We’ve got FUS disabled through a configuration profile, but it appears the menu bar/control center extra bypasses this setting. Users can enable the extra and then use it to switch accounts.Not a major security issue I don’t think, but my org doesn’t use FUS. Is there a way to block specific menu bar/control center extras?

I used the “Defer software update” function so that our users could not upgrade to iOS 26 since it seems to be killing the battery on our phones. However, I wanted to send out iOS 18.7 for security reasons. I was able to send it out via Software Updates but if our users don’t catch the update prompt the first time it is sent to them, they will hit an error, and they can not install it other than going to General > Software Update which we have blocked.I was wondering if anyone has reached a similar obstacle and was able to find the best way to proceed. Thank you!

Hey all,Working on a script that prompts the user for information. Once complete, I set the script to ask the user if they would like to enter another response. If yes, a policy is triggered to call the script again. I seem to be getting an error. I believe it is because you can’t trigger a policy that is already running.I’m aware I can make the loop within the script. Just want to confirm that this is not possible. Has anyone run into this or found another option?

I recently spent some time working on a script to deploy AirPrint printers as we’ve got a few of them on our campus that don’t have driver support from the manufacturer, meaning AirPrint is the only option. I wanted to share what I’ve come up with in case anyone else is in need of this. All you have to do is change the details in the “Printer details” section at the top of the script to match your printer’s IP address, location, and display name. I’d also recommend modifying the PPD path slightly to give it a more specific name than just printer_driver.ppd. Example: break_room_printer_driver.ppd. Note: For this to work, the Mac needs to be on the same network as the printer since it queries the printer to gather the information to create the PPD file. The result is that you can deploy an AirPrint printer to your Macs via Jamf Pro complete with the icon and everything!   #!/bin/bash # Adds a printer via AirPrint. # Author: John William Sherrod - jwsherrod@mac.com # Version 1.0: 02

Students in our School figured out, that Widgets and Focus cancel restrictive Settings you set with Jamf. For example: With an other Focus you can change your Homescreen and use Widgets. If you lock the Screen with an App like Classroom you also can get around the Screenlock by clicking a Widget like the clock.Is it possibly to block Focus or at least Widgets on other Focuses?

I am testing Connect 2.45 and have had a popup appear on the Login Screen.Its a really "Helpful" Popup. All it says is SecurityAgentHelper wants to make changes, and it asks for an Administrator username and password. None of my users are Administrators, so they will not be able to fill this in.Is this a bug? Is there a way to fix it so that it does not pop up? What process is it that wants this access? Thanks Paul  

Hey all,So I know we can use Jamf Connect or even just a script for elevation to admin for a standard user. Has anyone attempted to creating some form script that would require the user to enter a validation code provided for the admin rights before granting rights?The work flow would look something like this, SS policy that prompts for a code. The code would then verify against “something” - maybe an API call. Once it could verify the number it completes the script that elevates permissions temporarily.Im not sure where the script could validate the code from though. Maybe just a parameter that the Helpdesk could enter upon request?Thoughts?

Hello, looking for some help/advice.Has anyone successfully deployed the Dameware Remote Everywhere Agent?Does anyone have a working script they could share?We have created the bulk agent and have the ID, but no success.Thanks for any info.

Hi,Could any one guide on how we can migrate data between two managed macOS devices and same for iOS devices?

Hello everyone, you can probably help me with a request.I created a configuration profile for software updates in Jamf Pro, and I enabled "Automatically install app updates from the App Store" because I always want to have the latest updates for apps installed from the App Store.However, there is one app that I don’t want to update automatically, and that’s Xcode. This app must not auto-update, because newer versions of Xcode don't always work for our developers.I deploy Xcode via the Mac Apps - App Store section. In the settings, I disable "Automatically force app updates", but it still seems to update on its own.Do you have any idea what I could do?Jamf support told me that since it’s an app installed from the App Store, it’s not possible to block automatic updates for that app only.Any ideas?Thanks all

Looking at a JAMF instance that  has this policy that runs once a day on recurring checkin. (scoped to ALL 4K+ macs)it’s just a files and processes: softwareupdate -ad --verboseI feel this policy is totally unnecessary. OS X caches updates BY DEFAULT. I’m watching this in real time on a workstation using jamf policy -verbose and it’s just sitting there doing nothing but burning up bandwidth cycles and preventing software install policies that the customers actually want from ever running.  

Testing out GlobalProtect for our Mac users and running into this keychain issue. We are using a local Certificate for authentication but the machine wants to use the system keychain every time GP tries to connect. The goal is to have the users never have to authenticate or enter a password after the local cert is installed. I have already amended the ACL to include the GP app but the keychain still wants to be accessed. I am also using an administrator account, but still am prompted. If I manually unlock the System keychain from the keychain menu I am still prompted when I try and connect. Thank you for any help or tips someone may have.

Now that Tahoe is out of beta, gremlins that I'd noticed earlier now feel more pronounced.  During Build testing I find myself frequently running through sudo Jamf recon ; sudo Jamf policyBut since moving to the release of Tahoe they’re just painfully slow to report data. It doesn't matter if it’s an upgrade from Sequoia to Tahoe or fresh install via IPSW.  Wired or wireless. ...S.L.O.W…  Is it just me?

A notice in “Other changes” in the 11.20.0 Release Notes mentionsApple deprecated the following keys in macOS 26*, iOS 26*, iPadOS 26*, and tvOS 26*. This change deprecates the Defer updates of settings in the Restrictions payload for computer configuration profiles and the Defer software update setting in the Restrictions payload for mobile device configuration profiles.This is not currently noted in the Restrictions profiles for devices or computers.  They mention using Blueprint builder to manage deferrals going forward.   Time to test Blueprints once we get past the last deferrals  or 26 apparently.  

Is there a better way to update Users chrome app via JAMF? I’ve been using Mac Apps and it’s working for the purpose, however the issue is with the force quit. Sometimes while users are in an online meeting, chrome just force quit to update. I want to force update but not while they are using chrome.

Hi all. AirDrop is enabled for use between our shared iPads. However, when transferring files, the iPads emit a beep, but no notification appears to accept the transfer. Do you have any insights into what might be causing this issue? The devices are running iPadOS 18.3.1.Thanks in advance for your help!

Tahoe now wants to put three default widgets on the desktop in the upper left corner (Calendar, Weather, Photos)  I don’t mind the weather and calendar widgets but the Photos widget will confuse people who are using this machine in a Lab setting. How can I control, remove or disallow them during or after setup?I looked through all the Configuration Profile settings but there doesn’t seem to be any way in the Jamf GUI to address this. Will it require a custom Configuration profile?Thanks!

On Saturday, October 4, 2025, Jamf Cloud Infrastructure will be patched. During this time, you will be logged out of your Jamf Pro instance. The purpose of patching is to ensure that Jamf Cloud infrastructure and the database service are up-to-date, stable, and safe from security threats. Please see the times for our regions below. Hosted Data Region Date Start Time End Time us-gov-west-1 October 4, 2025 0800 AM CT 1200 PM CT  

Important notice: This version is intended only for on-premise environments. Jamf Pro 11.20.2 will not be mass deployed to Standard Cloud environments or posted on Jamf Account for manual hosted upgrades. Today we are releasing a maintenance version of Jamf Pro; highlights include: Resolved Issue Jamf Pro Server: Security IssueJamf provides the CVE-ID for security issues with high or critical severity when possible.[PI141565] Jamf Pro 11.20.2 includes Tomcat 10.1.44, resolving a known security vulnerability in a third-party library (CVE-2025-48989). For additional information on what's included in this release, review the release notes via the Jamf Learning Hub.To access new versions of Jamf Pro, log into Jamf Account with your Jamf ID. The latest version is located in the Solutions section under Jamf Pro.  

I have a Configuration profile to set the wallpaper to the corporate wallpaper, but that give error on MAC OS 26 Tahoe.Any one with the same problem?

Hi,We're starting to see a number of cases being raised internally about some of our Macs (all on macOS 15.1.1) having intermittent login issues.  Our devices are bound to AD and our users have been logging on fine for some time but now we're starting to get issues.  Sometimes the logins are fine.  Sometimes they take ~10 mins and sometimes they appear to stall completely (waited over 2.5 hours in testing) even on the same device.  The login screen appears to freeze (the time doesn't change) and you eventually get the spinning beachball.  SSH is still working and you can run a "jamf policy" successfully.  "Screen Sharing" reports that the user who has attempted to log into the device is the active user when you connect.Can anyone share some tips as to how we would start to investigate this sort of issue let alone resolve it???ThanksStuart

Hi there,I'm looking for some assistance please in coming up with a solution to sharing organisation contacts to 100+ iPhones as read-only.In our current setup we're hosting the contacts on a Google account and have configured the Contacts payload in JAMF with the Google CardDav server which works great, however is NOT read-only, meaning end users are able to add/modify/remove these shared contacts which we do not want...I've faffed around with different solutions such as CoContacts, however am yet to come up with a solution that works. Any assistance is greatly appreciated!!P.s we have no allegiance to Google contacts and are only using it as a temporary stop-gap, but happy to switch to another platform if it will allow for read-only contact sharing that can be deployed via JAMF. Thanks again.

As the subject says, if I have auto update for a VPP app for iOS is set to disabled, new version comes out, app updated on one device, users verify the new version is good to go, how do I send the update to a thousand devices at once?  In our WS1 environment it’s simple, I just select the radio button next to the app and click Update.

I’ve tried testing a few times with Tahoe Beta and now Release and can’t get a Platform SSO to trigger an account creation. I’m tried just scoping profiles to target workstations, adding the profile as well as adding the profile to my Pre-stage.  What am I missing? PSSO works great once an account is created, however I can’t get the Tahoe specific options to occur. 

Has anyone had any luck in blocking the Games app? The only thing that appears under “Restrictions>Apps” is Game Center and that does not block the new app.