Hello everyone,Anybody able to advice witch way to go to get Singel Sign-On for our Apple fleet? Is it with only Single Sign-On extension in Jamf, Kerberos SSO extension via Apples site or any other?

Hello Jamf Comunity - After ADE PSSO - Password enrollment, the user reaches the desktop, but a Jamf Conditional Access picker appears unexpectedly and disappears automatically within approximately 45 seconds. The MFA challenge and subsequent authentication/compliance checks complete successfully.Has anyone experienced this behavior? Is it related to Entra Conditional Access evaluation, device registration, or the Jamf compliance integration? Is there a recommended way to prevent this window from confusing end users?

Is anyone configuring Platform SSO with the Secure Enclave authentication method to overcome local password synchronization with Entra ID? Are you using JAMF Connect? If so, could you confirm which solution or flow you use with ADE and share your insights?  

I really like using Blueprints/DDMs for macOS fleet upgrades. Apple is so close to finally giving us a solid mass update workflow, but in my opinion, two main flaws remain:Users get no clear feedback when an update installation is scheduled. Notifications are way too scarce and easy to miss. Users have even told me they sometimes only see them on the final day.To solve this at my company, I added a live countdown in the menu bar so everyone has a constant reminder that their Mac is scheduled for a restart and update. 48 hours before the deadline, it also sends persistent notifications every two hours, so I can be sure users are properly informed.I know other tools exist for this, but none of them quite hit the mark for me on UI/UX. After two months of fine tuning, the app is out of beta and I'm sharing the source code with the community. While I won't be taking feature requests, I'll do my best to maintain it and fix bugs as long as I'm using it myself.

Hi Nation,Product Office Hours #8 - Jamf Setup Manager & ChecklistNext session: Thursday, 8th Oct - 10 am CDT / 4 pm BST / 5 pm CEST *please note this is one hour later than usual*Speakers: Armin Briegel, Senior Consulting Engineer ​@arminBriegel Register here: https://jamf.it/ProductOfficeHours 🧵 Got a question? Drop it in the comments below ahead of time if you want it on our radar, though you don't have to. We'll be taking questions live on the call! The Q&A transcript will be added to this thread post event.See you there!

In this case I’m trying to use two policy’s in macOS Terminal, one works and the other doesn’t. Office 365 with id 266 (can be installed via Self Service for the user) that works via the Terminal. The policy only contains a package.   Dockutil for students with id 293 (can also be installed via Self Service for the user) that doesn’t work via the Terminal - it says “No policies where found for the ID 293”. The policy contains a package and a script.  Does anyone know why the first works and the second doesn’t?

Hi, hoping someone is able to help!We’ve successfully deployed SCEP with Jamf School for our iPads. The devices received their certificates correctly and were able to connect to our Wi-Fi.However, we are now experiencing an issue with certificate renewal around a year later. The certificates are not automatically renewed when they are approaching their expiration date. It seems that Jamf School’s SCEP configuration does not send a new certificate request before the current certificate expires.As a result, the iPads are dropping off our Wi-Fi and are unable to reconnect once the certificate expires. To get them back online, we have to connect the iPads to another network and then manually push the Wi-Fi profile again through Jamf School.Other MDM solutions provide an option to specify how many days before expiration a certificate should be renewed, but I can’t find a similar setting in Jamf School.How can we configure automatic certificate renewal in Jamf School? I’ve looked through the

Four badges. Four conferences. One meaningful journey.  Four years of JNUC—from attendee to speaker.Being a Mac admin in a long-established Windows enterprise can sometimes be a lonely road.Policies, security controls, governance and expectations naturally grow around the dominant platform. As a result, people may expect Macs to operate much like Windows PCs.But macOS is not Windows. It was never meant to be.When we introduced Apple management through Jamf, I do not think any of us—including me—fully appreciated how many systems would eventually intersect with it. Identity, networking, DNS, endpoint security, CASB, VPN, certificates and other controls all influence the management experience.That complexity taught me something important: Apple device management is a cross-team discipline. Success requires technical skill, cooperation and a willingness to understand where different systems meet.Sometimes you are building the very road you are expected to travel.I certainly did not get ev

Does Jamf Pro 11.32.1 support Apple’s LiquidGlass Setup Assistant SkipKey in Mobile Device PreStage Enrollment/ADE? If not, when will LiquidGlass be included when “All” Setup Assistant Options are selected?

Has anyone had any experience in deploying Fortinet's FortiClient to computers? I get a DMG from our on-prem controller but that doesn't install when I use Jamf Pro to install onto client machines

I had a ‘latest version’ enforcement not apply recently so I want to source the community to see if anyone else has a similar setup or came to the same conclusion. This may end in a Feature Request, but I want to understand some logistics and maybe crowd-source a solution if possible. Let’s say I want to defer my updates for a set period of time across multiple release rings (Early Adopters, GA1, GA) but I also wanted to enforce updates as well. This would create ‘update windows’ for each ring. EA opens up after 7 days and is enforced after 10 days. GA1 is a week later and GA a week after that. Blueprints - technically - provides this and its quite simple to deploy. However… I’m learning that the enforcement mechanism relies on the Apple GDMF feed which… is typically only a single version in a given OS family. Right now, it looks like this: A command-line view curling gdmf.apple.com. For Tahoe, only 26.7.1 is listed as of 6 October 2026This means the Blueprint checks against this feed

Hello, I have seen that the FortiClient is causing difficulties for some users. However, I have just been able to create a relatively simple solution with which the config files can also be made to work by default. My requirements: macOS 11.2.3 (intel) / Jamf Pro / DEPNotify 1.1.6 complete installation on one system upload the install.mpkg to Jamf Admin start Jamf Composer and create a pkg with the following path incl. all subfolders (all custom settings are saved here): /Library/Application Support/Fortinet new policy: select both pkg-files, I first selected the config-pkg and then the Install.mpkg. That´s all. I had success with this. FortiClient is running perfect with custom settings. No restart needed.

Hello,I’ve run into a roadblock and could use some guidance.Our school district has been experiencing an issue with Keychain access prompts appearing for staff. For most users, clicking “Always Allow” after entering their password, resolves the issue, but for some, the prompt reappears after a period of time. This is only seen in Apple Classroom, as of now.Has anyone encountered this before? Are there any recommended troubleshooting steps or potential solutions I should explore to prevent the prompt from recurring?Any guidance on the best approach to resolving this would be appreciated. 

Hi everyone, I. HATE. PRINTERS. That being said, we have to work with them.  and... Canon does not make it easy. Here is what I was able to find out from several places online, in order to get this "installer" to actually work. So let's jump on to our Macs and get this over with.Downloading the "Installer"1. Log into your Uniflow Online (web)2. Start Printing (Side Bar)3. Install Printer Driver > Click [Download macOS printer driver] Navigate to Download FolderOpen SmartClientMac.iso > Open SmartClientMac Volume > Notice here you only have 1 file. But actually there are 4. 3 are hidden.On your Keyboard us the show hidden files shortcut: Command+Shift+.(Period)Getting Files in the Right LocationYou will now see 3 other files. We only need the SmartClientForMac.pkg and tenantcfg.plist files.Next, Go to Finder > Go > Go to Folder (Shift+Command+G)Enter 'private/tmp'Next create a new folder called 'uniflowclient'Which is now located in private/tmp/un

In Jamf Teacher, after the latest update (8.6.6) I face a big bug : Restrictions and Athaurozed apps menus are unavailable, and a message is displayed saying that (restrictions or authorized apps) are not available on MacOS devices.Well my device is an iPad, and so are the pupils’ devices.A bug correction will be welcome, unless this problem comes from something else ? but what? the pnly change I made was updating Jamf Teacher from 8.6.3 to 8.6.6. A colleague of mine showed me the same messages on her iPad.Thanks for your help.Jérôme

Hi there,i have a strange issue with my Apple Configurator 2, its up to date on a macOS 27 Mac, and when i try to prepare an iPad, for exemple, i have an error telling: provisional enrollement failed without anymore explanations.I’ve read this issue might be caused by ntework but i don’t have any problem to access to internet.Is there something elese i can do? 

Since NoMad has stopped working with the new macOS 26, we are looking for its replacement.We tried implementing JAMF Connect, but since we use ADFS, JAMF Connect is not compatible.Can anyone suggest any other replacement for NoMad, which can work as a password sync between Mac devices and our Entra environment.Thanks

I am trying to roll out Bitdefender via jamf school. They supply instructions for Jamf Pro https://www.bitdefender.com/business/support/en/77209-157498-install-security-agents---use-cases.html#UUID-d74e057a-3c56-ea49-62d0-e78bec7b5ca5_section-idm456459405796483264241879965 but nothing for school. I am unsure how to install the extensions that are required for Bitdefender - if anyone has followed the process, would welcome your input

Posting this because I couldn't find it documented anywhere and it cost us a day of detective work.Symptom: a cart of zero-touch ADE Macs (no user created in Setup Assistant) enrolled fine and checked in for about a week, then went dark. At the login window, Wi-Fi was disconnected and the Mac had "No preferred networks". Logging in as the local admin either auto-joined with no password prompt, or asked for the password, depending on the Mac.Cause, from the airportd logs: Wi-Fi joined in Setup Assistant stays "pending". It works for that boot, and even through the post-setup restart, but macOS only saves it to the System keychain and Known Networks at the first console login:Attempting to remember network joined during SetupAssistant (network=SSID: ...)SUCCEEDED to set system keychain password for network joined during SetupAssistantSUCCEEDED to add known network for network joined during SetupAssistantIf nobody logs in, it's never saved. Once the Mac drops off Wi-Fi it can't rejoin. An

Hi,  Has anyone has sucess with the new OS 27, Golden Gate and being to select the wifi on lock screen. It was mentioned as a new feature but it’s not working for me at this time and would be a great help in higher ed for our labs and using platform SSO for new users logging in.  Any feedback would be greatly appreciated.  Thanks!

Hi Nation,Product Office Hours #7 - JNUC Keynote Recap Q&ANext session: Thursday, 1st Oct - 9am CDT / 3pm BST / 4pm CESTSpeakers: Matt Benyo, Director, Software Engineering, and Tim Knox, Senior Consulting Engineer, Industry SolutionsRegister here: https://jamf.it/ProductOfficeHours 🧵 Got a question? Drop it in the comments below ahead of time if you want it on our radar, though you don't have to. We'll be taking questions live on the call! The Q&A transcript will be added to this thread post event.See you there!

FYIJAMF and Apple have a bug that if you have a customized enrollment and a forced major OS update in your prestage. You will more than likely will get the WSOD on your iOS 26 device and the only fix is to “Restore” it to iOS 27.  

Using Jamf Pro. We have an extension attribute for App-Packs for grade levels (K-2, 3-5, 6-8). Is there an easy way to change this in bulk? I typically use MUT, but v6 doesn’t have Ext. Att as an option and Classic wont be compatible with MacOS for much longer. I even tried using the MUT on Jamf Extender but that didn’t work. Any help is appreciated. 

Hello,We are wanting to deploy software updates to our iPhones and iPads outside of business hours. However many of these devices use cellular when not onsite. A big concern is going over our data limit and being charged for overages. Is there a way to restrict OS updates to only occur if a device is connected over wi-fi?

TitleHi Apple/Jamf admins,I purchased a MacBook Neo advertised and sold as brand new from a third-party seller.During initial setup, I discovered that the Mac is enrolled in Jamf/MDM and is showing organisation-management information. I was not informed before purchase that the device was managed by an organisation.I have contacted the seller and they have offered to exchange the device, but I’d like to understand what has happened before returning it.From an IT/admin perspective:What are the legitimate ways to determine whether the Mac is registered in Apple Business Manager/Automated Device Enrollment? How can I distinguish between a locally installed MDM profile and Automated Device Enrollment? If the device is in Apple Business Manager, does removing the MDM profile locally actually resolve the underlying enrollment? Can an Apple/Jamf administrator release the device from their organisation remotely? Could a genuinely unused/new Mac have been purchased by a reseller and subsequentl