Hey everyone!I'm reaching out for guidance on a complex issue I've encountered with integrating Jamf Pro and Microsoft Entra ID for SSO, specifically regarding user attribute mappings and device enrollment processes. Despite a successful setup of Single Sign-On and Cloud Identity Providers for new macOS device enrollments with corporate credentials, I've hit a stumbling block with more detailed configurations.Core Issues:User Attribute Mappings: My goal is to map the User Name attribute to the onPremisesSamAccountName (essentially, the UPN without @domain.com) for a more intuitive username representation. Additionally, I aim to map Phone attributes to mobilePhone and Position to jobTitle, enhancing user profile completeness within our system.Device Enrollment Customization: During the Setup Assistant phase of Automatic Device Enrollment (via ABM), I intend to pre-fill the primary account information with the device owner's details. However, the system defaults to using the UPN/email fo

I am attempting to use SSO Enrollment through Enrollment Customization, but having issues with getting the desired Full name and Account name (Home folder).The Account name is always the user’s full email address.I am NOT using Jamf Connect. Using Entra ID as IDP. I am using pre-fill from Pre-Stage Enrollment for the user account.johnsmith@email.comThe goal is for Full Name to be John Smith. And Account Name to be johnsmith.I’ve tried checking and unchecking pass through Jamf Pro to Jamf Connect with different attributes. (I know I’m not using Connect, but I’ve been running out of ideas). This always places the proper Full Name and always the the email for the Account Name.I adjust the IDP attribute mapping to change the username to mailnickname. This tests properly and the username appears as johnsmith. It pulls User & Location from my directory properly when I do a search by just the nickname. When I go through enrollment customization though, it still places the full email as th

We’re Trying to force OneDrive to sync Desktop and Documents on our Macs using Jamf. machines aren’t domain-joined. They’re already signed into Outlook/Teams with their work accounts.Here’s what I’m trying to do: Auto sign users into OneDrive Turn on Known Folder Move (KFM) for Desktop/Documents Avoid macOS prompts asking for folder access What I’ve done so far: PPPC profile – I used the correct code signature from the OneDrive app (verified with codesign). Gave access to Desktop, Documents, and Downloads. But the profile fails to apply in Jamf with a status of “Failed”. Script – I’ve got a script that reads the signed-in email from Office apps and uses the odopen:// URL to trigger OneDrive login. It runs, but OneDrive either doesn’t sign in or doesn’t start syncing unless the user manually clicks through prompts. Where I'm stuck: PPPC profile won’t install, even though the code signature looks right. Even if OneDrive opens, syncing doesn’t start unless the user allows folder a

I’ve got a weird issue with MS Defender Configuration Profiles applying/Un-applying intermittently. As part of our enrollment process we install MS Defender and apply Configuration Profiles.  This has been working fine for close to 12months.Now for some reason even though the Configuration Profiles are still applying (You can see them in Device Management).  The configuration doesn’t always apply even when it does apply the settings can stop taking affect shortly afterwards.Device Management still has the Configuration Policies applied.I’ve tried downloading fresh configurations, onboarding etc. from Microsoft with exactly the same result. Has anyone else seen this? 

I am trying to test out Single App Mode so we can fulfill a request a user has when their new Ipad comes in. They want it to only allow access to Safari and not allow any websites except the sign in page they set up. I have been able to restrict other sites with no issues, but the Single App mode is causing me issues. I created a Configuration Policy and selected Safari from the Lock to App drop down. When I scope it to my test group, it does attempt to apply, but fails due to "The field “Identifier” contains an invalid value.". Even when I chose "Specify Build ID" and enter "com.apple.mobilesafari" as the build ID, I get the same error. This happens for all apps in the drop down.I have confirmed the Ipad is supervised and all other settings I set up have applied with no issues. It is just this one thing that will not apply.  Any assistance anyone can provide would be appreciated. 

Suggestions needed for this query...

Hello All,We’ve just started to implement Jamf Pro in our company. Nearly all configurations are completed except sending compliant information to Microsoft Intune. We have to do this because we’re using Azure (Entra) Conditional Access rules in our company. If a macOS device is not compliant it cannot reach internal company resources. Just a simple rule. Steps CompletedJamf <> Intune compliance partner connector connected successfully. Microsoft Device Compliance configuration policy prepared in Jamf Policies -https://learn.microsoft.com/en-us/intune/intune-service/protect/jamf-managed-device-compliance-with-entra-idProblem SummaryAfter enrolling to jamf, we are trying to sign in to Company portal and jamf compliance popup appears. Then we are entering our user account details again but somehow Microsoft login page shows that “get app”. It behaves like Company Portal is not installed. Briefly some of our computers are being Compliant without any problem, but some of others canno

I created an EA to tell me the last time Adobe Acrobat was used. The issue I am facing is that i have gotten a lot of results showing as NULL. From what I can tell this happens if the user has not launched Adobe Acrobat since it has been updated. Any ideas or a better way to report the last time it was used?    #!/bin/bash    # Define the path to Adobe Acrobat    acrobatPath="/Applications/Adobe Acrobat DC/Adobe Acrobat.app" # Adjust path if needed    # Check if Adobe Acrobat is installed    if [ -d "$acrobatPath" ]; then        # Get the last used date using mdls        lastUsedDate=$(mdls -name kMDItemLastUsedDate -raw "$acrobatPath")        # Check if a date was returned (meaning it was opened at least once)        if [ -n "$lastUsedDate" ]; then            echo "<result>$lastUsedDate</result>"        else            echo "<result>Never Opened</result>" # Or a default date like "2001-01-01"        fi    else        echo "<result>Not Present</result&g

I dunno know who this will help out, but here it be ………We normally do screen recordings of macOS enrollments. This does several things for us.We provide it to our Support Team so that they can see the new[er] enrollment flow. Become familiar with it. As it sometimes changes from time to time. We share it out with our Security Team as well. So that they can see the enrollment process as well. In case they have a question or request a change that they would like to change. Lastly, we do it for training as well. We show the process of beta’s [macOS 26b3]. So that the team can see the process & changes that have been made or are coming down the pipeline.This has been & continues to be a helpful tool we continue to provide to our teams. However Apple has made some changes with how this process was done in the past. No matter what I tried we were not able to capture any video output until it got to the desktop. This just sux’d, we could no longer provide this service. Sure we could t

Hi all -Trying to install Adobe Creative Cloud through Jamf School. I have had success with other .pkg files, but the installer file generated from our Adobe Admin Console is opening up like a folder and not a simple .pkg file.I've scanned the posts here for answers. Tried to send it as a zip, tried to generate a file with Compressor. No luck.Anyone have any suggestions? Thank you!

Hi everyone,I’m Ajay Hinduja, a Geneva Switzerland (Swiss) a travel enthusiast who’s recently been exploring Apple device management through Jamf Pro.I’d like to deploy an app across all managed Macs in my environment, and I’m wondering what the best practice is for doing this efficiently. Should I use a policy with a custom trigger, Self Service, or is there a better approach you’d recommend? Also, any tips on dealing with app updates or version control would be greatly appreciated.Thanks in advance for your guidance!Best,Ajay Hinduja, Geneva Switzerland (Swiss)

Since July 4 I haven’t seen any Daily Digests.  Did they get turned off as part of the upgrade to the new JamfNation? 

Hey Jamf Nation!Are you able to keep up with all the content that Jamf Nation has to offer? It’s a challenge to make sure you don’t miss out on all the info and happenings. I’m thinking  the Tech Thoughts Blog, General Discussions, the Events page, to name a few.Make it easy on yourself and click on the ‘Subscribe’ button on the right hand side of any page you follow to get updates when there’s new posts.   

Hi All, I was wondering if it’s possible to push a plist/script to allow Outlook to download external images from a sender. I have seen a thread on here regarding the same topic, but I believe this is to download ALL external images from ALL senders, which is something that we do not want to do. We just want to download from a specific address. Any help pointing me in the right direction would be amazing.Thanks, Chris

Like most JAMF environments, we don't let users be admins on their own box, so when a user gets a new computer that means that they cannot use Apple's Migration Assistant either, so I had to come up with a "homegrown" solution for users to migrate their data instead of having the IT do the transfer for them.  This a constant work in progress, and in no way as comprehensive as Apple's utility, but it works to get the job done.  Feel free to use in your own environment and let me know of any feedback / usability enhancements, etc...  Again...this is not perfect in any way, and always a WIP, so if you use this test, test, test!  Enjoy...   Source Code: https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/MigrationWizard

Many organizations recommend or prescribe a specific web browser for their users. The user can change the setting in the user interface, even though it is not really obvious where to look. Many MacAdmins would like to pre-set this browser and the default during enrollment. However, there are several challenges associated with this in macOS. It would be really nice if Apple provided some means to manage this with a configuration profile. If you agree, please file feedback with your AppleSeed for IT account. While we wait for that, what can we do?   Use the browsers Most third party browsers have a built-in command option to set themselves as the default browser. Most Chromium based browsers (Google Chrome, MS Edge, etc.) can be launched with the --make-default-browser option: open -a "Google Chrome" --new --args --make-default-browser open -a "Microsoft Edge" --new --args --make-default-browser For Firefox, the options are different: open -a "Firefox" --new --args -silent -nosplas

The Jamf 400 course is the highest certification level in the Jamf training program and is designed for administrators who want to deepen their knowledge in scripting and automation. This course not only requires a thorough understanding of Jamf Pro and macOS but also the ability to independently analyze and solve complex problems.    What to Expect in the Jamf 400 Course?  The Jamf 400 course covers advanced topics and practical challenges. Key focuses of the course include Automation and Scripting:   Developing and implementing advanced Bash scripts and API calls to automate administrative tasks.  Prerequisites and Target Audience  To successfully complete the Jamf 400 course, intermediate to advanced scripting skills as well as familiarity with the Jamf API are required. The course focuses on deepening these topics and applying them in complex scenarios.  The course is designed for Experienced Jamf administrators who are already familiar wit

I’ve been silly busy learning lots of non Apple related stuff. However there does seem to be a need for a how to guide of sorts on how to implement Jamf’s new SSO requirements.  Back in the day, you set up a SAML integration from your IdP to Jamf Pro. Access group of users on one side, Jamf user accounts on the other and you called it done.  Jamf is changing how all this works. Instead of an integration per app, they are replacing everything with one OIDC connection from your IdP to their Jamf Account page. Every single SaaS app you then get from Jamf will then already be enabled for SSO, you just have to put the accounts in place. Essentially authentication becomes a once and done and the gating is done on the application side.  Any other speculation as to intent from Jamf here I think is complete hogwash.  This article has a Okta focus, because that’s the IdP I use. Your mileage will vary with other providers.  Before I get into the technicals I do need to po

Microsoft has announced plans to move storage of the Workplace Join Key out of the user’s Login Keychain and into Apple’s Secure Enclave:    Microsoft Enterprise SSO plug-in for Apple devices - Microsoft identity platform    Announced in March 2024, Microsoft Entra ID will be moving away from Apple’s Keychain for storing device identity keys. Starting in Q3 2025, all new device registrations will use Apple’s Secure Enclave. There will be no opt-out of this storage location.  Applications and MDM integrations that have a dependency on accessing Workplace Join keys via Keychain will need to start using MSAL and the Enterprise SSO plug-in to ensure compatibility with the Microsoft identity platform.    In the same document, Microsoft provides guidance on how to test the Secure Enclave today to ensure the change will be compatible with your environment when the change goes live:   If you would like to enable Secure Enclave based storage of

At some point in your career as an Apple Admin, you’ve (most likely) inherited a Jamf instance and said either to yourself or out loud, “Huh, I wonder why they did that. I certainly wouldn’t do it that way” or “That’s not the best practice I was taught”.   Caveat: There’s no such thing as best practice. The better concept is defining the best practice for your environment.   This is where you get to step in and be the hero. It’s your job to take the environment, back it up first. Make sure you backup your instance and sync it to your free Jamf sandbox (If you don’t have one, talk to your rep). Once you’ve backed up and sync’d to the sandbox, I hope you’re noticing the theme here…you can get started with the H.E.R.O. process.   Something not mentioned is the process of writing documentation. DOCUMENT, DOCUMENT, DOCUMENT. Write down everything from the current state, proposed changes, changes you made (with dates), how configs work, workflow processes, and everything else. The 1st thing

Apple Intelligence is finally here now that iOS 18.1 and macOS 15.1 has shipped. However, many people and organizations want to know how they can block it.Apple Intelligence is an Opt-In service from Apple, so unless you Opt-In, there’s no concerns about AI, on or off device.Officially, Apple has provided the following configuration profile keys for the X.1 OSes for the preference domain com.apple.applicationaccess.allowWritingTools allowMailSummary allowGenmoji allowImagePlayground allowImageWandAnd DDM management of Math Notes.There’s also the key allowAssistant to disable Siri, which has become more intelligent with Apple Intelligence.Currently in the X.1 OSes, these are the features which are available and able to be restricted: Siri, Writing Tools and Mail Summary, even though there are controls for the other features not yet implemented.This will allow you to fully block those features. But is that it? …the answer is …No. So even if you implement all the Apple supplied restrictio

I manage several dozen iPads using Jamf Pro.  I have a restriction set to only allow OS updates after they are 30 days old.  Once the 30 days are up, I manually push out the update using the “Download and schedule to install” option, setting the “Force install date” one week in the future and selecting the specific version I want installed.  What I am seeing is that when the “Force install date” comes around, the update is not forced, but the user is allowed to continue using the iPad without updating the OS.  I expected them to be “forced” to update when this date happens.  Does “force” have a different meaning here?  What am I missing?  Also, if I choose “Download and install” it does not force the user to update the OS either.  Thanks for any insight.  I’m new to this world.