Hey folks! Dropping in for another quick Self Service+ post on how to: determine available URL schemes for a macOS app (in this example, Self Service+.app) how to map policy URLs from Jamf Pro to the new schema and have the actions load within Self Service+ The Self Service app has historically supported URL schemes to automatically run a policy or open the app directly to a description of a given policy. Within the Self Service settings of an app policy in Jamf Pro there are installation and description URLs provided. Those URLs tie into URL schemes for the Self Service app, and can be launched in scripts and by sharing them directly via link. For example, running the simple Terminal command open "jamfselfservice://content?entity=policy&id=392&action=view" one can launch Self Service classic and deep link right into a policy and view the description. Self Service+ also includes this functionality, though the URL schemes are not displayed in Jamf Pro for pol

Hi I’m trying to set a wallpaper for Apple Tvs in a school. I’ve set a configuration profile which locks the Apple TV in the conference display mode. I’ve also created a smart device group where i’ve uploaded a test jpg file, but it doesn’t want to pickup the wallpaper. Does anyone have have suggestions?

Hi, I want to deploy an initial default Dock layout after enrollment is completed, where the end user can later change it to whatever suits them.I’ve heard of multiple methods, such as using Dock items in Jamf Pro settings, scripts, Outset with docklib, and dockutil. I was wondering what the easiest and most hassle-free approach would be as an MDM administrator. Thanks in advance.

Before we get too far into this I want to say one thing. I am not a medical or mental health professional. I’m a Jamf Engineer who has thought a lot about this but by no means am an authority on the subject. The following article is my reflections and not any type of mental health treatment. Now that that’s out of the way…here we go! Nobody goes to school to be a Jamf Engineer or Admin. The vast majority of us ended up in this field because we like to tinker with things, eventually break them and are forced to fix them without any help or education. For a lot of us, we ended up in this field by doing other things in a job where we do have formal training.When you fix what you’ve broken, you feel great. But when you can’t fix it, some of us give up, others seek advice, some keep plugging along to find the solution.  But what happens when you end up in a corporate environment and you have to tackle things that you inherited, need an upgrade or you just need to do maintenance, most of it

We are having problems with apps signing out  each time our students try to to use them on their iPad. They sign in with Google Single Sign on or use the QR code. As an example our students use the IXL app, sign in with google sign in and the next day they are signed out again. Does anyone have this problem or have solution on if something set in JAMF School would be able causing this problem?

Hi everyone i'm trying to understand the best way to configure Jamf Protect with our jamf instance. I set up a smart group in jamf to alert users about security issues and that works fine. Unfortunately the jamf protect documentation is a bit incomplete imho. What are the next steps i need to follow? Any suggestion or guide to suggest? Do i need to manually remove the mac from the smart group? Jamf Protect has some removing capabilities or i need to clean the mac manually?

Took me awhile to discover this and could not find a solution anywhere in Jamf Nation so thought I would post my solution I used. I have several Extension Attribute scripts that require a user to be logged in (including 2 provided by Jamf Onboarding, Jamf Connect First Run and Entra Registration statuses). Problem is if Inventory Update runs when no user is logged in (yes, this happens) the script does not detect current user so it cannot access current user folder to check plist file so it updates the EA to Not Found losing the Entra Registration completed or Jamf Connect First Run Completed (or any other EA that uses user directory).I created a script to detect if user logged in and if not to use a cached status created/updated from previous run when a user was logged in. Hopefully this helps someone else or someone else has an improvement to it: #!/bin/bash# 1. CREATE EA CACHE# Set this to match your EA name exactly (avoid spaces if possible)EA_NAME="EA_Name"# Create a dedicated hid

AI is moving fast. We want to know where you actually stand. Four questions, under three minutes -- your anonymous answers will shape how we think about what matters most for Apple enterprise IT and security teams right now. Take the survey here: https://www.surveymonkey.com/r/jamfaipulse26

Any on know how often is the built in Jamf External Applications repository updated in Jamf Pro?Also is Jamf pulling these from https://github.com/Jamf-Custom-Profile-Schemas/ProfileManifestsMirror?I noticed com.microsoft.autoupdate2.json was update on the github Feb 17 2026 but is does not seem to be updated in the built in Jamf External Applications repository (still says Revision: 2024-12-13)  

Hello all you Jamf Rockstars,I was building a new package and decided to add the script I needed to run at the end as part of the package instead of a separate component in the Jamf policy.  When I tried to deploy it I got “Installation failed. The package could not be verified.”Turns out this can happen when Gatekeeper rejects the package because the package is unsigned, and included a postinstall script.Composer has a setting for signing packages, I do not have that configured.  There is also a field for “Default Bundle Identifier” under the advanced tab. Is anyone signing their packages?  Do you use a third-party cert?Are you populating the “Default Bundle Identifier”?  Thanks in advance,-Pat

With the update of iOS 26.4 there is now a prompt for age verification in the UK for content. Most of our managed phones do not have apple id’s associated with them and all apps are distributed through self service. Is there a blanket way to say all the phones are with users who are over the age of 18 to avoid having to deal with many service tickets.

Hello,I am trying to update our method of deploying out the essential sounds for GarageBand through Self Service. In the past, I had leveraged the Carl Ashley AppleLoops script (it worked great!). After Apple removed Python from the base installation of macOS, I had been limping along with installing Python on the devices that were needing the sounds. This has posed other complexities.Currently, I am testing out installing all of the sound packages needed for the Essential Sounds from a cached copy of those packages on the laptop. This has not produced the desired results yet. The user is still prompted to install the sounds when launching GarageBand. All of the sounds that should be available from the Essential Sounds are present in GarageBand. The loops have also been reindexed in hopes that would resolve the issue.I would appreciate any help that anyone has to offer.Thanks!

Has anyone successfully implemented Epic Bedside using JAMF? I have the MyChart URL but anything after that I am lost. If so I could use some help with the AppConfig for Bedside. Epic has not been much help and our Epic team is not familiar with the values needed. Here is the only information Epic sent us. Work with your MDM representative to pass your MyChart server URL to hospital-owned tablets so the tablets can be activated with a numeric code. The MyChart Bedside application must be updated to version 10.9 or higher to receive the server URL. Pass your MyChart URL to the Bedside tablets. The exact setup to include the MyChart URL in the managed app configuration varies, so you should refer to your MDM system's documentation to determine how to provide the configuration value. Add the Configuration Key of MyChartURL to your sent configuration options. Set the Value Type as String Add your full MyChart Server URL (e.g. https://mycserver/MyChart-instance/) 

I'm trying to configure the app request for our iPad users but I'm not seeing the App Request option in the Self Service app.  I'm testing this on myself. So far I've... Created a static group and added myself to it In Settings > Self Service > App Request App Request Form > Checked "Enable App Request in Self Service for iOS" App Request Form > Added some request form fields and set the App Store Country/Region Requestors and Approvers > Set the Requesters to the static group Requestors and Approvers > Added myself as an Approver Email Address In Settings Self Service > iOS General > InstallType = Automatically install Self Service app General > Checked "In-house app updates" General > Landing Page = Home App Options > User Login = Allow users to log in to the login menu Signed into the Self Service app on my iPad   What else am I missing?

Hello all,   I am working on deploying the updated company wallpaper.  Current attempt is using the script below, but it gives the user a that “Jamf wants access to control Finder...” (screenshot attached). Maybe there is a better way to do this. #!/bin/shcurrentUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}')sudo -u "$currentUser" -H osascript -e 'tell application "Finder" to set desktop picture to POSIX file "/Library/DesktopWallpaper/backgroundDefault.jpg"'exit 0 

Update your iPhones and iPads right now’'Darksword' exploit just went global: Millions of iPhones now wide open to hackersiPhone exploit DarkSword has been released in the wild | Mashable

Hi, everyone!We are in the “Pilot” stage of our Self Service+ deployment.  For the most part everything has run smoothly while deploying as a policy to our “test” group and our “pilot” group.  I scoped the policy to our “pilot” group on 3/23/26 and did not receive any reports of any strange activity or concerns.  However, this morning, three different users reported seeing a Self Service+ pop-up when they logged into their machines for the start of the work day.  When my colleague and I were testing this policy on our test machines, we did not see this pop-up or anything else happen out of the ordinary.  I know that this is considered  “expected behavior” but, I would like to figure out why it has only happened for three spereate individuals and no one else (as of yet).Has anyone else experienced or heard of this pop-up occuring on there end?  TIA!-Michael G.  

• https://support.apple.com/en-us/100100• iOS - 30+ CVEs patched• macOS - 70+ CVEs patches

I'm trying to upload a signed config profile and I keep getting "Unable to create object from file." It worked a few months ago, but I had to change the name. I changed the UUIDs, there is no duplicate named profile and the unsigned profile uploads fine. I tried both a couple signing certs I have in Xcode as well as creating a signing cert using these instructions.I can install the profile fine locally:We're running 10.41.0-t1661887915 in the Jamf cloud.

We have configured Jamf with Nudge. The action button Update Device launches the Self Service policy for the minor update of the current OS. However, with Self Service+, this does not work. The Self Service+ app launches, but the policy never begins. It simply spins. With the old self service, it works without a problem. This is a bit of an issue because it then becomes more difficult to enforce compliance with Nudge. Anyone has a solution? Thank you.

Hello, We have had "device compliance" for MacOS configured since August 2024 and it appears to be working correctly. I just enabled the iPadOS/iOS option and the test device appears in the Device Compliance = Compliant smart group in Jamf but continues to show as "n/a" for compliance in EntraID. It's been half a day and the EntraID compliance status has not changed. How quickly should the compliance status get updated in EntraID and is there a way to sync Jamf with EntraID to update the status? Is anyone seeing this work successfully?Thank you. 

Hello For those running MacOS 26 how are you deploying background security improvements?Blueprints doesnt seem to understand the format. https://support.apple.com/en-gb/111333I could find anything in Jamf blueprint documentation either.  thanks

Hi Team,I’m evaluating a potential integration between Jamf Pro and a third-party Threat Intelligence Platform (TIP), and wanted to validate feasibility from a technical/partner perspective.The TIP APIs provide: Stream of malicious IOCs (IP, domain, file hash, URL) (Usually need to run on schedule) On-demand IOC reputation lookup (malicious/suspicious/benign) File and URL scanning capabilities Planned approach: Integration will rely only on Jamf Pro APIs (no agent/kernel-level extensions) Key questions: Can Jamf Pro workflows leverage external IOC data to trigger actions on managed devices? Using Jamf APIs, is it feasible to: Enforce blocking of malicious domains/URLs via configuration profiles or policies? Act on files (e.g., remediation based on file hash via scripts)? Trigger automated responses (policies, scripts, device lock/wipe) based on external intelligence? Are there any recommended patterns or limitations when integrating external threat intelligence fe

I am using Jamf Pro with Google IdP, Enrollment Customization, PreStage Enrollment, and Single Sign-On. However, no matter what I try, when I enroll a device the fields populate as:Full name: Firstname LastnameUsername: firstname.lastname@emailaddressWhat I want instead is for the username to be first.last.I created a custom SAML attribute that maps to firstname.lastname, but I have not been able to get it to work. I’m not sure what else to try.Is it possible to have the home directory set to first.last instead of using the full email address?When I use $FULLNAME and $REALNAME in Enrollment Customization and PreStage Enrollment, the auto-populated information during device enrollment becomes:Full Name: Firstname LastnameAccount name (home directory): Firstname Lastname Not using Jamf Connect

Hello all you Apple Rockstars!I just noticed that there’s a whole reward system you can redeem points (“bytes”) for stuff.  Very cool.  Ivanti used to have something like this called Insiders, but the reward system was abruptly discontinued while I had lots of unspent points.I’m not sure I fully understand what actions get points, but it looks like you get 5 points for the first posting/replying each day, and then a single point for each subsequent post/reply.Doing some quick math:  If you want to get to 500 points, that would take you 100 days.  Assuming  you only did 1 post/reply a day, on normal workdays, thats 20 weeks.Does that seem like an unreasonable amount of effort to get a tech mat or whatever?I know they are doing this to stimulate customer engagement, but I think they would need to get more generous with the points for people to participate more.What do you think?Anyone had experience with redeeming points?  I’m not sure how long this has been a thing.