We have activated the checkbox in iOS PreStage enrollment that credentials are required.We have set up Cloud Identity Provider (Azure AD) in the Jamf settings.Every time a user now tries to log in to the iPhone setup, the message always appears that the data is incorrect.However, I don't see any entry in the Azure AD log that Jamf has tried here.Now I don't know what I'm doing wrong and what I need to do to make it work.

I am new to JAMF but not MDM in general. We are currently testing our profiles and would like to auto configure the Apple mail app for Office 365. I have created a profile, exchange active sync, with the correct variables and it pushes down to the device. In this case it is an iPad. We are prompted for a password but the app does not auto direct to exchange online for the user to login. Is there a good article on successfully setting this up? I have looked around but articles I have found have been a few years old. I have successfully set up auto config for Outlook and it works just fine. I understand a lot of organizations are moving to the Outlook app but we have a few cases where the Apple mail app is required. Any advice or a nod in the right direction would be appreciated.

need help converting script to user bearer token. script below:#!/bin/bash ## API informationapiURL="https://jamfcloud.com:8443"apiUser=“test”apiPass=“test”1234 ## Get a list of all sites and their IDsallSiteData=$(curl -H "Accept: text/xml" -sfku "${apiUser}:${apiPass}" $apiURL/JSSResource/sites | xmllint --format - | awk -F'>|<' '/<name>|<id>/{print $3}') ## Split out Site Names and Site IDs into arraysallSiteNames=("$(echo "$allSiteData" | awk 'NR % 2 == 0' | grep -v 'Provisioning' | grep -v 'Ground Control')") ## Prompt for a Site selectionchosenSite=$(/usr/bin/osascript << EOFtell application "System Events"activateset siteNames to do shell script "printf '%s\\\\n' \\"${allSiteNames[@]}\\""set namesForDisplay to paragraphs of siteNamesset chosenSite to choose from list namesForDisplay with prompt "Choose a Site"end tellEOF) sleep 5 ## Get the computer serial numbercomputerSerial=$(ioreg -rd1 -c IOPlatformExpertDevice | awk -F'"

I've recently run into the issue where machines upgraded to 14.4 have had all their printers wiped, and are no longer able to add new printers. A few posts i saw online linked it to defender potentially causing the fault with the new os.  Im coming here to see if anyones run into the same issue and/or found a solution via jamf that could be easily sent to everyone on the newest sonoma version.   

I have two connectors, primary and failover that are load balaced.  The secondary is set up with the same server and client certs as the primary and they sit behind an F5.   The both work individually thanks to input from @bradtchapman  I'd like to fire as many CA requests as I can to ensuring timing works.   Is Postman the best option?  It's unrealistic to set a computer up and have it attempt to grab the cert. I don't have access to the CA. How can I send multiple requests to the connector to ensure functionality?

We recently had Apple's APNS support team transfer our APNS cert to a new Apple ID as we had lost the secret questions to the original account. They were able to help, after much paperwork was sent, and it was transferred.When this process was completed for us, we got a different serial number for the cert in the APNS portal, and I am getting worried that is going to break something when I renew it in Jamf. Can someone confirm that the serial number being different on the cert after Apple transfers it to a new account is okay? The topic and Subject DN are the same, but the serial number is different. I really don't want to have to reenroll a bunch of devices. Thanks in advance!

Hello! I am the technology director at a private school currently using Trend Micro Apex One for EPDR and we are looking to make a switch if it can provide us with cost savings or better protection. I am interested in learning what solutions you are deploying that you are happy with. I am considering evaluating Jamf Protect, but it can't protect my Windows devices or servers, so we need to maintain an additional agent.I appreciate any insight on the topic!

I'm wondering if there is a way to bring up a GUI (jamfhelper, cocoadialog, etc) to give a device an already created EA. As mentioned, the EA is created, I just need a way for a technician who is setting up the computer to assign it to the right EA so that it drops into scope for some policies to run based on the EA. The EA I created has the following characteristics: Data Type: String, Input Type: Pop-Up Menu . I then have a few items in the dropdown to choose. I'm hoping to be able to assign one of those dropdown items directly from the computer.

Today we are releasing Jamf Pro 11.3. Highlights include: Account-Driven Device Enrollment for ComputersYou can use account-driven Device Enrollment to enroll computers with Jamf Pro. Account-driven Device Enrollment allows you to enroll institutionally owned computers with Managed Apple IDs, simplifying the enrollment process. Account-driven Device Enrollment requires computers with macOS 14 or later. Viewing LAPS Passwords in the Jamf Pro InterfaceYou can view managed local administrator accounts and passwords in the Jamf Pro interface after enabling Jamf's managed local administrator password solution (LAPS) in the Jamf Pro API. Viewing a LAPS password automatically triggers password rotation according to your LAPS settings. All LAPS events, including password viewing and rotation, are logged.   For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. To access new versions of Jamf Pro, log into Jamf Account&nbsp

It's finally here!Hello everyone! I'm so excited to announce the release of MUT v6.0.0! MUT v6 is a collaboration between myself, a few other Jamf's and even a community member who submitted a PR on Github! MUT v6 includes code from a whopping FIVE (5) contributors now, and resolved eight (8) filed Issues on GitHub. As always with MUT, I strongly recommend trying out a small, test run of just a few devices before doing a massive update to your entire fleet. MUT is a very powerful tool, and while I've done plenty of testing, it is good to be careful, especially with a change as massive as this.Changelog:Added "Classic Mode" fallback when a Group or Prestage update failed due to CSV issuesAdded ability to leverage new API endpoint for enforcing and unenforcing Mobile Device Names (requires Jamf Pro 10.33+)Added ability to update Is LeasedVarious bugfixes and optimizationsKnown IssuesThere should be a more verbose feedback if a user attempts to enforce a mobile device name, but

We are rolling our Jamf Remote Assist and trying to wipe out some legacy Screen Sharing settings we set a while back. I want to disable the ability for our team to use the built in Screen Sharing app to remote into user's computers for support. Looking for a way to script the changes necessary or maybe delete a plist etc? My original code I found on jamfnation years ago to set this up is below:  /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -activate -configure -clientopts -setmenuextra -menuextra no/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -users otheruser,Administrator -access -on -privs -all/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -allowAccessFor -specifiedUsers -privs -all 

Hello Jamf Community,Is there a maximum value for the Integer type of extension attributes?If it exists, what is the maximum value?What happens if you set a value that exceeds the maximum value?Where can I find information about the maximum value?

I implemented the login banner (placed PolicyBanner.rtf in /Library/Security). However, it shows only on logout and not at login. How do I show it only on login? Is there an option to log out if not accepted?

I'm not actually having a problem with something but I was playing around with being able to find a substring from the output of a variable. I can't get this to give me the expected result. #!/bin/zsh proc=$(system_profiler SPHardwareDataType | grep "Chip:" | /usr/bin/awk '{print $2,$3,$4}') echo $proc if [ "$proc" = *"M2"* ]; then echo "M2 processor installed" else echo "unknown" fi The correct result should be "M2 processor installed". I get "unknown".  I looked up how to do this and found this site: https://linuxize.com/post/how-to-check-if-string-contains-substring-in-bash/ After reading that site I changed my conditional statement to match the syntax in the article. #!/bin/zsh proc=$(system_profiler SPHardwareDataType | grep "Chip:" | /usr/bin/awk '{print $2,$3,$4}') echo "$proc" if [[ "$proc" = *"M2"* ]]; then echo "M2 Processor installed" else echo "unknown" fi This works. The only change I made was to use "[[ ]]" instead of "[ ]". I have written a lot of conditi

Hi!Our middle schoolers are 1 to 1 w/ iPads and are able to add apps from Self Service and delete apps not needed. This helps them to self-manage free space on their devicesIs there a way using an app configuration to prevent deletion of one specific app?we already have this box UNCHECKED but it does not prevent the app from being deleted (🫤): “Allow users to remove app (iOS 14 or later) Allows the user to remove this app from a device. The app is not removed from the App Catalog in Jamf Pro.”Thanks!sandy 

While we wait to hear from the vendor, has anybody deployed the Amplify browser extension for Edge and Chrome?  I did find a chat in here to add Nexthink and just modified it to use the code for amplify, but it didn't add the extension. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ExtensionSettings</key> <dict> <key>bmpbcphgifhfkfjioddeenggdpffbgek</key> <dict> <key>installation_mode</key> <string>force_installed</string> <key>update_url</key> <string>https://clients2.google.com/service/update2/crx</string> </dict> </dict> </dict> </plist>

Vulnerability may exist everywhere the shebang '#!/bin/zsh' is being used sans '--no-rcs' Background While the description for CVE-2024-27301 accurately references Jordy Witteman’s macOS Support App, the vulnerability may exist everywhere the shebang #!/bin/zsh is being used sans --no-rcs. Continue reading …

I'm curious as to how many people in this community are using Jamf Protect? If so, are you using it stand alone? Do you supplement it with anything?

We are testing out Jamf Protect and also leverage Microsoft ATP (Microsoft Defender and ATP) currently. Is there any concerns for performance issues with both of these solutions running side by side? 

Was able to do the following while exploring Microsoft Entra Github login option.Has anyone encountered this? Any solutions out there to prevent? 

I need to migrate a user from iPhone A to iPhone B.Both phones are managed and supervised through Pre-Stage Enrollment and both run iOS 16.x.I have tried making a backup of A using Apple Configurator. However restoring to B from Configurator fails consistently.Quick Start appears to run very quickly but does not seem to transfer apps or data. Will they appear after the user logs into iCloud?Is a full migration even possible at all? I see q's from over a year ago, but can't find any migration guidelines from Jamf.Thanks! 

Guys, anybody here done a sustainable software restriction for their environment?I followed some tips here, from old threads, and it basically rotated around the concept of restricting the "installer" app. I understand that blocking software per title would have been the best course, but I just don't see it being sustainable as there could be non-mainstream software that we haven't heard of and they end up getting installed without resistance. To further, we just don't know how much we can restrict per tenant/account, please correct me if I am mistaken.With restricting the "installer" app, I noticed that you can still install apps from Self Service without issues, provided that the said apps came from Jamf catalog or Apple store. If you upload a package and have a policy to install it, then add it on Self Service, the restrictions will kick in. This has been the challenge for us since we have software that are not in the built-in catalogs so we have to install them via policy: Sentinel

Hello,I am trying to configure a profile to lock users laptop screen soon as they close the laptop lid, any help on how to do that?

Hello, I have a lot of mac apps in self service, but some set to install automatically that are used by everyone in the company. This works fine on devices that have gone through automated device enrollment, but when enrolling via user (either URL or email) it does not install these apps. It does get the self service portal, can download some from there, getting the mdm profile, required policies etc. Just not installing apps automatically. Am I missing something? Does this need to be enabled elsewhere?

I've read a previous post that stated to reset the PRAM/NVRAM, which did not work. Here's the error:Things we have tried.Reset NVRAM/PRAMUn-assigned from ABM then Re-assiged. Once completed, renewed the DEP token Enabled Debug Mode,  replicated the issue for about 15-20 minutes. Disabled debug mode and then download the Jamf Pro Server log. Uploaded to Jamf support caseJamf support stated there was an APNs mismatch, but we confirmed afterwards there was not.Ran First-Aid within macOS RecoveryFully wiped the disk and cleanly installed macOSIn Jamf Pro, un-assigned the machine from PreStage, save changes, wait 10-15 minutes and then assigned it back.Jamf support is now trying to say it's an issue with Apple and to contact Apple.Not sure what to do at this point, but I'd appreciate any help.