Hey all, If you missed the PSU conference this year, not to worry. You can check out the videos of sessions here and slides can be found here.

Hi All,    I have issue with login into Self Service with SSO, I am able to login to access the login process, but once I approve my MFA it doesn't approve my access, does anyone have any information this process?    

Hello Jamf NationThe JNL London 2025 sessions are now available here on Youtube. Catch all the sessions in case you weren’t able to attend. Happy watching!

Hey All,We are working on determining the best way to manage our assets. We are a Mac/iOS only environment. So all of our equipment goes into Jamf Pro. We don’t do touchless deployment (management decision although its practically touchless). I’d imagine we’d need to get MUT involved to update purchase status.How do you handle new equipment or equipment that goes back into inventory? Also, we are looking to get physical asset tag stickers for the devices. Any suggestions on using Jamf as a complete solution? Or addition tools that people use for Asset Management to track items?Thanks!

I have a script that worked before OS15.5. After updating to OS15.6, the script became abnormal. Even if it connected to the allowed SSID and obtained the IP address, it would turn off and on WIFI infinitely. The following is the script. Thank you for your help~~ #!/bin/bashallowed_ssids=("SSID_1" "SSID_2")wifi_port=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $NF}')[[ -z "$wifi_port" ]] && exit 1  lockfile="/Library/Application Support/JAMF/.wifi_cleaner.lock"mkdir -p "/Library/Application Support/JAMF"if [[ -f "$lockfile" ]]; then    pid=$(cat "$lockfile")    if ps -p "$pid" > /dev/null; then        exit 0      else        rm -f "$lockfile"      fifi{      echo $$ > "$lockfile"    trap 'rm -f "$lockfile"; exit' EXIT INT TERM          check_and_clean_ssid() {          local connected_ssid=$(/usr/sbin/ipconfig getsummary "$wifi_port" | awk -F ' SSID : ' '/ SSID : / {print $2}')                  local ssid_list=$(networksetup -listpreferredwir

Today we are releasing a maintenance version of Jamf Pro; highlights include: Changes and ImprovementsJamf Pro 11.19.1 includes Tomcat 10.1.43.  Resolved Issues Jamf Pro Server: Security IssuesJamf provides the CVE-ID for security issues with high or critical severity when possible.[PI136944] [PI138128] Fixed: A known vulnerability in a third-party library (CVE-2025-48976). [PI138965] [PI138090] Fixed: A known vulnerability in a third-party library (CVE-2025-5878). Jamf Pro Server[PI135178] Fixed: In a computer configuration profile with a Restrictions payload configured to allow integration with external intelligence services, users may be prevented from enabling ChatGPT on computers in scope. This is due to the profile containing the key "allowedExternalIntelligenceWorkspaceIDs", even if the corresponding setting is not selected. [PI139029] Fixed: Modifications to smart groups are unable to be saved when the group is a dependency of a blueprint and impact alert notifications are enab

Need help with installing GarageBand Loops for users without admin rights.

How do I set up so that students are not able to use the Messages app on their Mac. 

Update 06 August 2025: Standard Cloud upgrades are scheduled for the weekend of 15-16 August (details below). We appreciate your patience with the revised schedule. Today we are releasing Jamf Pro 11.19; highlights include:Impact Alert Notifications for Scopeable ObjectsThese notifications provide enhanced visibility and control when modifying group configurations. This feature helps prevent unintended large-scale changes by giving administrators insight into how their modifications will affect devices and existing group configurations across their organization.   Automatic Redistribution of ACME CertificatesYou can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire. To support this function, a $PROFILE_IDENTIFIER is automatically inserted into the Subject of the issued certificate as an organizational unit (OU). Note: Your ACME certificate authority template must also support t

Hi all, we are using cloud instance of Jamf Pro, with user-initiated enrolment for iPads, iPhones, etc always been unticked (all boxes, inc account-driven and profile-driven), while computers were enabled.Everything was fine till iPads with Apple M-chips were released - now users CAN enrol them manually… Is it because Jamf Pro mistakenly taking them as MacBooks? Is there a way to fix this?Thanks!

We just got the Jamf AD CS Connector set up for our environment. It's awesome considering we were using an ancient, user-initiated script through Self Service for a long time to accomplish the same thing. However, I am wondering what the best practice is for pushing the wireless config during or after enrollment is. As part of our zero touch efforts, we have the user enroll using our guest wifi network when on site. I'd like to get the wifi profile installed as close to enrollment time as possible so when it does its post-enrollment tasks (installing security software, settings, etc) it will pull from on-site distribution points rather than our Internet facing distribution point. Has anyone had success with this? I seem to find myself getting railroaded installing this profile as it either interrupts the enrollment or post enrollment when it automatically switches from our guest network to the corporate network. Thanks in advance for any thoughts.

I am running into this issue where after pushing an app, updating inventory or enrolling a device, the apps are going straight to the failed command list and display the “No license was found for app”. I have tried wiping and re-enrolling, updating OS, restarting, sending a blank push, or update inventory command but the issue persists. I check the apps and we do have enough licenses available. Any solutions or ideas on what can be causing this?Thanks

I just wanted to say they really helped me get across the finish line with a script I needed to move computers from one pre-stage to another.Also special shoutout also to ​@mattjerome for getting the base script started with me.Anyone else have cool stories of how Jamf Support came through for them when you were hitting a brick wall with things?

Hi,  Is it possible to block widgets with the Home Screen Layout but also allow apps to appear (at least on the second page) while not having those apps lumped into a folder? Here is an example I have setup -- Main group (All Student iPads): Has normal student iPad apps. These apps and profiles appear on the first page as intended according to the home page layoutSecond group (LMC): Has specific apps set to auto-install. Sometimes these apps appear after the first set of apps. But if wiped and returned to service, the apps will move to the second page of the home page and get lumped into a folder called “Managed”. Is there a way we can have this setup so the apps on the second page DON’T get grouped together while also hiding widgets/blocking students from removing apps? It would theoretically be nice to just have all the apps together but having the layout locked on page 1, and other apps on page 2 (if more then two groups) be together, that is fine too.  Thanks 

I am attempting to import a new VPP token that I have downloaded from Apple business manager. Every time I try to do this, I get an error saying "The file received was not valid". I have tired using a different web browser. I have rebooted Jamf Pro, and I rebooted the entire Ubuntu server VM. The Jamf Pro server log does show an error at the time I attempted to import the token. I have an open case with Jamf for this, but if anyone knows how to solve this, that would be wonderful 😊

We are deploying ClearPass OnGuard to our macOS fleet using Jamf Pro. The ClearPass application installs successfully via the Jamf policy, but it fails to establish a connection with the ClearPass backend. Manual installations, however, are fully functional. The root cause has been identified as a missing or misplaced .agent.config file, which is a hidden file essential for the initial configuration and backend communication. This file is present within the ClearPass DMG but is not included in the standard PKG installer.The challenge is to devise a deployment method using Jamf that ensures both the ClearPass installer PKG and the .agent.config file are present on the client machine at the time of installation, allowing the application to connect to our backend successfully.

Hi all,I’ve been unable to find the answer to this one so I’m hoping the experts here will know the answer.I accidentally scoped a policy to all computers with the recurring check-in box ticked rather than just the enrollment complete option. I realised my mistake and rectified it, but now there are multiple pending commands in the policy log. How can I cancel these? Thanks

Hi everyone,I’m in the process of cleaning up a previous school system’s JAMF instance, which unfortunately lacked proper patch management. As a result, there are still devices running macOS Catalina and newer versions.I’m looking for advice or best practices on automating OS upgrades. While I’ll address the specifics of communication with my new manager separately, I’d really appreciate hearing from anyone who has dealt with a similar situation—particularly those without a dedicated team to handle the task.Thank you in advance!

We were configuring our new devices in Jamf pro and it was working fine till August 4th. After that there were no communication between the devices and the server. Any idea why this happened and how to fix?

I use IBM Notifier for most of the popup and notification messages for my user base. Has anyone had any luck using IBM Notifier with a progress bar from a script? I’d like to use a progress bar in a few of my longer running scripts. Would AppleScript be a better option? I’ve used CocoaDialog back in the day but that’s not an option right now.

I've been tasked with finding a way to prevent users from running applications out of unapproved locations such as their Desktop and Downloads folders.  I found a nearly 10 year old thread talking about doing exactly that, and it doesn't seem like much has changed in the years since.  That said, any decade old device management thread is going to be really out of date. Are there any major gotchas I should be aware of while building out the test Restrictions here?  Things like needing to whitelist unexpected directories for Microsoft or Google products?  Should I hold off until the Restrictions payload gets updated to match the modern Jamf payload setup?

I have a script that worked before OS15.5. After updating to OS15.6, the script became abnormal. Even if it connected to the allowed SSID and obtained the IP address, it would turn off and on WIFI infinitely. The following is the script. Thank you for your help~~

Basically we have disabled the screenshot feature for a certain group in my organization via JAMF Configuration Profiles, but recently we have found a loophole for users to take screenshots via enabling the “Show features for web developers” and then on Safari, going to Develop tab and “Show Web Inspector” > Elements tab and right click the html to show the option to “capture screenshot” and it will allow you to save the screenshot. We are trying to remediate this loophole by disabling the option to enable the web developers option. Anyone have any ideas? I have tried using Configuration Profile and using the Application & Custom Settings option, but could not get it to work using the plist I found online.https://www.geeksforgeeks.org/techtips/how-to-take-screenshot-apple-safari/

Has anyone found a way to configure the Canvas app with your schools site? One issue we see a lot of is our users entering in the wrong address when trying to access Canvas. I cannot find any information about configuring it from Canvas so I figured I would see if anyone else found out how.

I'm currently traveling around the globe and using VPN to have a static IP address. Is JAMF going to report my location either by detecting nearby WiFis and matching them to a location or by GPS?I understand that a script can always be pushed to do just that, but I'm asking about the more common default setups.Thank you!