Am am trying to secure our jamf pro portal but cant seem to find any documents on this and cant see anywhere to add it in JAMF pro, has anyone secured there logins with 2fa 

I have a script that will do the following: Create a local account based on admin pop-up box and rename the mac to this username-last4ofserial#. The account that is created is in LDAP format and is the user that I would assign in JAMF console in the user location field. I have LDAP fully set up in JAMF pro how can I make an API call to grab the username from the user account or the computer name and update the user location fields in JAMF pro console?

As it is the holiday season, I wanted to offer up a little gratitude in the form of boilerplate code related to topics that come up in the macadmins #scripting & #bash channels again & again. I hope people find it here & find it useful. 1) Logging is always a hot topic. "How do I create a log for my script?" "Where should I write log output?" etc. Without saying this solution is definitive, the script below has a pattern that I have used over & over. In fact, I paste this block exactly into any script I create that needs logging. It uses tee along with exec & with a named pipe. Why? Well, I find this works in all situations to capture all foreground & background processes executed by the script & it creates a dedicated stream / file for the log output regardless of what the script is trying to do. 2) Jamf API. I said in an earlier post I had come up with the shortest, bestest version of making an API call with token auth. I was wrong. I made it shorter

Hello,Posting to the Jamf Community for the first time so I hope I'm in the right place :) We use Jamf Pro to manage MacBooks and iPhones. These devices are corporate devices and registered with Apple Business Manager. The MacBooks and iPhones have been successfully registered and they now also appear within Microsoft Entra as 'Entra Registered'. This was achieved by getting the staff member to log into the Microsoft Entra app on their iPhone and MacBook.Is it possible to have these iPhones and MacBooks appear within Microsoft Entra as 'Entra Joined' instead of 'Entra Registered'.'Entra Joined' means they are corporate owned devices.'Entra Registered' means they are personal/BYOD devices.

Good Morning/Afternoon,I'm trying to add a Sub-Menu with some common links that our staff and students use.  I got the menu to show as "Actions."  Shouldn't I be able to name it "RBS Links" using the MenuText key? Am I not placing it in the correct spot?See plist:<plist version="1.0"><dict><key>Actions</key><array><dict><key>Action</key><array><dict><key>Command</key><string>url</string><key>CommandOptions</key><string>REDACTED</string></dict></array><key>Name</key><string>Launch LMS</string></dict><dict><key>Name</key><string>separator</string></dict><dict><key>Action</key><array><dict><key>Command</key><string>url</string><key>CommandOptions</key><string>REDACTED</string></dict></array><key>Name&l

Hi,I'm reaching out to see if anyone has found a way to enforce the Do Not Disturb feature while driving. We are trying to limit employees from texting or emailing while driving. Does JAMF Pro allow for this? If not, have you heard of other apps that would reach the same results?

Hello everybody,I’m quite new to all this JAMF settings and configurations.In the next weeks I will have to roll out new  iPads to our teachers to replace their 5 years old 32GB iPads with the newer 64GB devices.Old and new devices are/will be managed with JAMF School.Is it possible to setup the new iPads by using proximity setup as you would do on a private iPhone when switching to a newer iPhone?Thanks for your helpGerard 

Dear allWe have been using personal iPads for students for a couple of years now, managed with Jamf School. Lots of teachers regularly restrict the functionality of student iPads, especially during tests. However, during exams, things are organised differently: students are put together in large places, such as the sports hall. In those circumstances, restrictions are sent to more than 250 students, with a time limit of several hours.While this procedure works in smaller groups, there are lots of delays and failures in larger groups. Furthermore, the time limit is not always working: often we receive calls or mails from students at home, complaining that their device is still restricted.Does anybody know of any limits to the number of iPads/devices to restrict with Jamf Teacher? Are there best practices you know of, that might impact this situation?Thanks!

Hello everyone,yesterday, I pushed out the update to our 150 Shared iPads and today I saw, that they all lost their wallpaper, WiFi as well as the complete connection to our MDM. A connection with Apple Configurator 2 was not possible, too. The devices did not check in anymore and our team had to reset all of them via Recovery Mode.We are using Jamf School.Anyone having a solution for this?Thanks!

Can someone explain why certain Jamf policy 'User Interaction' notifications appear in the macOS Notification Center, and other polices (that are configured identically) have notifications that appear in a jamfHelper utility-style floating persistent windows?

So, we have the global setting in place for auto updates of mobile apps. Up to this point, we didn't have any issues with any of them. Today, on one critical business app, the dam broke with issues when the latest version made it onto several devices. I immediately paused auto updates for now. The people who support the app are working with the vendor for a solution. Question is this, if I find a device with the previous version still installed, is there a way to extract the previous version from that device and upload it to Jamf. In essence, a manual rollback. I realize there's no way to rollback the version in a traditional way.  

We are having a terrible time with filevault and want to find out if there was some kind of definitive guide to its implementation.  Right now we are binding and using AD accounts (Implementing Connect in 2024.  Would love to hear if this would help our situation) to login.  When a user changes their password it seems like we need to disable filevault, to reset the password and then reenable filevault otherwise the changing the password through system prefs doesn’t work.  And end users can’t disable filevault this because they aren’t local administrators. Questions and issues I have:Are we supposed to use a policy or a configuration profile in Jamf Pro to enable it?  Pros and cons?We have shared Macbooks that we need to be able to logged into by new users on a regular basis.  How do we enable that new user to automatically get access to a filevault encrypted drive? Based on this should we be using an institutional key or a personal key, or does that n

I'm trying to create a smart group to check to see if the anyconnect compliance module is a specific version. Our network group is in the process of updating our ISE Compliance on the backend. We're assisting with providing devices so it can be done in waves. On the windows side of things, they have he ability to grab the compliance module version to verify. I'd like to do the same for the Mac side, so when it's updated on the backend, we can confirm it's running the correct version. I've went through the different criteria's and can't seem to find one that fits it. Just checking to see if anybody has any ideas on gathering this info to be able to verify it.

Just doing an industry survey. Those NOT in education, do you lock the wallpaper for your users? 

Hi Folks,I need some assistance. I have been trying to onboard M1/M2 through prestage enrolment and it's failing due to rosetta2 not being available as some apps not getting installed properly. Can anyone suggest to me step by step process on how to install rosetta2 on those macs before any other application?  Thanks,Rish

I think I know the answer already but wanted to give it a shot here. I have a machine purchased in June 2023 from a employee that departed the company in November. On the last day part of the procedure is an IT team member will Jamf lock the device note the code and then get the machine back from the former employee.Seems after the machine was returned a team member thought they already unlocked it and completed a wipe and then deleted the machine record from Jamf. Well now its on a Jamf lock screen and the 6 digit code isnt working or the person wrote it down wrong. It is still in ABM but I am not sure how to unlock it since its out of Jamf, even if it were still in Jamf idk how one would unlock it without the 6 digit code. I tried DFU revive but that didnt go anywhere.Wondering if anyone has any thoughts or just release it out of MDM and e-waste?

Maximum of how many device we can enroll into Jamf now?

I have a group of about 200 devices I need to remove from management. I know I can do a bulk delete, but this appears to leave the profiles (and wireless certificate) on the devices. If I unenroll a device, this removes the profiles. There is a bulk delete, but I can't seem to find a bulk unenroll. Am I missing something or is this not possible? I can't just delete these devices and leave our wireless certificate on the device, so I have to remove them from management. Cheers,Chris.

HiWhen the new year starts, I want to know the easiest or best practice for iPad devices in school. I want to easily delete data and have them fresh with the required apps they need for the new school year. Please advise what your best practices and methodology are. Hopefully, this can be easily done through JamF school.@

Hiwe need the most important Infos from the User but we miss at the export the SerialNumber. This means that I have to combine the data from the categorie „Devices“ and the „user", which is very cumbersome.Export from categories "Users" Columns UserFirstNameUserLastNameUsernameEmailManaged Apple IDGroupsDevicesIt will be very well, if we could export with the SerialNumber and not if the user have a Device 1 or not 0.UserFirstNameUserLastNameUsernameEmailManaged Apple IDGroupsSerialNumberOr have anyone an idea, where I can extract/export the Infos (see the upper chart)Thanks for help!Peter

looking to the community for recommendations on keeping tabs on Apple updates. My org is strict about keeping things up to the latest version within 30 days. What sites/ RSS feeds, etc do you use to track upcoming updates?

I've read multiple posts here about machines not checking in with the JSS anymore.We have multiple machines that are not checking in anymore with our cloud JSS.I've tried many things written in previous posts. These are the commands I've tried and the results:Command: sudo jamf enroll -promptResult: Downloading required CA Certificate(s)...Restoring JAMF.keychain since an error occurred.Error submitting enrollment status to the JSS: Security Error - A security error has occurred.There was an error.     Error enrolling computer: Unable to establish trust with the JSS - Unable to add the certificates to the System keychain...Command: sudo profiles renew -type enrollmentResult: Error: Renewing DEP enrollment failed: (null) (NSCocoaErrorDomain:4099)When computers are connected to our education network I connect to them with ssh. This is how I tried these commands. I prefer to do it like this (when renewing through Jamf doesn't work), because I don't have to disturb

We have been using an EA to find Macs that have Find My enabled. It worked in Monterey and Ventura, but now in Sonoma it is coming up with blank results. Anyone have ideas how to correct it?#!/bin/bash # iCloud_FindMyMac.sh # Purpose: to see if machine is enrolled in Find My Mac plistBud="/usr/libexec/PlistBuddy" loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) if [[ -e "/Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist" ]]; then #FindMyMac=`$plistBud -c "print :Accounts:0:Services:11:Enabled" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist` FindMyMac=`$plistBud -c "print :Accounts:0:Services:" /Users/$loggedInUser/Library/Preferences/MobileMeAccounts.plist | grep FIND_MY_MAC -C1 | grep Enabled | awk '{print $3}'` else FindMyMac="Not Enabled" fi echo "<result>$FindMyMac</result>"

Safari17.1.2VenturaAuto-17.1.2

Hello dear community,We have some iPads that are not updated via the Jamf interface. The iPad OS version displayed in Jamf does not match the one on the iPad at school.The iPad cannot be reset and no longer receives any commands.For some reason, the certificate has not been updated.I will probably have to reset all the iPads manually.Does anyone have any idea how this can happen?