Since we couldn't reliably do VPN only when offsite, we have Always-On VPN always-on for students, even when on-site. This has achieved many (but not all) of our objectives so far on managed devices - in terms of ensuring that internet traffic is always passing through the firewall. Enter Apple Classroom. Our firewall vendor (Cyberhound) uses strongswan. Even if we put a teacher on the same IKEv2 JSS-configured Always-VPN, they can't see each other. Any ideas? Could we have done something on the (or a..) VPN server to make VPN clients bridged to a common network? Is that even possible with IKEv2 VPN? Thanks

Im trying to convert a large number of admin accounts to standard accounts. On jamf nation, multiple people have been sharing this script below, but when I run it, it does not change any users from Admin to standard. Below is what I ran:with ###### being the local admin account on every device. #!/bin/sh adminUsers=$(dscl . -read Groups/admin GroupMembership | cut -c 18-) for user in $adminUsers do if [ "$user" != "root" ] && [ "$user" != "######" ] then dseditgroup -o edit -d $user -t user admin if [ $? = 0 ]; then echo "Removed user $user from admin group"; fi else echo "Admin user $user left alone" fi done When it finishes, the logs show 0, but nothing changes. I can change each laptop individually with #!/bin/sh sudo dseditgroup -o edit -d $username -t user admin but that isn't ideal. Am I doing something wrong? And I have seen the other posts about this topic and almost all share this same script with users saying it worked fo

Hello nation!I have been testing the Jamf Mac Apps feature to install/update Microsoft 365 programs and things have been well so far. There is just one thing I can't seem to  Unless I am completely oblivious to what is in front of me, I am having trouble understanding where one would find logs when software installs occur. It's been pretty good to me so far, but was wondering if I had access to logs for troubleshooting purposes.Thanks in advance!

I've seen a few tricks for getting what  calls the Marketing Model name of a Mac in Terminal. One uses the last 4 characters of the serial number in a curl command, e.g., documented here...This seems to work (it requires the -l flag on curl) but it may stop working because of changes to  serial numbers. However, there is no need to use curl to get this information (even if that is how it's done in the background...)It is available on Intel Macs if the com.apple.SystemProfiler.plist exists. This .plist is created when the "About This Mac" menu item is opened.It is available on  Silicon Macs in ioreg output.Clicking "About This Mac" in the  menu launches the "About This Mac.app" located in /System/Library/CoreServices/Applications/ so it can be launched from a script with the open command.The "About This Mac.app" executes the "System Information" process. You must close "About This Mac" with a different command than the one you use to open it...The Mac Market

Hi all,I had an issue where the jamf binary stopped working (although not deleted). I received the error "command not found" when trying to run sudo jamf recon from command line. I ran a jamf API (jamf-management-framework) which fixed issues with running jamf commands in terminal. However, no policies will run in Self Service. the status bar spins, but nothing happens. When I look at the device record in jamf, it doesn't show a record of the policy being run. Please let me know if you have any suggestions.

Hello Team,I want to block two commands (sysadminctl  and  dscl) on mac devices through JAMF. Please let me know if I can do it through config profile, I can change the permission(000) by a script/command and run it via a JAMF policy but users are admin and very smart so that they will create another users via commands, so I am planning for config profile so that they cant run or change anything to make run on macs. Any idea will be appreciated. Thanks!

Adobe's products can be a challenge to deploy, manage, and integrate into high-stress production environments or the chaos of a classroom lab. Does it take a skilled ninja with a mastery of Adobe's alphabet soup (AAMEE, AUSST, APTEE, RUM, and xDA) and JAMF Software solutions to survive? Or does it take meditation on how you can become "one" with the optimal production workflow? Jody Rodgers, Senior Product Manager from Adobe, will be shaving heads or sharpening swords depending on your path. We will be working through what it looks like to use the Adobe tools in conjunction with the Casper Suite, and be examining successful workflows, and sharing what Licensed Software, Application Usage Reporting, and targeted deployments can do to assist in your organizational endeavors! Bring your questions, and we will put any resources here after the presentation! Thanks! wudi

I have created a SelfService policy that executes open -a "About This mac.app" in Self Service. We would like to have the app open directly into the "Storage" tab, so that users can identify/delete largest space hogs (Clicking on "Manage..." does that). Our managers like the colorfulness of that window, otherwise we'd launch "Storage Management"). Is there a way to get that tab open directly when the user clicks on the icon in Self Service? This is what we currently have.    Thanks, E  

Has anyone noticed this? For the last few weeks, I have noticed that editing the scope of profiles using Safari is very slow. It starts after I click Edit and try to add or remove computers or groups in either Targets or Exclusions. The first thing I thought of was that I use an ad blocker. I made sure that it was disabled for Jamf cloud. It is. If I try editing the scope of profiles in Edge or Chrome, there is no issue. I have been a Safari user since it was released as a beta app in 2003. I prefer to use Safari, and I only use Edge when necessary for sites that I use for work. I'm very stubborn about my preferred apps so I really don't want to have to switch to using Edge for Jamf Pro. I have tried this on my work MacBook Pro and my personal MacBook Pro. It's the same issue.

Is there a way to have all Mobile Device Apps under Devices have the "Assign Content in Volume" option checked if available?  Doing a migration from Xenmobile and assigned all the relevant apps but forgot to initially check the box.  Was trying to see if there was an option to do this without going back into each app (100+ apps).Thank you!

Other than deleting them, does anybody know if there is an alternative method to unmanaging devices that are shown as managed that are no longer contactable (Remove MDM Profile -  will not work here) in JAMF?Reason is we would like to keep the inventory.Thanks 

We're trying to populate user and location data on our iPad devices - But it doesn't seem to work.We have Azure setup as our Cloud Identity Provider. The test function confirms the lookups & mappings are working properly.  We have an Enrolment customisation that points to our SSO Azure authentication - This is then set on our pre-stage enrolment.  When a device goes through setup - The users are prompted to sign in. We expected the user & location data to be populated - But it doesn't. 'Collect user and location information from LDAP' is ticked under inventory collection settings.Has anyone got this to work? Not sure what we're missing.Cheers

The Microsoft forums seems to have little in the way of information regarding exclusions on macOS and my Google fu seems to be broken today.Rather than re-invent the wheel, can those that have implemented Defender share any nuggets of wisdom regarding any system folders /  processes that should be excluded as part of the standard configuration config profile. My starter for one would be the jamf binary and /Application Support/JAMF  

Howdy,I have a laptop that failed to update the MDM Profile, it's expiring soon. Normally I'd just wipe and re-enrol but this happens to be a Developer's laptop and they can't really afford the downtime. I checked the logs and I see "Update to MDM profile contains different push topic". All other 200 or so devices in the fleet renewed fine, just not this one. Is there anyway to resolve this without wiping the device?TIA.

We can't find a workaround to GarageBand, Logic Pro, MainStage and MuseHub requiring admin rights to install additional stuff (even running Carl Ashley's loopdown with the all parameter still results in Logic Pro wanting to download additional items although GarageBand shows everything installed). So now we're considering deploying MakeMeAnAdmin and reducing the time down to 1min. All good except that the script stores the logs locally which we're concerned about the user deleting. One option is to email it out but that means leaving an unencrypted mail user password in the script which we could live with by creating a mail only account that can only send to internal addresses. But then I remembered seeing a script that sent logs to Jamf but can't remember where. Does anyone know if it's possible to send the MMAA logs to Jamf (and how)? We just need to know what the user did during that window that they were an admin.

Can i export any of my config profiles or policies in Pro and import to JAMF SCHOOL?

Hello all,I've done a search for this but haven't quite found the info I'm after. Basically we are looking to flip the switch on federated authentication via Google for our Managed Apple IDs. We have ~70 people who are currently using their work email address for their Apple ID. Just want to know what their experience will be when we flip that switch. Will it just be a case of re-authenticating with their Google details or will it be more painful? &#x1f605Any info will be greatly appreciated!

Environment context: 2 different ssids- Open network Captive Portal SSID with a portal enforced (Aruba Clearpass)- WPA2 SSID with an allow all after authentication (by default)While devices are on the default SSID, we are able to push a wifi profile consisting of the captive portal SSID to devices successfully. However, when devices are on the Captive Portal SSID, we are unable to push the default wifi profile back on devices. The following IPs, URLs and Ports have been allowed to devices on the Captive Portal SSID: https://learn.jamf.com/en-US/bundle/jamf-school-documentation/page/Firewall_Ports_IP_Addresses_and_URLs_Used_by_Jamf_School.htmlWe need to switch SSIDs during maintenance periods where having an allow all SSID will be beneficial to us, open to other suggestions on a better workflow as well. Any one has any idea how we can go about this? Thanks for reading

While rolling out Jamf safe internet we see this message in the dashboard for active devices.    

I'm pretty sure I know the answer, but can't find the statement in any documentation.  Is it possible to pull attributes when you have Cloud Identity Provider enabled for Azure in via extension attributes?  If so, what attributes are available?

Today we released Jamf Connect 2.37.0. This release includes the following changes and improvements: Identity provider (IdP) related features and background activity are now disabled by default when Jamf Connect is not linked to an IdP. PingFederate is now a supported IdP when making role-based privilege elevations. The login window web view now expands to better fit certain IdP logins on larger displays.   To access new versions of Jamf Connect, log in to Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Connect. Product Documentation For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. Thank you!The Jamf Connect team  

I've been having this issue for a while and it seems to have been caused by a Jamf PPPC profile that I created to allow standard users to authorize Teams to screen record.On Monterey and earlier operating systems, users get stuck in an endless loop in the new Teams when trying to enable Screen Recording to screen share. They get prompted to authorize it but even when it's authorized, they get asked again, as if it wasn't authorized. The only solution we've found so far is to upgrade to Ventura where it doesn't seem to be an issue but they do have to toggle it off and then back on and if it's already been set ton On. Has anyone experienced this issue? Thank you.

Hello, Our organization would like to set the "Download External Images" to "Only in Messages from my Contacts" which we were able to do with ease. However, we want to add a few known emails to everyones contacts or at least to the "Junk - Safe Senders" list so this change doesn't cause issues with our users. Is there a way to do this?

Hello folks,I am currently testing iOS 18 dev beta. As it stands, Profile-based User Enrolment is no longer supported and you are forced to use Account Driven Enrolment with Managed Apple ID. Is this correct? Are there any official sources from Apple? I haven't found anything about this in the release notes.Best regards,Florian

Hi everyone, With the update to Ventura, is there a way in Jamf Pro to enable users to change the Airplay Receiver settings? We want our users to be able to enable Airplay Receiver and Change the "Allow Airplay for" category without needing admin credentials. We were able to allow users to change these settings when they were under the Sharing menu in Monterey, but these settings were moved to the AirDrop & Handoff and now users can no longer edit (without admin credentials). We currently have AirDrop enabled in Jamf Pro. Thanks!