Is anyone else experiencing devices falling out of registered status and thus being marked non-compliant in Microsoft Entra when using the Jamf Pro Device Compliance integration? The users are still within the "Compliant" Smart Group in Jamf Pro but they fall out of registration. The Jamf AAD plist is missing and there is no MS-ORGANIZATION-ACCESS entry in Keychain. If I have the users re-register using Self Service/Microsoft Company Portal it will be fine for a while and the Jamf AAD plist and Keychain entry will reappear but then after a couple of weeks the same thing happens all over again. Jamf Pro version is 11.3.0 so it shouldn't be related to the recent product issue.

Hello,I would like to get all of our Macs up to date and create a plan to maintain this.    I would like to use the ScheduleOSUpdate command with the InstallLater command as described in Use MDM to deploy software updates to Apple devices - Apple Support My questions are:Can these apple commands be used in a configuration profile that gets deployed via Jamf Pro? I am having trouble finding an example or specific guidelines.Or are these commands intended only for a Mass Action Command as indicated Introduction - Technical Paper: Deploying macOS Upgrades and Updates with Jamf Pro 10.34.0 or Later | Jamf ?How can I see the status of a Mass Action Command after I

Our students have discovered the password to our "vendor" network, which is unfiltered, and have been putting both their personal devices and their school devices on this network.  We are working on dumping all connections and changing the password, but I am wondering if there is a way for me to block this network from being joined on our student devices?  I had thought initially that I could push this network out to all devices with the wrong password associated with it.  This does work but it also is interfering with our student network and causing an error with not being able to join that network either.  Thoughts?  Suggestions? TIA

When the machines have been started this morning, compliance issues were found and the Company Resources were unavailable. In the Company Portal application which is also connected to the Jamf Pro, there were two different devices with the same serial number: one was marked as compliant and the other as non-compliant. Upon refreshing and the status, the same device had still two entries: one entry showed as compliant and the other one as non-compliant. As a solution for Compliance issues, we have the dedicated procedure as seen below:Restoring ComplianceIn the event of non-compliance, users can follow these straightforward steps to restore their MacBook's compliance. Click on the respective button on the right to open the respective guideline in your support app.1. Install System Updates:Make sure that all relevant system updates are i

We are new to JAMF Cloud and would like to integrate our Google G Guite as our identity provider with our JAMF Cloud instance. We got the following linkhttps://www.jamf.com/jamf-nation/articles/440/configuring-single-sign-on-with-g-suite-google-apps Followed the steps, but got app_not_configured_for_user 403 SAML2 error. Anyone has a sample config template that works? Thanks for your help.

We need to downgrade a bunch of machines back to safari 17.3 from our recent update to 17.4 as the devs need it for their contract work with our clients, any ideas on how to do this?

Good afternoon, I am at a loss in an improvement that I am trying to make to speed up our student enrollment process.Current Situation - We have 2500-3500 students that enroll in our Further Education establishment yearly and each one of these students receive an iPad. In our current setup, we have it that the iPad is freshly wiped and the students will have to go through the process of; Signing into Wi-Fi (This is a pain because the students password is set to change on first login, they cannot authenticate to our Wi-Fi before they change their password. So typically, they will have to use a secondary device to go to Office365 to update their password first.). Using their Active Directory account and credentials to enroll the iPad. Signing into their managed Apple ID. Agreeing to Terms and Conditions, etc. and turning on Location Services.This is a time consuming and tedious process when you're running four enrolment sessions over four different zoning are

Hello, I need a daily report. Our security team want a daily report like this. Does Last users has admin rights? How can i do that? I need your help. Thank you. 

Just in case anyone needs this I wanted to post it for an updated resource.#!/bin/bash # Script Name: Disable Slack updates.sh # Author: [Michael Cleveland] # Created On: [Creation Date, e.g., 2023-10-31] # Last Modified By: [Michael Cleveland] # Last Modified On: [2023-10-31] # Version: 1.0 # Description: # This script modifies the Slack application's preferences for the currently logged-in user on macOS. # It specifically sets the 'SlackNoAutoUpdates' key to 'true', which prevents the Slack app from auto-updating. # Usage: # Ensure that Slack is not running or is restarted after this script runs to apply the changes. # Note: # This script uses PlistBuddy for editing plist files, as it ensures the file's integrity. # Be cautious when editing plist files and always ensure backups are made before script execution. # [Here starts the actual script code] echo "Starting the update of Slack preferences..." # Get the current logged-in user USER=$(stat -f %Su /

Hello all,I have an issue showing up at random with only a select few of the iPads I manage. A certain app will not install but will show up on the device grayed out and typically says Waiting (it is properly scoped and we have enough licenses). When you click on the grayed-out app, it either does nothing or prompts to be installed via the App Store.I'm also not able to install it through Self Service. The "Install" command is non-responsive and JAMF shows the command as failed, citing that the app is already scheduled for management. I am not able to delete the grayed out app because it's not installed. I supposed I could install it through the App Store but I shouldn't have to. The iPads are 7th gens running the latest iOS and have enough storage available to install the apps.Thanks!

Hello,what is the best way to remove Jamf Trust from the devices (macOS)?The configuration is quickly deleted, but what about the app? We have rolled it out via the App Store using VPP licences. Thank you

Hi,Jamf is supporting default scripts for checking time machine backups. But with new versions of mac os this won´t work beuacse diskutil is using PlistBuddy. This has no disc access. If i enable Terminal in full disk access those scripts are working again. Without disc access With disc access   How can i set Terminal do full disc access via configuration profile? Greets Frank

Wondering if there is a way to change the default shell for all users?I see that a user can themselves type  chsh -s shellnamee.g. csh -s zshbut they have to authenticate.  I could run a script at login, once, but not sure how to tackle the need to provide their password.Also, I'd like to change the system so that new users have the newer shell (zsh)

Hi , we are trying to setup SSO and ran into an issue where users in an ldap group are not recognized and get access denied. Only ldap users directly added to JSS are recognized and signed in. Any idea how this can be solved ? thanks

Hi. What is the preferred/best way to create a custom PKG from the developer's PKG? An example is Cisco AnyConnect. If I run the installer for Cisco AnyConnect manually, I get the options to deselect certain things, such as Web Security or ISE Posture. If I were to deselect these options, how could I make sure those options get deselected for everyone else when deploying via Jamf? (since it will install without a GUI) Would this be done via Automator? Thanks!

Sorry if this is a simple one but couldn't find an answer elsewhereAfter I upload a package to Jamf, is there a way to download it? Giving I don't have the original package and it's not in Composer. I need this to be able to push the package through Munki and/ or Deploy studio Thanks!

Hi everyone,I am testing Jamf Connect for our environment. Our setup is to have a local admin account as the first user created. When we add another user via Jamf Connect they are not getting secure token. This only happens if the user account was not already on the Mac. Has anyone found a work around for this?

With the help of support we did find out how to prevent students from deleting history with Safari.It is in the profile under Web Content Filter and then "Enable web content filter" and "Enable Automatic Filtering". This successfully removed the option to delete history in the Safari app, and also removed the ability for the student to do private browsing.We also need to see if this is possible in Chrome. We have contacted Google support but without much luck so far. Has anyone gotten a profile payload to work with Chrome that might accomplish something similar?

Hi,We have an on premise Jamf distribution point. It appears to have MySQL and Java installed. I don't believe these components are necessary for a distribution point but have been struggling to find a definitive answer. Does anyone know if I can just uninstall these without affecting the DP Many thanks 

Hi, happy new year to all of you first 🤗 !! To start this year, I have an issue on our Macbook Pro M3 during enrolment setup.  User tried to enroll device but nothing appears : no step configuration, no DEP. It gave her this screen with no local account created. Device exists in Jamf with no local user account created and named MacBook Pro. Seems that the device has no completed the config setup...We had in the past the PI-111120 issue where it seems to be resolved in the Jamf 11.1.1 :  https://community.jamf.com/t5/release-info/jamf-pro-11-1-1-now-available/ta-p/305751To test, Transfer Information is uncheck in PreStage : 

Hello All, I'm stuck. I hope anyone can help me :)I need to check all apps status on full disk access. Is there any command to find status or other way? My manager want to know 2 things. 1. Is XXX.app added to full disk access ?2. Is XXX.app open on full disk access ?Thank you. 

Looking for same help with Okta SSO into Jamf Admin. We have it working for Admin accounts that already existed in Jamf and for directory users, but I want to transition to the correct way of controlling access to Jamf Admin using User Groups. I've tried both Standard Group and Directory Service Group, matching the name to the group name in Okta. I've captured the SAML assertion and it is listing the group name, I've done group membership lookup in ldap test and it sees the user in the group, but when a user in the "Jamf Admins" Okta group who doesn't already have a Jamf Pro admin account attempts to log in via Okta they get an "Access Denied" error. Any ideas?

Anyone know of a resource for this?

Hello !I have a script that helps me to reconfigure printers and sets them by default depending of their location, department, etc...The problem is that I can't set the ~/.cups/lpoptions by using lpoptions -d default_printer. To run the command, I use a function that I found and that executes it as the logged user.runAsUser() {     if [[ "${loggedInUser}" != "loginwindow" ]]; then          launchctl asuser "$userID" sudo -u "${loggedInUser}" "$@"     else          echo "No user logged in"          exit 1     fi}If I execute the command as test:launchctl asuser 502 sudo -u myuser /usr/bin/lpoptions -d default_printer, it does nothing. The lpoptions file is not populated. Even if I run the c

Recently we have noticed that the System Preferences keeps popping up no matter how many time you turn it off or close it. I have checked the login items and nothing is selected. Any advise?