Hello , Is there any way to block all apps except the chosen ones? I saw on Apple developer that whitelisted app were deprecated whitelistedAppBundleIDs[string],but solution with allowListedAppBundleIDs didn't work for me. In my case I need to push policy to block everything except preinstalled apps and 5 chosen by IT. 

Important notice: Beginning with this version, Jamf is no longer sending maintenance release email messages. We will continue to send Jamf Pro release announcement email messages for major and minor releases (e.g., 12.0.0, 11.21.0, respectively). Today we are releasing a maintenance version of Jamf Pro; highlights include:Resolved IssuesJamf Pro Server[PI134363] Fixed: When configuring a computer configuration profile with a Network payload with "Any ethernet" selected, Jamf Pro incorrectly uses the string "AnyEthernet" instead of the required "GlobalEthernet" in the payload, preventing computers from successfully joining corporate 802.1x wired networks. [PI139045] Fixed: Activation Lock status fails to display for eligible iOS devices in the Management > Activation Lock bypass category of a mobile device inventory record. [PI140234] Fixed: Static groups fail to display in the Management > Mobile Device Groups category of a mobile device inventory record. [PI140306] Fixed: Jamf P

Howdy all, I am facing an issue that I can’t seem to solve with running Microsoft AutoUpdate via script from Jamf to keep our mac office apps updated. I have had this set up for several years and it had been working beautifully as a hands off solution. I am not sure exactly when it started failing, I recently noticed the problem and started digging into it. I am wondering if anyone is facing the same problem, or has advice on what to try.The setup is fairly simple, a policy that runs against a smart group of any macs with office apps that are not the latest version once a day. It runs a script to use the MAU command line msupdate to pull and install any available updates.Script is below, it only worked under user context originally so that is why it is set that way.The error I am seeing on every run now is related to the XPC connection, this happens on all clients no matter what, -reinstalled MAU with latest version, brand new mac build with latest install etc.  I have the original PPP

 This guide will walk you through setting the local macOS account pictures for end-users via Jamf Connect  Requirements: Jamf Pro Jamf Connect Formatted ID Token Path setup in Jamf Connect Login Config (/private/tmp/token) Azure Storage Blob Email addresses of users follow a pattern for all users (john.smith@myorg.com, jsmith@myorg.com, etc..)  Tested with: Azure AD and Jamf Connect Test User: John.smith@ericsontech.com Steps: 1. First step is to get all of your user images. To make this easy on yourself name them the same as the user's email address. So for John Smith his email is john.smith@ericsontech.com I would name his image as john.smith@ericsontech.com.png and upload that image and all other user's images to an Azure Storage blob. Example:   2. Setup this script to run via Jamf Pro. I have mine setup to run via Jamf Connect Notify Note:  You will need to update this with your Azure Storage Blob url  curl -L "https://myazureblobname.blob.core.windows.net/mdm/$EMAIL.png" -o /tmp/

Our school district would like to defer the upcoming macOS 26 upgrade (scheduled for release on September 15) but still allow security updates for macOS Sequoia.What is the best way to configure this in Jamf Pro so that the major OS upgrade is blocked, while security updates and minor patches for Sequoia remain available? Thanks  

Has anyone had luck hiding the 4 slides that appear after an upgrade to Tahoe? 

Hey all,  Wondering if anyone has any ideas on this? I am wanting to utilise SAM to lock down our iPads to a specific app. Trying to scope this through a department group but the device isn’t showing in the logs for the configuration profile. There are devices in there, just not the two that I specifically need. Both devices that aren’t showing in the logs are supervised and managed institutionally so unsure on what the issue is here… I have also checked to see if I can manually add the two devices but they are not showing when I try to search for them? Getting increasingly confused as the devices that are showing scoped currently, and are in the profiles logs, are NOT supervised...

Morning,Despite my best efforts i haven’t found a solution online so my question is, can i deploy an automator workflow i’ve created via Jamf Pro as some sort of policy of which i can then distribute to selected machines?Thanks

Hi All,  We have setup Jamf Pro SSO and Cloud idP for to EntraID. We then tried to use the EntraID groups for the targeting of applications/configuration profiles but they wouldn’t scope correctly.  I logged a ticket with jamf support and their theory was that because we map UserPrincipalName (i.e. Full email address), this doesn’t match the username on the local account because it doesn’t support the @ symbol. Their suggestion is to drop anything after the @ symbol on the mapping but it’s not that simple as we use the full UPN for other configurations in Jamf.So i guess my question is does anyone else have iDP setup with Jamf and do you sync the full UPN and able to target users via EntraID groups?  TIA.

We use Jamf Pro Cloud with Jamf Connect (for account creation + Entra ID password sync).After enabling “Use Self Service+ as the default end user app” in settings:Old Self Service was upgraded to Self Service+ on existing Macs Jamf Connect was removed, menu bar now has Self Service+ icon instead On new enrollments, we install Jamf Connect 2.45.1 → now it’s there alongside Self Service+I can’t find clear docs on this — so:Questions:Is Self Service+ intended to replace Jamf Connect completely? If yes, should we skip installing Jamf Connect post‑enrollment? Or should we move to Jamf Connect 3.x? Any official migration guide for 2.x → 3.x with Self Service+?Any experience or official Jamf resources appreciated.

I’m trying to implement Jamf Setup Manager. I have everything aligned regarding the configuration profile and the Jamf Setup Manager PKG assigned as an enrollment package. But the PKG won’t install. I’m not seeing any logging or the app in the Utilities folder after enrollment. Any suggestions would be appreciated.

Hi All, so i’ve had an issue for a few months, I’ve been trying to find the bash command line to turn on accessibility keyboard, so looking around in ventura this was easy to do and now the location has now changed, main thing is i don’t where. As i work in a school some teachers want on screen keyboard when they connect to the white boards, so i wanted to add an option in self service to deploy a shortcut to the keyboard

Startup Power is a macOS application built with SwiftUI that allows you to configure your MacBook’s automatic startup behavior.It directly modifies NVRAM variables (BootPreference for Apple Silicon, AutoBoot for Intel) to control these options.The app automatically adapts its behavior depending on your Mac type.If this can help the community, the application and the source code are available here:https://github.com/chrisbasse/Startup-Power 

Hello,I have multi-user workstations on which I do not have FileVault activated so as not to have a problem when connecting a new user with Jamf Connect. Unfortunately, the TAHOE update automatically activates FileVault and suddenly at the start of the station an account is requested that can activate FileVault before having the Jamf Connect window. How can we get around the problem or how can TAHOE not activate FileVault?

Hey Guys,I already talked to Jamf and got this issue escalated for me. You may want to check if this problem applies to you.I was trying to enable activation lock through a static and smart group via selecting the group>View>Action>send remote command>enable activation LockAfter talking to Jamf they are aware that it is not accurately reporting if the device has AL turned on in the inventory screen so I was checking with ASM. There I discovered AL was off. I tried it again the same way and the issue persisted. If I went to the device>Management>Activation Lock>Enable activation Lock it seems to send out the same command but does enable activation lock. To test it I did the same this again with the group command and the device turned it off and could not turn it back on with the same command. I had to go back to the specific device and turn it on again. My problem was with a small number of iPads so this wasn’t a huge issue for me, but if you manage lots of Macs and

Howdy everybody! Time for my annual post about how we all need to get our budgets prepped and ready to go for all the hardware we need to replace that Apple is dropping from its OS Compatibility list! I've modified my previous regex statement to take out the models that were lost to us this year to the latest macOS version. It looks like Apple is taking a big ole axe to the intel macs, minus only a couple of exceptions that seem to tie to the devices that were still being sold at the time of the M1 release. One tricky piece are the specific intel MacBook Pro's that Apple has listed. In that grouping are the MacBookPro16,x models, where x is 1,2 and 4, but not the 16,3 model, so keep that in mind. If anyone has details that contradict that, please let me know here and i'll quickly change the posted regex. I've tested this in my own Jamf instances to verify its returning the data that i'd expect to see, and am confident this will be able to match everything that is no longer supported by

Get ready to supercharge your scripting and automation expertise at Level Up JNUC 2025! Running Monday, October 6, the day before JNUC 2025 kicks off, this exclusive, in-person training is your chance to dive deep into hands-on learning with a Jamf instructor. From IF statements to APIs, loops to user interaction, you'll gain the practical skills needed to automate like a pro. Full-day training (9:00 a.m. – 5:00 p.m.) Lunch & refreshments included Hands-on scripting & automation challenges Digital badge, swag & bragging rights upon completion 📢 Limited spots available – secure yours for just $99! New to scripting? No worries! Check out the Bash Scripting Foundations and Bash Scripting Automation courses in the Jamf Online Training Catalog to prep. Don’t miss this opportunity to level up before JNUC 2025! 🔥 Register HERE now!

We have a bunch of machines that R7 is reporting the version.plist file in the safari.app container contains vulnerabilities. The app container is in the cryptexes folder and is listed as version 18.x. The machine itself is on macOS 15.6.1. I assume the container in question is in the reboot environment? I’m not sure how to fix this.When I try to remove the vulnerable plist file it comes back as operation not permitted. Can I even remove this file? Should I remove this file? Is this a matter of the recovery environment not being up to date? Looking for any insight I can get. Thank you in advance.

Hello everyoneMy context: wi-fi authentication based on 802.1x through a Windows Server (NPS). Computer certificates are deployed by Jamf (Configuraton Profile) and through the Jamf ADCS connector.Macs are not bound to the Windows domain but a computer object is created for every laptop (it's mandatory with a NPS server).Everything is working as intended. As you may know, in may 2022 Microsoft published an important security update that changes the way certificates are validated by domain controlers.https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16  A new extension identified by the OID "1.3.6.1.4.1.311.25.2" is now included in certificate templates, but only for the ones that build the subject information from Active Directory.Unfortunately, certificates issued through the Jamf connector are "offline", meaning that the subject information (CN, DNS name) are supp

During post-release window for at least the last 4 minor macOS releases, our users have reported that the Mac only lets them unlock with password, not allowing their fingerprint.If the user restarts the device, then logs in, the fingerprint option for unlocking is available but, reverts to not being available shortly after. This behaviour appears when a new macOS update is released, then is only resolved once the device is updated.We’ve confirmed that the fingerprint is setup and works for other auth with the device unlocked - never seen this behaviour before, anyone else experiencing this?For reference, this has happened on at least;macOS 15.4 → 15.4.1 macOS 15.4.1 → 15.5 macOS 15.5 → 15.6 macOS 15.6 → 15.7

Hello,We have an LDAP server (Active Directory) configured on our JSS.We will move to Azure AD.For this, we have configured "Cloud Identity Providers" to integrate with our Azure AD.Everything seems ok with tests. We can query for groups, users and get "true" for membershipWe are trying to scope and limit policies (Self Service) to group memberships from AzureAD (via Cloud Identity Provider). I can search for the group and add it to the Limitations section of the policies.But when I try to test the policies on computers, the policies are not available when users connect to Self Service using the Azure AD accounts in the target groups.When we try with Active Directory groups, that works well but not with Azure AD groups.Do you know if this is normal? Can't scopes with Azure AD groups?We have Jamf Cloud 10.33.Thank you for your help

Self Service + with JAMF 11.18 adds a menu bar icon by default with no way to natively disable it from self-service. Does anyone have any menu bar techniques to remove icons that do not involve using third party apps? Thank you in advance  

This.  So much this.  Now if we could get granulated details of impact or history into the jamf app catalog for things such as “failures” or “unsupported”….Anyways, this is a step in the right direction for sure!

Is any one else having issues logging into the JNUC app? Even when I select “Forgot Password” I don’t receive an email to change it. 

Hello,I have a brand new instance of JAMF Pro, about a month old so nothing is expired. I have about 80 iPads and when I send a remote command it sits in the pending status until someone wakes the iPad. This is very inconvenient because it slows down work flows in the morning and causes Apps/OS to update during their work time. I have force app updates on and it checks every day at 4:00AM EST, but it never actually updates at that time.Is there any solution to this?