Hi Everyone, how do you get your users to Enrol in to InTune? I have all the correct apps set up, but it still requires the user to go into Self Service and click on "Register in InTune" and follow the steps, and today when the infosec team enabled conditional access, 300 users who all "claimed" to have enrolled were locked out of MS Office apps? Open to any suggestions

Hello everyone. So how we use Jamf Connect login is only on the first login for new hires. This is just to provision the account properly and do all of the magic.After that we run an onboarding script which contains authchanger -reset to kill the login window and just use the menu bar for password resets and whatnot. For us it just works better for our users when they have the native login. If they are out of internet and then looking for the local login button etc etc.The issue is that it seems after a major OS update for existing users the Jamf Connect Login window comes back as the login mechanism. I'm wondering if anyone has a good solution for this for existing users/upgrades?

Hi all,I'm looking for some feedback regarding Jamf Connect. We've recently purchased Connect and have it all setup and ready to go, it's connected to our IdP, which is Azure AD but gets passed through Okta for authentication. Everything is working perfectly: Connect menu bar app works wonderfully, as does the Connect Login window.When connected to the Internet, the Connect login window requires Okta MFA authentication. When not connected to the Internet, local login can be used. Which makes sense, we can't have users not being able to log into their machines if they aren't connected to the Internet. All working as designed wonderfully. However, mu question is this: If people can bypass MFA authentication and just login locally, what is the actual benefit of using the Connect Login window? I feel like I'm missing something simple.

Hello all,We are exploring solutions to allow some of our end users to have a local VM (on their daily Mac) that allows them almost full control. The key things we need are:User cannot copy and paste, or file transfer directly between the VM and their daily Mac.Network will be connected to a DMZ through a trunked port.The VM must be configured so that the user cannot modify the settings of the VM to allow defeating of the above protections of the daily Mac and the rest of our infrastructure.User will not be admin on the daily Mac, but will be on the VM, with less restrictions for testing and research purposes.The VM will likely be macOS in this case, as we have a proper infrastructure for Windows and Linux VMs on VMware, but that might change.In my quick experimentation, I have found that at least VMware Fusion does require admin privileges to modify the network configuration of the VM, but does not disallow modifying the sharing settings. VirtualBox and UTM do not appear to lock down

Hi, does anybody have a simple script to notify users to check for updates and then takes them to the default software update in sys pref? I don't want to use nudge or other software and I don't want to force the update at this point. Basically just a nagging reminder at a set interval. Thanks

Hello - I'm sending remote commands to 7000 iPads to update iPadOS on supervised devices>Latest version>Download, install and restart. None of the iPads were updated to 16.5(going on the 14th hour mark since commands were sent). Under Devices>History>Completed Commands, I see 'AvailableOSUpdates' on all the iPads. I am currently on JAMFPro version 10.45. There's no iPadOS defer in place. I've been pushing iPadOS updates throughout the year with no issues until now. Any suggestions? Thank you!

Setup Your Mac (1.11.0) leverages several new features of swiftDialog (2.2)New Features in SYM 1.11.0Updates for swiftDialog 2.2Required selectitemsNew activate command to bring swiftDialog to the frontDisplay Configurations as radio buttonsReport on RSR version (if applicable) Pull Request No. 50 thanks @drtaru!)Specify a Configuration as Parameter 11 (Pull Request No. 59; thanks big bunches, @drtaru!. Addresses Issue No. 58; thanks for the idea, @nunoidev!)Configuration Names and Descriptions as variables (Pull Request No. 60; great idea! thanks, @theadamcraig!)Consolidated Jamf Pro-related webHookMessage variables; Set “Additional Comments” to “None” when there aren’t any failuresContinue reading …

How can I pull the specific insight's non-compliant system list as a csv file or as report in Jamf Protect? is there any options available for this?

Hi. I am IT in a school and use Jamf Pro. I tried Jamf Parent few days ago and was surprise to observe an easy way to disable the limitations for the student: he downloads Jamf Parent with a personal device, flash the QR Code from Self Service, and then disable the rules and other limitations to have a full access. Did i miss something ? Thanks, Kévin

Hello,I am preparing the deployment of a new antivirus with Jamf. A profile has been created for the authorizations following this documentation:https://www.pandasecurity.com/en/support/card?ID=700101&track=26424 However, the antivirus still requires an additional authorization (Content Filter): I did not find this information. For other antiviruses yes, not for Panda. Is it possible to authorize this on a computer and then retrieve the necessary informations with a command line? Trying in Jamf the following information, it does not work:Thanks for your help

I don't use the cli tools often, and when trying to check something today, I'm being prompted for the configuration password but none of my documented passwords are being accepted. Is there a quick and simple way to delete the cli configuration and set a new password? I believe the only thing I had set was a scheduled backup, which appears to have not been running correctly, so attempting to get in there to check it but unable to do so at the moment.

Working in end-user device management, focusing on onboarding, configuration, security, and updates, is easy. After all, getting everyone working is critical! But what happens at the end of a school year or employment contract? What about managing the sudden departure of a staff member or student with a BYO device? Do you have an end-user device offboarding process in place? Do you have licensed software to recover? Configurations to remove and permissions to reset or restore? What about the removal of the framework itself? In this article, I’ll guide you through the basics to complete these tasks and let those devices go with comfort and ease and, most importantly, satisfied end users.   In most circumstances, our users initiate device offboarding via Self Service. The policy becomes available when their computer record is scoped to our voluntary offboarding department. All institutionally licensed software and configurations are removed. Local student user accounts are elevated

Glad to see they we can finally have some insight into what is going on when we push MDM commands to attempt to enforce macOS updates. Disappointed to see that apparently none of this info can be used in a Smart Group, Advanced Search, etc for tracking and reporting. Baby steps I guess.

Button placement issue. 

Hello,With the new certificate renewal procedure I had to reconnect directly to the Apple site which manages the certificates.The problem is that the specific Apple ID we used for this when originally installing the product, is now asking me for answers to the passphrases we lost. And therefore I cannot access the certificate management.To work around this I used another Apple ID from our company to generate a new certificate.But after installing it in our Jamf server, I notice that the push no longer works: In view of the logs, it comes from the certificate.Is there a way to force Jamf and associated devices to use the new certificate from another Apple account?If not, what is the procedure with Apple to recover the original account that managed the push certificate for our Jamf server?Thanks in advance for your suggestions.Regard's Stéphane

Guys,We are migrating from Jamf to Intune. Once Jamf profile removed from devices, did drive get decrypted?If not a policy is enough to escrow the key to Intune?

Hi All,I have created one wifi profile and deploying Root CA and sub CA in the same profile where SCEP is configured. At the end it is getting failed after deployment giving error as "<NSOSStatusErrorDomain:-909>".Any suggestions please

I keep bumping up against the issue of different things like Macports, HomeBrew, gfortran and precompiled command line executables need their own specific environment in the shell. I've been lucky most of the time that there's been enough overlap of the apps and I could negotiate to not have MacPorts or HomeBrew but I finally hit one that is just causing pain as I really need everything.  When I've seen big linux systems, they usually have something that you can run to configure your environment usually when you open the shell.I was thinking I'd try something along the lines of a script that runs when you open Terminal and it displays choices for MacPorts, HomeBrew etc and runs the environment setup for them that way rather than my existing all you can eat way from the system wide files in /etc.  I did talk with one of our big system managers who said they use something called Environment Modules (https://modules.readthedocs.io/en/latest/index.html)Just wondering what ot

In this blog we will assume you have Jamf Pro, Jamf Connect, and Jamf Protect or a combination of those and look at it through the lens of Microsoft and Jamf Device Compliance, but the exact same workflows can be achieved with the integration between Jamf and Google BeyondCorp, which was added in Jamf Pro 10.45!     For several years now, Jamf Pro has allowed organizations to integrate with Microsoft Azure AD and Microsoft Endpoint Manager to provide Conditional Access to Apple endpoints; initially it was only available for macOS using the Conditional Access feature in Jamf Pro, but Device Compliance for iOS was then added some time later.   Recently we received the deprecation notice for Conditional Access for macOS; Jamf now offers an alternative solution with macOS added as a supported platform to Device Compliance in Jamf Pro, which is good news!   With Conditional Access for macOS, Jamf Pro offered basic information like the state of FileVault, the firewall, a

Hey All,Need some help regarding reseting user password on MacOS devices.I'm trying to avoid separate admin account with LAPS on all company devices. To do that I want to use manageable Apple ID's so the user can reset it by themselves . Unfortunately we are using integration from ABM to Azure with SSO and my problem is that the MacOS recovery window is not visualizing the pop up window in which I have to confirm my credentials. Dose anybody find any solution for this ?

I know this is the old way of doing things,. I have multiple domains in the same forest and a service account in one domain that I'm trying to use to join another domain.  I'm just wondering how I need to specify the service account's domain on the directory binding I created. In Jamf's directory Binding there are fields for domain, username, password, verify passsword, and OU: For domain I specified the domain I want to join, not the domain the service account resides in. For username I have just the simple username of the service account.  Do I need to specify it in the SIP format?  user@domain?  Or maybe with a backslash?  domain\\username?  

Got this Error while handing out apps on my Ipads. Is there a solution?

Hello,I am trying to add an EA's value "YES" to the existing EA's name "Decommed:" in JamfPro.Spending hours and still not being able to figure it out! New to API/XML and learning along the way by watching the presentation from JUNCxxx.so far this is what I have and I am sure the curl statement is not working with the error message <p>ERROR in XML file</p>Appreciated your help.-------------------------#!/user/bin/shjamfuser="jamf_account"jamfpw="jamf_password"jamfURL="https://jamf_server:8443/JSSResource/computerextensionattributes/name/Decommed"/usr/bin/curl \\ --user "$jamfuser":"$jamfpw" \\ --header "Content-Type: Text/xml" \\ --request PUT \\ --data "<value>YES</value>" \\$jamfURL------------------------------------------above URL "$jamfURL" has this data. <computer_extension_attribute><id>38</id><name>Decommed</name><enabled>true</enabled><description>Decommissioned devices.</d

Apple Script format #Created by Kyle Ericson Date July 24th 2018 #If you want to remove from JAMF uncomment this #do shell script "sudo jamf removemdmprofile" user name "Administrator" password "superpassword" with administrator privileges #do shell script "sudo jamf removeFramework" user name "Administrator" password "superpassword" with administrator privileges #Remove Company Portal Items do shell script "killall 'JAMF' || True " do shell script "killall 'Company Portal' || True" do shell script "sudo rm -R '/Applications/Company Portal.app/'|| True" user name "Administrator" password "superpassword" with administrator privileges do shell script "sudo rm -rf '/Library/Application Support/com.microsoft.CompanyPortal.usercontext.info'|| True" user name "Administrator" password "superpassword" with administ

What are the possible causes we can expect to become mac device unmanaged in JAMF Pro console? As enrollment is not completed successfully so we cant see any enrollment log under /var/logsHow can I do the troubleshooting to fix this issue.