removeFrameworksudo jamf enroll -prompt -nopolicy #After this is run, it would request for JSS and password.  This is where I am stuck. I understand this is a bad Security practice. But I still want to do this. I was thinking of creating a one-time account to do this push and removing the account.With that said, my question is:Is there a way to add the username and password inside the script so that when "sudo jamf enroll" runs, it uses the credential to bypass it? I don't want the users to enter the credentials instead use a one-time script to run everything and complete it.

We're trying to give access to subsets of machines to tier 1 technicians using Sites but we're running into a glitch. The tier 1 accounts see the Start Session button under Management/Remote Assist but when they click it it just spins. Bringing up the browser console I find permission denied error for a XHR call to /computers.html after the button is clicked. Even giving the tier 1 admins Administrator Site Access isn't enough. Is there something they have to be granted at the Full Access scope? Since the UI shows the users the Start Session button I think this is a bug.

We recently initiated Federated Authentication in our environment and I have noticed a strange thing - if I am trying to add an account via Apple Business Manager and I I want to set it's "Role" to Administrator - it automatically selects Authentication: "Apple". Only if I select Staff it is added as "Federated". Does it mean that Administrator "Role" account on Business Apple Manager can only be authenticated via Apple? As it requires attaching a working phone number in such case... Any insight on this would be great!

Troubleshooting steps Extensive trouble shooting steps are available from Microsoft at: https://learn.microsoft.com/en-us/entra/identity/devices/troubleshoot-mac-sso-extension-plugin   Removing PSSOe from a user account  To force an update to a user account with PSSOe, unscope the configuration profile with the steps below.  This allows for the device to be re-registered or the local macOS UNIX user account to be paired with a different cloud identity provider account.   Secure Enclave method - Un-scope the configuration profile.  Check to see if any legacy SSOe payloads are still on the device and remove those configurations as well even though the Platform SSOe keys are missing.  Reboot the computer.  Open System Settings, Users & Groups, select the “i” next to the user account.  Confirm the Platform Single Sign-on section is missing from the user account.   Password method - Un-scope the configuration profile.  Optionally, rebo

Hi Everyone,After 2 years of using an older package of Garageband with All Loops, it's time for me to repackage it and I'm wondering how to best do it. In the past, I created a 10Gig+ package of Garageband and all the loops using Composer (this is why it's been 2 years). The music teachers want the students to have access to all the loops and since we have Standard accounts it makes it easier if Garageband is just ready to go without Admin privileges to install the loops later. Should I try to install Garageband using Mac Apps Store and then try to push the loops after? We don't assign the students Apple IDs so I'm not sure if I can push out Garageband directly to devices. I had tried in the past but did not seem to have success. And then where would I find the loops? They seem to be buried in various locations. Thank you in advance for any advice and guidance.

Hi,I have done the setup for Device Compliance for iOS following the Jamf Docs, however when i go to the Self Service app on my iphone, and go to Microsoft Authenticator. There is no option to register. I can confirm my iphone is in both the compliance and applicable group in Jamf and my Entra account is in the group which is used in the Intune Partner Compliance portal Im not sure what im missing?thanks

When the inactivity timer kicks in and logs you out, logging back in and going to the devices inventory, I have to re-select all the columns I wanted again, and in the order that I wanted them.

I am migrating my workflow of managing the macOS ALF firewall from scripts/policies to Jamf MDM profiles. Found odd behavior that prevents users from making changes.Even though I have explicitly set the new ALF profile to allow users to modify ALF if needed (Jamf Privacy & Security > Firewall settings change > Enable user changes to the firewall settings), the ability to manage ALF locally is greyed-out (disabled) on my test Macs - even though the user is a local admin(and can authenticate to unlock the Security & Privacy pane.As soon as I remove the profile (un-scope the target Mac) the ability to modify ALF returns.When I examine the raw XML plist (/Library/Managed Preferences/com.apple.security.firewall.plist) I dont see any key/value pairs related to restricting users from modifying ALF (assuming I'm looking in the correct location.)When I look at the raw XML plist (/Library/Managed Preferences/com.apple.security.firewall.plist) I don't see any key/value pairs related