We use Jamf School to manage iPads and will be using Jamf Pro to manage Mac Minis for a high school computer lab. Can these two use the same VPP token and the same Apple ID? In my research, I'm finding that we can use the same Apple ID but need to create a different location with a seperate VPP token. Is this correct? 

A Little Background In 2017, Jamf released an integration with Microsoft Endpoint Manager’s (formerly Intune) Partner Device Management (PDM) API. This API allows Jamf Pro to send inventory data for managed computers to Microsoft Endpoint Manager, where compliance is then calculated using Microsoft Endpoint Manager’s Compliance Policies. In order for Jamf Pro to send data to Microsoft Endpoint Manager, computers must be registered to Azure AD using Company Portal, and a jamf agent (JamfAAD) must collect and maintain an active user session token. Organizations seeking to use the PDM integration must guide end users through this registration flow. The following document addresses best practices for registration, including configuration of the JamfAAD agent, Azure AD SSO Extension, using policies to guide the user, and tracking registrations via Extension Attributes. Configuring the JamfAAD agent UseWKWebView JamfAAD must prompt the user to sign in with their Azure AD crede

While I welcome updates that make things better, I'm not sure the new font choice / bold type in 10.48 is an improvement on the dash board. All uppers worked well, now its upper and lower.. which im not sure is more readable.Bold.. this does not work for me, maybe it works for others?  some smart groups that were once fully readable are now cut at the end, meaning you can't see the ending, making some groups look identical. Renaming these is not an option due to how JAMF uses names for reference. Display preferences are somewhat lacking (dark mode) but an option to toggle this back to Uppers / No bold would be welcome.   

Hi folks,is it possible to set up the very common Make Me Admin Skript for my Macs as a local executable file? It would be no problem to hardcode the local admin credentials into the skript.Thanks for your replies.Th.

hey guys,  I was trying to make computers compliant with cis level 1 hardening standards. Although i have solved some of the standards with configuration profiles, but many remained and i thought automating the process with a script would be easier.i found this great project https://github.com/usnistgov/macos_security.git  and i have tried it on my computer, though it did not fix everything, but it improved my compliance. I created the below bash script and tested it. but when i created the script in jamf and went on and made it a policy on one computer, it failed.any one please have an idea to solve this? or maybe i could change my approach. the script is :#!/bin/bashcd /Users/$USER/Applicationsmkdir cis_compliancecd cis_compliance/macos_securitygit clone https://github.com/usnistgov/macos_security.gitcd macos_securitygit checkout montereypip3 install -r requirements.txt --userbundle install --binstubs --path mscp_gems./scripts/generate_baseline.py -k cis

I've got a webclip on 84 devices that are set as not removable. Unfortunately, the configuration for the webclip was deleted which did not affect the devices. The webclip is still on, still as unremovable put we want to remove it from the devices. Does anyone know a way to do it? I've added the configuration for the webclip again but this time as removable in the hope that it will be changed to removable on the devices which does not seem to affect them. Any ideas, script or anything?

Hi,we would like to have the apps compass and calculator on the desktop for students.In the layout of the configuration these are also displayed but not on the ipads of the students.How can I install the software?RegardsStefan

I have been using Composer with no issues ever since we started with JAMF back in Jan 2022.I did have version 10.48 installed and updated a few days ago to 10.50 version of the apps (Composer & Admin), and they have both been working fine all week.This morning after continuing to work on a project and using Composer all morning, shortly before lunch it crashed.I got the usual Apple popup for a crash, but then tried to open Composer again. It prompted for my password, saying it was going to install a helper application, started to open but then crashed again. I tried rebooting. I tried throwing the apps to Trash and installing version 10.48, still crashes. I tried following this article (https://community.jamf.com/t5/jamf-pro/composer-will-not-open/m-p/217853) but it didn't help. I will add I didn't have the folder mentioned (/Library/PrivilegedHelperTools/) when i first checked. I manually created the folder, copied the com.jamfsoftware.Composer.helper file that I found w

We noticed almost immediately that WebClip payloads caused errors on Shared iPads. We made sure to separate those into their own profiles, but that still leaves us with a dilemma...is there any way at all to get WebClips onto a Shared iPad? I've tried assigning to the user instead of the device, and even using the "Home Screen Layout" payload (both in Config Profiles and in Classes), and I can't get anything to stick On a similar note...I have no idea how that WebClip setting for the Home Screen Layout is supposed to even work, so maybe if I get that figured out, the rest will come...

Hello everyone,  We use an extension attribute that will identify the Max supported macOS by going through OS regexs. For Sonoma, we are using the regex below SonomaRegEx="(^Mac1[3-9]|MacBook\\d{2}|MacBookAir([8-9]|\\d{2})|Macmini([8-9]|\\d{2})|MacPro([7-9]|1\\d)|iMacPro[1-9]|iMac(1[8-9]|2[0-9]),\\d|MacBookPro(1[4-9]|2[0-9]),\\d)" And it will identify it's maxOS with: # Compare Model Identifier against Sonoma Regex compatible Macsif [[ $myModel =~ $SonomaRegEx ]]; thenmaxOS="14"fi So far, it's working partially. As devices are updating inventory I am seeing them update, but on my Macbook Air (m1, 2020) it will not show up as Max OS 14. It does, however show up in a smart group where it searches for Model Identifier matching the regex.  Is there anything obvious that I am missing?  

Hi Peeps, I'm having an issue with this login window, and I can't find any solution for this particular issue.  

Can someone tell us if there is any option to know what was the last device is enrolled at Jamf School to check what happens when you are in overdue lincense process. Thank you

A comment @pete_c made in a recent discussion regarding the inability to compare the result of one EA to another reminded me I created a Feature Request a few years ago for that capability: Support a 2nd Extension Attribute as the Value when using Extension Attribute CriteriaAnyone who has ever dealt with the email configuration option for installing the Netskope agent probably recognizes the original trigger for this request, but I suspect people would find more if it were available. I don't recall when the status was changed to "Reviewing", but with only 5 votes at this point it's not likely to be getting much review so this post is a request to any readers to upvote the request. I don't know if it'll actually help, but it can't hurt :-)Thanks!

 this is happening on new outlook for mac for many of our users. have moved them to legacy outlook and seems to help. Wondering if anyone has seen anything like this before?

We are looking at replacing the Mac's in some computer labs.  Last time I re-used the older wired keyboards and mice so we didn't have the problems of flat batteries or keyboards/mice disappearing.  Are there any wired keyboards/mice that people have found are good for Mac's?We are going to get Mac Mini's so am also asking if anyone has advice on good ways to lock them down

Hi all,Since I upgraded my MacBook Air from Sonoma Beta 6 to Beta 7 (23A5337a), in his inventory all Extension attributes disappear.When I try to launch a Jamf Recon, now I've a message error (Unknown Error - An unknown error has occurred)Do you have the same issue ? cheers

HiI just started or like to start with the managed apple id's which should be created via our azure application (apple business manager)Everything looks fine for me when comparing all guides (Apple, Microsoft)The app creation went fine. I like to add the users via a group in Azure. The group is scoped and i added 3 users to test. Checking the provisioning logs says, the user were provisioned and it looks like ok for me.But the provisioned users are not in apple business manager and the apple id's for the users are not working.What i am missing? Ideas?  

Hello all,I've been trying to troubleshoot this issue for a while and I'm at a point that I'm not sure what to do.A user reached out with the issue that safari extensions do not show up in safari settings after being installed from the app store. After checking, I found that it was true for all devices in our environment.I have excluded myself from all security configurations deployed to our environment, as well as uninstalled McAfee completely to rule out that possibility. The issue persists.I have also gone into settings and allowed any downloaded app from the app store.Any ideas on what could be happening? Thanks!

Hi, I have a policy available in self service for staff members to install MacOS updates. Since the policy reboots their computer I have set a description warning them to save all work before running and ticked the "Ensure that users view the description" option. I have noticed though that the description is only shown the first time the person runs the policy. Because it's for updates I have set the frequency to ongoing, in other works they can check for updates however often they like. To me this isn't expected behaviour, I need that warning to be shown every time because it's important. It seems as though for any given policy JAMF is written to only force the description dialogue the first time though. If I flush the policy then the warning will re-appear but as far as I know a single policy still can't be flushed from the binary so I can't add that to the updates script. Am I doing something wrong here or should I put this in as a feature req

I have seen various people struggling with this, some claiming it's not possible and Chromium documentation on this particular policy isn't straight forward so here we go... Based on Google Chrome documentation for the policy "ExtensionSettings". The following assumes you've already got the application you'll be pinning installed either via other Chrome policies (E.g. ExtensionInstallForcelist) or manually installed. See the below image what the end result looks like - Pinned chrome extensions (HTTPS Everywhere + MyApps) which can't be unpinned by end-users. Create a new configuration profile. Add the "Application & Custom Settings" payload. Enter the preference domain as "com.google.Chrome". Populate the property list contents with the following: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ExtensionSettings&l

Hey Guys,I have MFA setup in Onelogin for my Jamf Connect app.  The Onelogin activity log shows an error that MFA is set on the Onelogin side. I opened a case with JAMF support and they say that I need the success codes in my PLIST, but they don't know what those should be. I opened a case with Onelogin, and they said that the OIDC standard doesn't support MFA.Anybody have this working? My intent is to have MFA presented upon MAC login.Thanks for your thoughts! 

I'm not having any luck with preventing Teams from Autoupdating. I have script that removes what should be the correct files. I also did the default write command to change. Plist settingsAutoUpdateSettings =     {        DisableCheckForUpdates = 1; Script removes /Library/Application\\ Support/Microsoft/MAU2.0/Library/LaunchAgents/com.microsoft.update.agent.plist/Library/LaunchDaemons/com.microsoft.autoupdate.helper.plist/Library/Application\\ Support/Microsoft/TeamsUpdaterDaemon/Library/Application\\ Support/Microsoft/EdgeUpdater/Library/LaunchDaemons/com.microsoft.teams.TeamsUpdaterDaemon.plist/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper/Library/Preferences/com.microsoft.autoupdate2.plist

I was reviewing my Sign-in's on Microsoft Entra and I noticed that Jamf Connect generates a lot of Sign-in requests.Some of them correlate to when I logged in but I leave my computer on overnight and there were 21 successful Sign-ins while I was sleeping.  I checked a few other Jamf Connect users and it looks the same for them.   I assume this is normal but need some confirmation as it triggers some alerts in our security monitors

Hello , Recently I have a problem with devices , after registrating to Intune everything works fine however after 1/2 days the device disappears from Intune. The object is still visible in AAD however it completely disappears from Intune making the devices lose complaiance.Has anyone had a similar case ?I can't track down the changes because on the Jamf side as well as the Company portal app logs everything looks correct.

Firefox manages certificates separated from the system certificates that are used by Safari or Chrome. To circumvent the issue that users are presented with the "certificate not trusted, add exception" notification, it is possible to add the certificates automated to the users firefox installations by utilizing the following commands: Importing Certificates on Firefox & code snippet for looking for the profile name I know that there is also the CCK utility, but that is also more or less a pain in the a**, especially when you want to maintain firefox installations that are already existing (and have a filled user profile). Firefox now provides the possibility to trust certificates that are stored in the system keychain by setting the key "about:config", "security.enterprise_roots.enabled" to TRUE. Mozilla Help This setting should also be stored somewhere in prefs.js, but i have not figured out how to fiddle around with this file without ruining the user profile. Now my questi