Hello Jamf Nation,I had Jamf Connect configured to create the local user account as Administrator if the Azure AD user has the Admin role assigned in the Jamf Connect Azure AD enterprise application. This worked like a charm until we introduced an enrollment customization with Single Sign-On Authentication (with user information passthrough enabled).Now the user first has to authenticate with Azure via SSO before confirming the password once more in the Jamf Connect flow which then creates the local user. Although the user has to enter their password twice, the added benefit is of course the automatic "registration" of the user to the computer object in Jamf Pro.However, as the title of this post indicates, it seems the 'roles' attribute is now ignored and the local user is always created as Standard.Is there a way to benefit from the enrollment customization without losing the user roles functionality?PS. Using Jamf Connect 2.27.0.

I was looking at the list of Macs registered to JAMF in my company. Some get lost in international transport or are stolen etc.This can sometimes be verified by looking at the last IPv4 it used - if it is miles away I lock them with a PIN with a polite request to contact me.In this instance though, there was no record of the serial number logged in our hardware database - I locked it just to be sure.The person in possession of it has contacted me (months after I locked it), to tell me he cannot use the Mac. It turns out that he is a business partner but no reference to this was logged in JAMF.I gave him both of the two 6-digit codes I use to lock machines. Neither are being accepted.Can the activation lock bypass code (9RV5C-xxxxx-xxxx-xxxx-xxxx-xxxx) in JAMF be used to override this (by the user booting to the recovery environment and entering the code). MacBook Air (M2, 2022), macOS 13.2.1I don't want/need the user to wipe everything on the hard drive etc. Can he then just resta

We retired 200+ macs this summer.  How can I mass delete them from Protect? Doing it one at a time is not a viable use of time.

Hello all is there a script out there or a EA that can show us all users computers that are locked in JAMF? is it possible to create a smart group for this sort of request?

In my current tasks, have a challenge to find the way to detect all browsers installed on the JAMF Pro administered devices, do you have any idea about do it possible?.Regards,MR

Hello,I would like to know what the proper way is to reset a device while still keeping it under management.I have a MacBook that was added to ABM using Configurator 2 and was prestaged and is now managed in Jamf Pro. It has several policies and packages installed. Now, I want to take the MacBook back from a colleague and send it to a new colleague. He can then start with the MacBook as if it's new (=PreStage). It's important for me that the device is not removed from ABM, because everything is managed remotely.Should I simply click on "Wipe Computer"? Will the MacBook rerun the policies, etc., if it's still in scope? Or do I need to take further steps, such as flushing all policies for that MacBook?Best regards,Floh

Hi All, We have a deployment Policy for Epic Games Launcher however the App updates itself so frequently and requires Admin Access to complete the Update. My team and I are wondering if you have ever come across a way to trigger this update silently or get the app to auto update? I want to note that myself and my team are new to Jamf and to working with MacOS. Any assistance or help would be awesome - thank you in advance

Hi Jamf community! I have a need to configure the settings below globally on our fleet of iPads. I am hoping someone has found a way to do this as doing it manually is not overly appealing! Settings > Camera > Formats - Most Compatible Settings > Photos > Transfer to Mac or PC - Automatic Camera - disable live photos Any info would be great!

Looking to figure out a way to see how many laptops have not restarted or shutdown in awhile. Running into teachers that just do not shut down at all or restart. Thanks 

Starting in late August, a new version of JCDS will be released. To minimize potential disruption, you may need to make changes to your network configurations or third-party tools and plug-ins. For information about new domains, see the “Outbound Traffic from the Jamf Cloud Distribution Point“ section of Permitting Inbound/Outbound Traffic with Jamf Cloud. The new version of JCDS will include performance enhancements and stability improvements. Additional details and will be published in the Jamf Cloud Distribution Service (JCDS) Release Notes in the future.

We're noticing with our Apple Silicon Macbook Airs that the wifi sometimes goes on the fritz after the device sleeps, in that it refuses to connect to any network until rebooted.If someone is aware of a fix, please let me know, but we've been trying a few things and seem to be able to mitigate it by changing System Settings > Battery > Options > Wake for Network Access setting to Never. I'm not sure if this actually solves the issue, or if it's just coincidentally helping, but I'm wondering if we can set this from Jamf.I found an option in the Energy Saver section under Configuration Profiles called "Wake for Ethernet network administrator access" but I'm not sure if this is referring to the same setting I'm looking at within in Ventura/Sonoma.Thanks! 

We are having an issue with DNS in our environment.  Here's what happens:-We take the iMac out of the box-Run through set up wizard and set ladmin as administrator. When we launch terminal it already has a hostname called from another PC or Mac. This is before we name the computer L-###-M##, E-###-## or F-###-## or enroll it into JAMF Cloud.It got so bad that we started having our network team delete the DNS and AD records when we erased and installed our iMacs; no dice.We've been told they will look into it for years (since High Sierra).  I'm working with what little I know about networking so any suggestions are appreciated.

Anyone switched from Carbon Black app control, and if so, what product did you go with?

We are using Jamf Setup on iOS shared devices with Entra/Azure for SSO. Has anyone found a better way for user to type their usernames during login? We have a long domain name along with users full name for their ID. So we would like a better way for users to be able to supply their username when checking out devices. From what I understand you cant use an nfc or barcode or qr code on ios to esentially read the username from a code and open the authenticator app and type in the username.  Has anyone found a better solution for this challenge?

Additional information about Microsoft's Conditional Access filters for apps is available here. What is a “Custom Security Attribute”  Simply, the custom security attribute lets you stick a Post-It Note with anything you want written on it onto an Enterprise app, a user, or any other Azure or Azure AD resources.  Once you’ve tagged it, you can use that tag for things like applying conditional access policies or exempting apps or users from the policy. How are Custom Security Attributes used with Azure Active Directory Conditional Access policies Custom security attributes allow an administrator to tag an application or web service with a special flag.  This flag could be used like a group membership for applications, or it can be used to apply policies to an application which would not normally be subject to conditional access rules like native/mobile App registrations like those used with Jamf Connect.   In these examples, we will: Use a custom security attrib

I looking for a script that will force my machines to do an update to the latest version. Especially since we are required to use macOS Sonoma 14.0.

When a configuration profile for printer management is deployed to a Mac before the printer drivers are installed, the printers are configured as generic printers. Even the release notes of Jamf School mention this phenomenon:Best Practice: Deploying printer drivers to device groups before configuring a printer management profile ensures that the printers are mapped with the correct drivers instead of generic drivers.Question: how can you make sure that the printer management profile only gets deployed after the installation of the printer driver profile has been finished?

I'm looking for the correct API method to get a list of computers in a smart group.The documentation for smart-computer-groups-preview says it does exactly what I want, but I believe that description is incorrect.It says: Recalculates the smart group for the given id and then returns the ids for the computers in the smart groupThat's exactly what I need... unfortunately, it doesn't work. It just returns the count of computers in the Smart Group, it doesn't return the list of computer IDs. Even the example responses in the documentation just show it returning a Count.What's the right way to get the list of computers in a Smart Group from the API? Thank you!

Looking for a deployment script for Dropbox, so far I have found out that Dropbox does not provide an easy way to deploy their applications. Maybe someone has encountered the same problem before and has script/pkg that could help?

ik can't find it in https://xxx.jamfcloud.com/JSSResource/computers/subset/basic and in https://xxx.jamfcloud.com/JSSResource/computers/id/$deviceid.where the heck is it? :)regards 

On a test Mac I converted my mobile account from mobile to local using Rich Trouton's script. This appears to have worked without issue. I've then applied a simple config profile to the test Mac to enable the Kerberos SSO Extension. I can sign in and get a solid key icon in the menu bar and all appears well. However, it realizes that the account password is different than what's defined in AD. I get prompted to put in the AD password and then the local password. It attempst to sync the local account password with the AD password but keeps failing - "Problem setting login password" "There was a problem setting your login password to match your Active Directory password." Please contact your IT help desk for assistance." I've tried this numerous times and it fails each time.

I'm a bit confused on how Jamf Notify needs to be set up.I get the notify screens after enrollment but I'm getting black out screen for 30 seconds afterwards.  I've looked here But I'm not sure I'm implementing it correctly. I do see a notify screen but I'm unclear which of the below are making that happen.Q: What's the most basic form of Notify with the NotifyLogStyle key-value set to jamf ?Q: What is the minimum I need to get Notify to work?Currently I have Authchanger (see below).Basic notify script in package(copied the from jamf docs did not change this at all).Script path in login script.NotifyLogStyle key-value set to jamf (in login profile)  script args are crrently not set in the login profile. Do they have to be?Not sure where the ScriptArgs should go (login profile?)  what they should be set to and what they actually do.I'm using Azure but I don't have a OIDCIDTokenPath setrecap of set up:I've added a

This pop-up asking the user to restart keeps coming up, even after a restart and update. How can I find out what update or configuration is causing this?

I need to whitelist Jabra Direct in a Configuration Profile since they're still using a kernal extension, but I've been unable to get the Team ID and Kernal Extension Bundle name from Jabra Enterprise Support (they read whitelist and think I'm trying to whitelist a url). I can't seem to reach anyone there who knows what I'm talking about. Do any of you have this whitelisted already who can post the Team ID and Kernal Extension Bundle name?

Please add a option for dark mode.. too much white