Hi JAMF'ers... JAMF'ees.... JAMFS I am trying to deploy an iOS app (through VPP) and keep it from showing up on the home screen. I need the app to still be able to launch, but ideally icon would be hidden. Basically, we have our SSO app that we deploy to all iPads that our students need to login to first and then they launch the app that I want to hide through that SSO app. I tried setting up the Restrictions configuration profile to not allow the app, but in this configuration the SSO app won't launch the second app. Is there a way to just hide the app from the home screen through configuration profile, but it still live and be usable on the iPad?

I’m having a strange issue that started within the last week or so. Some laptops are not receiving some configuration profiles. Two profiles in particular, and not every laptop is affected. One is for Jamf Connect. It’s an uploaded profile straight from the Jamf Connect Configuration app. The other is for the Root3 support app.I have tried different versions of each profile, one using the built in Jamf Connect schemas one with the upload. I have tried the same with the Root3 app, one using their json schema and one with the plist.Neither will push down to some devices. Hardware doesn’t make a difference, and neither does os. It’s happening on Monterey and Big Sur, and intel or Apple processors.I am at a loss. Logs for both say failed on the device inventory page and pending on the profile pages.We’re on Jamf Pro Cloud.Anyone else having issues?

Hey everyone,  has anyone worked on securing their Mac fleet based on the CIS benchmarks for Monterey? If you can share scripts or config profile that would be great.Thanks

Trying to force the install of an extension in Microsoft Edge, the issue is that the extension is from the Chrome store and not the Microsoft Store. Allow extensions from other stores is already enabled.   I am able to force any extension install from the MS store so I know that is working but i don't see how I tell it to go to the Chrome store.

Hello, Can someone please answer, which I'm sure is an elementary question?Some of out Macs will need to be unenrolled and enrolled in Intune (don't ask!)What happens when you unenroll the Mac?What happens when you unmmage the Mac?What happens when you remove the MDM profile and framework?Self Service was removed, our VPN client does not work but all of the Office apps and Teams still work and have access to company data, including our company homepage? Is there a way to remove everything? Once we unmanaged or remove the mdm profile we can't access it.I'm confused. I thought doing all of the above would cut the ties. I don't know. 

Hello All,Happy Friday!   I am looking for a way to view the log file(s) of when a user used their local admin account to give permission for system changes. Such as installing an application or using the sudo command in the terminal. Does anyone know if or where a log file like that lives on the machine? Thanks for the help.

Hello,My organization is planning to introduce MacBooks for students to use. What would be the best way to introduce a 1 to many scenario where one cart of laptops is shared between 3 classrooms? We pushed the Goguardian app to the laptops so that students have to sign in to the app before they use the internet so that we can monitor and block all non-school related sites. They will only be using the laptops to access Google Chrome, to search the web. we also restricted all software except for chrome on the laptops. My biggest question so far is if we should have one generic student account with a password to have students sign in? What are some setups you recommend for 1 to many scenarios for student accounts?Thanks 

Strange issue that I'm seeing and unable to figure out why. We are trying to lock a device that potentially may have been stolen. It still checks in regularly and Inventory is updated as well but when we try to push the lock command, it fails saying: The device token is not active for the specified topic. Any help would be appreciated. Thank you :D

Has anyone else seen this? We have a large on-prem deployment where we have used manual procedures to update a large number of devices over a long period of time. I think there might be some leftovers in the DB because of this. Because when I try to enable that feature, a warning is displayed before enabling it. And that's a LOT of running updates. So I can understand that it might overload tomcat and make it freeze. But anyway, am I the only one with this problem? See below:  

This Message is From Adobe Customer Care Creative Cloud login is meant to linger, so the user doesn’t have to continually log in. Logging out of the OS user account does not log you out of the Creative Cloud. However, CC login is local to the user account. So, if user logs into a different user account they should not see the other use CC login. Is this a shared device such as in a lab or classroom? If so, are you working with Shared Device Licensing? If this is the case, the login does linger, but it is limited to 90 minutes before it verifies the user is still operating the computer. This is to help prevent issues of overlap between users but it is not a perfect system as 90 minutes is too long for some and not long enough for others. To full prevent overlap, the users should log themselves out after they are done with their session. Potentially, you could script something into the OS logout that will remove the “cookie” files which store the CC credentials. This document talk

These are machines that have been managed for years. Restarting doesn't help. Total wipe may but is time consuming.  Trying again in a couple of days may ... my current theory is that a wonky Apple server is contacted and it takes a couple of days for that relationship to expire so it talks to a different server.Are there other workarounds beside web enrol? Not happy that associates a userid to the machine.I think QuickAdd is very deprecated.

Hello everyone,When we enroll our Macs we sign in with premade account from pre-stage settings for the remote management and after that we set upp the user account for the computer. In this case the Inventory > User and Location is blank.Does anyone know any good way/script on how to fetch the local username and have it placed in the filed for username in Inventory > User and location?In about 14 days we shell enroll 550 new Macs to students. We're not too interested in updating the user information manually. 😆

How to configure Cisco anyconnect-macos-4.10.04071-predeploy-k9 for deployment with AMP and other modules (umbrella, DART, etc) To deploy Cisco Anyconnect and its modules such as umbrella, DART & AMP know the following.All you need to do is deploy the latest anyconnect pkg, but you need to have it with a script that does something like this:  #!/bin/bash /usr/sbin/installer -pkg /private/tmp/anyconnect-macos-4.10.04071-predeploy-k9.pkg -target / -applyChoiceChangesXML /private/tmp/choicesForAnyConnect.xml  2.  Put that script (you might need to edit it a bit once you update the version numbers etc) in composer like this, same file structure etc. private/tmp/(put your anyconnect installer here + choicesForAnyconnect.xml file). For your sources make sure to put in scripts a postinstall script like mentioned in step one (jamf nation doesnt seem to let me upload images/screenshots)  

Our Jamf Pro syncs with Apple School Manager. We have some users who have synced to a different account in Apple School Manager, so their Managed Apple IDs are wrong in Jamf. The users have devices allocated to them, and the device belongs to the correct username in Jamf, but in the Rosters section it is showing a completely different user.

I am using a script to remove student profiles from devices. I was testing the script and all seems well. My admin accounts are staying on the device, while removing unnecessary profiles. However, when I logged in at the Jamf Connect window I received the whole "your azure password does not match our local password" message......How can this be if I deleted my profile? Something, somewhere on the machine is holding onto my credentials after deletion. What's strange is the same script removed my co-worker's profile and he can log in. Jamf connect says "creating your account." But I can't log in without supplying the old password. Even when I do enter the old password, it says it's incorrect... Is it my script? # Get a list of all user accountsuser_list=$(dscl . -list /Users | grep -v '^_')# Specify the admin account(s) that you want to excludeexcluded_users=("admin1" "admin2" "root" "management account")# Loop through the user list and delete user profiles except admin accountsfor

We have a not insignificant amount of iPads and Macs in our JAMF pro instance that have gone AWOL. We are also over our license count right now. My idea is to make a Computer and Device Pre-stage enrollment group to move all of these non-communicating devices into and delete the device records to free up our license count. A large number of them just need to recovered and retired.The hope also is have the Macs rebind to our AD instance (I already have this setup) so that a user can login but then the computer is basically unusable after that and just displays a message to contact our support desk.  Is there an optimal way to accomplish this on MacOS and iOS. Like is there away to automate the sending of lost mode/lock device to as soon as a device/computer enrolls?

Does anyone have any experience utilizing Jamf Connect login LAPS functionality? https://travellingtechguy.blog/jamf-connect-and-laps/ Following this link there is specific plist config info called out for LAPS control built into Jamf Connect, our intended use case would be finding something that can manage our local admin passwords without being AD bound and securely using the FV2 escrow key seems like an interesting idea.  Any thoughts on best practice?

Hi All! Any recommendations you might have on this would be appreciated. Disclaimer, I haven't pulled out all the stops on testing this, just looking to see if anyone has a quick solution.Is there a way to set QuickTime as the default video playback application on client devices via Jamf, through Configuration Profiles or Policy? Or really any method.I have tried using the custom App payload in the configuration profiles, but I am a noob when it comes to json and plists. I can't even find the proper .plist or preference .plist that is setting Apple TV as the default. Along those lines, any resources on how to utilize that payload would be fantastic :) Any ideas are appreciated! Thank You!

We are making the switch to a cloud DP - and chose Akamai. It took us a bit of effort to get it working, the info in the admin guide was a bit slim. I made some notes with the info that would have made it easier to get started. Hope it helps, if you are considering moving to Akamai. http://lisacherie.com/?p=227

Ever since our Jamfcloud instance was updated to 10.40.1 over the weekend I have seen this error in every Mac enrollment for a couple of our config profiles (Cisco AnyConnect and Crowdstrike Falcon): The same team ID may not appear in both AllowedTeamIdentifiers and AllowedSystemExtensions. We have made zero changes to the profiles in question, so I can only assume the reason we're seeing it now is because of a change in Jamf Pro that now reports this condition where before it would not.  I looked it up and it appears that according to Apple's developer documentation, this is a true error. The question I have is how do we fix it? Which would be the better fix? Removing it from AllowedTeamIdentifiers or removing it from AllowedSystemExtensions?

Trying to get Defender deployed to our macs. Everything seems to work except for PPPC for Full Disk Access, so I can't get Defender to show its licensed.Followed the guide at MS and get the following error with Step 6 https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-jamfpro-policies?view=o365-worldwide#step-6-grant-full-disk-access-to-microsoft-defender-for-endpointIn the payload (UUID: 551B3172-1B04-4B74-85CA-87F7844CD9B6), the key 'CodeRequirement' has an invalid value.Bonus Question - Configuring background services - what is the proper preference domain to use? 

Hello Jamf Nation!We're excited to announce the Jamf Pro 10.50.0 Beta.This version has many new enhancements to configuration profiles including Smart Card authentication for Platform SSO, new FileVault enhancements, and several new Restriction options. How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Once enrolled, you’ll see a link to the Jamf Nation Beta Forum. Note: There will be a short delay between enrollment and Beta Forum access; you will receive a notification in Jamf Nation to join. When you receive the invitation, click "Join this group Hub". Email beta@jamf.com with questions.The beta program is covered by the Jamf non-disclosure agreement; please do not share any information regarding your testing on any public forum, including the non-beta areas of Jamf Nation. Use the Jamf Nation Beta Forum or contact Jamf via beta@jamf.com with any questions. Thank you to all who participate in this program!   3 

Hi,We are using Jamf Connect to allow users in our Azure AD instance to sign in with their network account to their mac devices.We also have other users residing in Google Workspace which we then invite as guests to our main Azure AD instance. Will these users be able to sign in to their devices using Jamf Connect (with microsoft prompt login), or do we have to set up a different configuration profile for Google Workspace login directly?Currently when I test this, I get the error that the microsoft account doesn't exist, however these accounts are used to sign in to apps registered in our Azure AD, so I thought it might be possible to do the same for Jamf Connect? 

How can I get the list of apps installed with Brew? I could not pull this list with Jamf Pro via script. Because the brew list command should work in the corresponding profile. However, I guess Jamf Pro doesn't run it in the relevant profile. Is there a practical method? I used the following commands;brew list --caskbrew list

Hi Everyone, I have created a policy for erase-install with the following Files and Processes command: /Library/Management/erase-install.sh --force-curl --reinstall --update --current-user --overwrite --depnotifyThe policy ran successfully on my test machine but it did nothing. I checked the logs in Jamf Pro and it says "Result of command: /bin/sh:/Library/Management/erase-install.sh: No such file or directory" I can confirm the package is uploaded (erase-install 30.1.pkg). All the mac's in our fleet is Intel based. Also, I'm not sure if erase-install works with Intel Macs.I am quite new to Apple management and jamf pro, and I'm having trouble making sense of this error whatsoever. I appreciate your time and support. Thank you.