I am in the middle of deploying a centralized Jamf Pro instance for a large disparate organization. We're talking 5 business units with multiple sub-organizations, ultimately leading to well over 150 different Active Directory forests with no trust between them. So, 150+ separate LDAP directories. We currently have an Okta integration that is being "fed" by these 150+ ADs, and while the Okta implementation is not the identity authority, it has every end user in it. We are standing up our infrastructure for the Jamf Pro instance in AWS. We have no connection back to our corporate networks (which do not necessarily have communication with each other), and there is no plan to do so or to implement a VPN of any sort in AWS. So basically, AWS is its own island. Rather than stand up 150+ instances of Jamf Integration Manager, I was hoping we could utilize our Okta integration to handle LDAP queries for the types of information we need in Jamf Pro. So Okta would become our LDAP source for

I'm trying to follow the documentation for deploying SwiftDefaultApps in order to make Outlook the Default Mail Reader and Excel the default app for CSV files for our production fleet of over 300 MacBook Air M1's.I'm using GitHub - Lord-Kamina/SwiftDefaultApps: Replacement for RCDefaultApps, written in Swift. for material.  I am also referencing this article for deploying a script via policy Configuring a Mac’s Default Apps for Different File Types | apizz (wordpress.com). Here's my dumbed down verison of the script from wordpress:#!/bin/bash# Set default apps for usersSWDA="/usr/local/bin/swda"MAIL="/Applications/Microsoft Outlook.app"SHEET="/Applications/Microsoft Excel.app"### MAIL #### Default mail client$SWDA setHandler --app "$MAIL" --mail# mailto: links$SWDA setHandler --app "$MAIL" --URL mailto# message$SWDA setHandler --app "$MAIL" --URL message# email$SWDA setHandler --app "$MAIL" --UTI com.apple.mail.email### FILE TYPES #### .csv$SWDA setHandler --ap

Hello All,I am looking into ways only to allow external media to be written to if encrypted. It seems to have been deprecated using Jamf Pro. Is there a PLIST file I can edit or a terminal command I can push to make this happen?

Hello,  Hope all is well. I was wondering if it's possible to get some assistance on this issue I came across. I am new to Jamf PRO. My Team Lead gave me an assignment to push Rapid7 automatically to MacOS devices in Jamf Pro. I've watched videos and read documentation but still a bit confused and was wondering if I could get some help.

I already posted a somehow working, but solving it only in a quick and dirty way, script for this.But over the course of the last few weeks i finally had some time to create something that worked a bit better and allows some troubleshooting.Before using this keep in mind that it needs some Prerequisites fulfilled to work (all of them are also listed in the script) and you need to change line 34 to have your JamfServeradress in it. Beside this if you already switched to Bearertoken Authentication you need to do some changes to the setextensionattribute function to get a BearerToken and constructing the API-Call including it.Prerequisites are:1. Known Adminaccount from PreStage2. API-Account with enough Privileges to write Extension Attributes3. 2 Policies, first one to delete the Adminaccount (Customtrigger: accountdeletion) and a Second one to recreate it (Customtrigger accountcreation).4. EA named autobootstrap (if you use a different name you need to change it in Line 36)This script

Hi Nation, I hope everyone is well today. I am wondering what you guys do with Dev environments? I need to look at a way to control a dev environment, separating daily work like emails and chats against a development environment. I need to introduce the latter in a way that is still controlled but allows the developer to run code and install tools. I was thinking if introducing a Parallels VM with macOS and forcing isolation. Then giving the developer access to tools through Self Service and allow them to make themselves an admin for a limited time, following a helpdesk request. I know this will not go down well, but its what is needed. I am wondering what strategies you guys have implemented around this bearing in mind it needs to pass external security audits and certifications.ThanksBob from Reno

Currently have an issue when trying to add new deployments of apps within Jamf App catalog.When trying to deploy any app does not show me the status of the deployed app. App prior to last week Friday deployed, and I do see the status. Any app added since Saturday does not show me the status.For example, I tried deploying Outlook. Once deployed, I received the message. I have tried removing and re-adding the app a few times this weekend with no luck. 

In today's world of Mac's we have a hodgepodge of Intel, M1 and M2 MacBook Pro's. I have several policies that install different software with PKG files that have run fine without any issues because, until we started to buy M2 Mac's.All of the policies/packages that fail to install all have errors relating to Rosetta 2 not being installed, despite it actually being installed on the machines. I even went as far as putting a script to run prior to the package install that installs Rosetta 2 that returns a successful install log. When I manually install the exact same package files on the M2 Macs they install fine without error or mention of Rosetta 2, which confirms that it is actually installed. It is only when Jamf installs the PKG file on the M2 that it fails because of Rosetta 2.All of these same scripts and package policies run fine on M1 Macs. All of our Macs are running MacOS 12.5. The only difference in the Pass vs Fail is processor type.  Executing Policy Xerox 5.

I'm willing to try this on my own, but after the struggles we encountered getting our JIM working in the DMZ I wondered if anyone had attempted this successfully before I go down the rabbit hole. Do you have your JIM and your ADCS on the same server/system? In the DMZ? Working reliably? Any caveats I should look out for? Thanks!

Hey all, we have the SCEP running with a configuration profile and the challenge type is static. That's working for us.But we want to change the challenge type to Dynamic-Microsoft CA When changing it to Dynamic-Microsoft CA, we run into the known PI-005716 and the config file stays on pending. Does anyone has an idea, what needs to be done to make the setup running with the dynamic setting? The configuration on Jamf is easy going forward for me. But do we need to change also a setting on the CA? I can't find any documentation on that.

HelloI would like to ask if there is a way to "scope" the Jamf Pro admin interface? To give some context, we have Support teams in several countries and we will have them do basic Mac management soon. However, I would like them to be able to see only the Macs from their specific countries, and not the others. Thanks 

Hi AllWhy is itn't possible to mark iPads and change/rename directly the AssetTag over the Jamf Portal?Nice RegardsPeter

(Please pardon the piecemeal post; I'm presuming partial information is better than nothing.) scheduleOSUpdate via the Jamf Pro API Thanks to AppleCare pointing out that: When running the softwareupdate command in a root shell on Apple Silicon users are being prompted for a password. This is expected behavior and the recommendation is to use the Schedule an OS Update command via MDM. This is the method to use if you want to update Apple Silicon Macs without requiring user credentials. In other words: if [[ "$arch" == "arm64" ]]; then scheduleOSUpdateViaAPI else /usr/sbin/softwareupdate --install --all --include-config-data --restart --force fi In my limited testing, users are still prompted: Pending Feature Requests @psliequ's Support the entire range ScheduleOSUpdate MDM commands for macOS Snippets #################################################################################################### # # Variables # #############################################

Hi AllWhat is the reason, that it not possible to choose and add Apps over the smart groups? Why is it necessary to go over the groups? And if when I will like create a group, than is possible do choose over checkbox all my Apps.It is such a hassle to select each app individually and add the group. Why is it not feasible, like import a csv file?Any ideas? Best RegardsPeter  

I need to know how to reset the User Template Folder to delete all files distributed under the JamfPro policy.thank you

Hello Jamf Nation!We are excited to announce that the Jamf Connect 2.13.0 beta is open for enrollment. Important changes of note:As of this beta release, 2.13.0, Jamf Connect requires macOS 10.15.4 or laterIf a computer with macOS 10.15.3 or earlier is in-scope for updating to Jamf Connect 2.13.0 or later, version 2.12.0 will remain installed and functional instead of updating to the latest versionUI updates to local login fallback for OpenID Connect-based identity provider integrationsUpdated tenant requirements for Microsoft Azure AD app registrationsIf your identity provider is Microsoft Azure, upcoming changes to Microsoft Authentication Library (MSAL) require changes in your Jamf Connect configuration. Existing applications remain functional, but in December 2022 Microsoft will discontinue security updates for Azure Active Directory Authentication Library (ADAL), deprecating the use of common endpoints. To align with these changes in Jamf Connect, you must include organizatio

Just checking to see if anybody is using Autopkgr with jamfuploader. Trying to cut down on some steps for our 3rd party updates. I'm able to setup up some recipes to upload them to jamf and add them to a specific category, but the portion to add it to a policy is a little confusing. 

 I have moved away from jamf connect for some of my devices but cannot seem to stop jamf connect from downloading with self enrollment profile. I’ve removed the package from jamf pro and disabled config profiles and policies. What am I missing from preventing it to download with mdm profile ?   

hi there, I enabled the notification for my account which has my email. I enrolled a laptop twice and it went through prestage imaging/ enrolling. However it's been more than an hour since it enrolled and still no email. Wondering if anyone has thoughts? 

Today we released Jamf Connect 2.25.0. This release includes the following changes and improvements: Configuration Support for Okta Identity Engine You can now authenticate via the Okta Identity Engine in the Jamf Connect login window and menu bar app configurations.  OpenID Connect Authentication Support with OktaYou can now natively configure Jamf Connect to use the OpenID Connect protocol rather than the Okta Authentication API or manually setting up Okta as a custom IdP. Other Changes and Improvements Offline MFA for the Jamf Connect login window now supports cloud account aliases alongside local account usernames. When a user unenrolls from offline MFA, enrollment status in the com.jamf.connect.state preference domain is updated. The Jamf Connect login window no longer appears unexpectedly during Apple's Rapid Security Responses. Additionally, the Disable RSR Watcher (DisableRSRWatcher) key has been added to the Jamf Connect login window which enables the login window to re

Hi All,We've managed to setup Okta LDAP as an LDAP server for Jamf PRO and it shows correct in tests.We've been wanted to setup an Extension Attribute for computers based on the LDAP group membership of the relevant user.But no matter what we do (we use the memberOf or uniqueMember attribute) it won't show up with any value.We also have JAMF Connect if that's relevant but I haven't been able to populate the UserGroups field in the state plist no matter what I do either. At the end of the day we are trying to limit policies based on LDAP groups - and while we manage to setup the rule, no Computer/User is assigned to the group. Any and all help would be greatly appreciated. Also let me know if you need any more info.

I wanted to reach out to this forum to see what you all are planning to do when Jamf Remote goes away. As a large K-12 enterprise, our campus tech's rely on Jamf Remote's ability to push commands to devices WAY more than they do the ability to screen share. Our users aren't administrators on our machines, and we don't use localadmin accounts, so SSH-ing into a machine is also not in the cards. We're going to be in quite the pickle.I'd like to know how others plan to address this, and if there is anything out there than can leverage JAMF remote's abilities that perhaps we don't know about.

Hello,I am a new Jamf admin and running into an issue hoping the community can lead me on the right direction.Objective: Accounts that have a security group SG-Developer will need to be admin and everyone one standard.Current Configuration.Prestage EnrollmentLocal account User- SkipJamf connectConfigured to authenticate with Google IDP with MFAScript is configured with the following. <key>CreateAdminUser</key> <true/><key>OIDCAdminAttribute</key> <string>SG-Developer</string>Issue:So, everything works except the admin part after a restart.The account will be created as admin but when restarted its set back to standard even though the user is part of that security group SG-developer. Any assistance would really appreciate it. Thanks, you! 

There are a bunch of privileges settings under server actions in group privileges that I can not find any documentation on exactly what they do. Does any one know or can you point to me to where this is documented?The privileges are:Send Local Admin Password Command Send MDM Check In CommandSend Set Recovery Lock Command View License Serial Numbers View Local Admin Password View Local Admin Password Audit History View Recovery Lock  Allow User to Enroll Send Application Attributes CommandSend Computer Unlock User Account Command

I'm new to jamf.  We have a classroom with old imacs that are being replaced.  I need to get them out of jamf before they go to recycling.  Id also like to wipe them.  What is the proper process for doing this?  Any help would be appreciated.Thank you