I have seen various people struggling with this, some claiming it's not possible and Chromium documentation on this particular policy isn't straight forward so here we go... Based on Google Chrome documentation for the policy "ExtensionSettings". The following assumes you've already got the application you'll be pinning installed either via other Chrome policies (E.g. ExtensionInstallForcelist) or manually installed. See the below image what the end result looks like - Pinned chrome extensions (HTTPS Everywhere + MyApps) which can't be unpinned by end-users. Create a new configuration profile. Add the "Application & Custom Settings" payload. Enter the preference domain as "com.google.Chrome". Populate the property list contents with the following: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ExtensionSettings&l

Hey Guys,I have MFA setup in Onelogin for my Jamf Connect app.  The Onelogin activity log shows an error that MFA is set on the Onelogin side. I opened a case with JAMF support and they say that I need the success codes in my PLIST, but they don't know what those should be. I opened a case with Onelogin, and they said that the OIDC standard doesn't support MFA.Anybody have this working? My intent is to have MFA presented upon MAC login.Thanks for your thoughts! 

I'm not having any luck with preventing Teams from Autoupdating. I have script that removes what should be the correct files. I also did the default write command to change. Plist settingsAutoUpdateSettings =     {        DisableCheckForUpdates = 1; Script removes /Library/Application\\ Support/Microsoft/MAU2.0/Library/LaunchAgents/com.microsoft.update.agent.plist/Library/LaunchDaemons/com.microsoft.autoupdate.helper.plist/Library/Application\\ Support/Microsoft/TeamsUpdaterDaemon/Library/Application\\ Support/Microsoft/EdgeUpdater/Library/LaunchDaemons/com.microsoft.teams.TeamsUpdaterDaemon.plist/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper/Library/Preferences/com.microsoft.autoupdate2.plist

I was reviewing my Sign-in's on Microsoft Entra and I noticed that Jamf Connect generates a lot of Sign-in requests.Some of them correlate to when I logged in but I leave my computer on overnight and there were 21 successful Sign-ins while I was sleeping.  I checked a few other Jamf Connect users and it looks the same for them.   I assume this is normal but need some confirmation as it triggers some alerts in our security monitors

Hello , Recently I have a problem with devices , after registrating to Intune everything works fine however after 1/2 days the device disappears from Intune. The object is still visible in AAD however it completely disappears from Intune making the devices lose complaiance.Has anyone had a similar case ?I can't track down the changes because on the Jamf side as well as the Company portal app logs everything looks correct.

Firefox manages certificates separated from the system certificates that are used by Safari or Chrome. To circumvent the issue that users are presented with the "certificate not trusted, add exception" notification, it is possible to add the certificates automated to the users firefox installations by utilizing the following commands: Importing Certificates on Firefox & code snippet for looking for the profile name I know that there is also the CCK utility, but that is also more or less a pain in the a**, especially when you want to maintain firefox installations that are already existing (and have a filled user profile). Firefox now provides the possibility to trust certificates that are stored in the system keychain by setting the key "about:config", "security.enterprise_roots.enabled" to TRUE. Mozilla Help This setting should also be stored somewhere in prefs.js, but i have not figured out how to fiddle around with this file without ruining the user profile. Now my questi

Hello everyone,I have an issue regarding patch management in Jamf Pro.Looking at my dashboard i see the following diagram with many "Unknown Version" that are actually more recent versions : The only action that works is to remove these tools from the patch management page and add them again so that Jamf takes the latest versions into account.This action is tedious, given that Chrome updates itself several times a week (days? :) ).Is there another way to do this and have an updated Patch Management stats for applications ? Thank you very much !!Yoann

Hi,we have distributed a working configuration profile to our macOS Ventura Clients to postpone the Sonoma Upgrade for 90 days. But in the system preferences under software update there is a notification that an update is available even when update list is empty.How can I disable this notification in system preferences?     Thank you!

Is anyone else out there having serious issues with JAMF support right now?I've had a case open since the 27th (I think anyway, who knows what day it is anymore)Aside from asking us for log files - Which as a hosted service they should have access to right?They haven't done anythingThe only thing we've heard from them has been in the form of the two "Emergency Maint" messages they sent out on the 30th of June and then last night.JAMF is one of two vendors I work with where I don't have an account rep's e-mail address and I don't know who my reps boss is (and his/her e-mail address)The only time we get e-mail from a person with a real e-mail address is when it's time to renew.I'm curious as to whether the rest of you long term JAMF customers are experiencing the same thing?

Has anyone come up with a way to schedule a recurring quick/full scan on a system using a configuration profile?

How do you disable iCloud in 10.9?

I have a report showing Extension Attributes of both "Admin End Users Only" and "Admin Users."What is meant by these two fields?  The data on our computer users is not consistent when it comes to users that have admin permissions on the local computer, which is how I interpreted the fields.Thank you in advance!

Edit: Disregard

I believe the issue is with the OS version line (Major and Minor), but I have very little experience in creating scripts. !/bin/sh # Get user logged into console and put into variable "user" user=ls -l /dev/console | cut -d " " -f 4osMajor=$(sw_vers -productVersion | awk -F"." '{print $2}')osMinor=$(sw_vers -productVersion | awk -F"." '{print $3}') sudo -u $user defaults -currentHost write com.apple.screensaver CleanExit -string "YES"sudo -u $user defaults -currentHost write com.apple.screensaver PrefsVersion -int 100sudo -u $user defaults -currentHost write com.apple.screensaver showClock -string "NO"sudo -u $user defaults -currentHost write com.apple.screensaver idleTime -int 600 if [[ $osMajor -eq 14 ]] && [[ $osMinor -ge 2 ]] || [[ $osMajor -ge 15 ]]; then sudo -u $user defaults -currentHost write com.apple.screensaver moduleDict -dict moduleName -string "iLifeSlideshows" path -string "/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex" typ

Hello everyoneI have a requirement to send notifications programmatically to iPad devices within a Smart Security Group at specific times every day. Unfortunately, I couldn't find a straightforward method in the Jamf API documentation to accomplish this task. In contrast, with the Microsoft Graph API, achieving this is quite straightforward.any suggestions?

I've managed to get Cisco Secure Endpoint and Umbrella deployed through Jamf Now but I need to make it so that the end user can't disable it. I also need to make the install seamless, so that when the application is installed, the user doesn't need to do anything like allowing the extensions or give it full disk access. I tried to make a custom profile thru iMazing Profile Editor but can't find the settings to allow something like this. Does anyone have ideas/experience with something like this?

I have software that a teacher purchased for her classroom.  I'd like to be able to install it to her classroom mini's through jamf.  It's a dmg file and I believe I have to convert to a pkg file in composer.  Can someone point me in the right direction?

I have an environment where network users are logging into lab machines with Jamf Connect which creates a local user account for them, but when they go to use some apps for the first time the apps ask for permission to access common folders (Desktop, Documents, etc) and this can cause a problem because if they for some reason click Don't Allow when the app requests it then this has to be manually fixed by an admin ... and in the case of some apps like Adobe Premiere Pro the app won't even open if access to those folders is denied.Does anyone know of a way through Jamf of setting these app permissions for users when they sign in so the apps don't have to request access when the user first opens them?Thanks in advance.

Hello All,I'm still learning JAMF so I apologize if this is a basic question, but I would like some help with figuring out the best practice in order to manage multiple locations on Jamf Pro. My IT team is in charge of taking care of users in California along with users in England and I am trying to find out what is the best practice in order to do so. For example, people in England might need to have access to different applications, or if we needed to modify our Zero Touch Deployment for them, we would like to keep it separate from our California side.I have looked into using Sites that is offered within Jamf Pro, but I hear that this is not the best way to go about this. 

I apologize if this has been asked and answered or documented somewhere, but I've looked and can't really find my answer.  I'm looking to change the distribution method for an app from Install Automatically to Make Available In Self Service. I know how to do that, but my question is what will this do to devices that already have the app installed? Will the app be pulled and require them to download it, or will it remain on device? Thanks!-Matt

I am trying to create a policy in Self Service that is scoped out to all devices, but is only accessible for a certain local admin account to install/run. When devices are enrolled, a default local admin account is automatically created and we do not use LDAP, so I'm trying to find a way to limit this policy from being run by unauthorized users. Is there any way to accomplish this? Or is there perhaps a way to require admin credentials be entered before the policy can run?The policy works great when I scope it to a test device, but as soon as I add the local admin account to the limitations, the policy is removed and disappears from Self Service. 

So with iOS 17, we've seen in the field that updates actually work as intended now! So what do I mean by that? Well, this is our observations:1. Admin uses the traditional method of sending a mass-action command do a device to update to the latest version, with download, install and reboot2. The device receives the command and downloads the update3. The next time the user unlocks it, it will require the device PIN regardless if you have touch-ID or not, presumably to get the PIN to allow software installation4. Then the update is scheduled overnight5. During the night, regardless if the device is connected to a charger or has usufficient battery charge, the update will install and the device will reboot This might seem like a no-brainer and obvious. However, this didn't work pre-17. Then users weren't prompted for a PIN at all, or they were prompted but could dismiss it. Update would fail to install overnight etc etc. In essence, what a huge positive change!Is it just me or is thi

Hello to all,I hope everyone is well in the community :)I have a recurring problem with macOS Ventura :when I upgrade from macOS Monterey to Ventura, a minor update or when I try to register a Mac directly, after restart, I get a blank screen with a wheel that spins without stopping.I have the impression that it is the Form of Address window that wants to be displayed, I only have the "back" and "continue" buttons at the bottom (they do not work).When I restart the mac, everything is fixed, I can authenticate and work again.Has anyone encountered this problem before?Thx for your returns

Hi is there a way to push certificate and "Trust" it via JAMF School? I am currently installing it manually and need to select "Always trust.    

Hello all,    I've tried difference scripts (bash and AppleScript) but none seem to work for me.  Basically, (and I see this has been asked a lot but varies), I would like for any user that logs into the Macbook, connect to their smb share AND place that drive as a shortcut in either the Locations (in Finder) OR Desktop.  Users should not be prompted for their username and password.  Here's what the smb path looks like:smb://servername/Userdata/UserName/My%20DocumentsWhere UserName can be any user that logs in to that Mac device.  But do not prompt for username and password if possible.  If password is a must, then I'll take whatever I can work with.