Hi,We are a fairly small company and offer a COPE service to our employees. Since the question came up how the employees can copy their data to a new private iPhone when they leave. Is there anything to be aware of when using Quick Start on a private iPhone to copy the data from an iphone managed in Jamf?Or is that not possible, because otherwise the management would also be copied?

Hi All,We are going do the MacBook refresh. And we would like to our users not to lose the followings,1. Bookmarks2. Cache3. Applications4. Desktop shortcutsDo we have any application to backup above listed and restore it in new MacBook. Suggestion are welcome. Thanks.

We are using the Mac Apps with the Jamf Catalog packages to keep some of our client-side apps up to date.Most of the time that work great and gets all of the clients to a better state then they were before using this feature.But the issue we found is that the updates are slowly spread across the devices AND it block the auto-update feature for eg Google Chrome.This way more devices then we want are running an older version; they will get the update but not as fast as we want in this occassion.This auto-update feature is blocked for eg Chrome, but for Brave it is not.Will this be made a free choice?What is the best option to push an update without spending much time on packaging?

This issue popped up on me in the spring and has resurfaced now as we prepare iPads for students. After setup most iPad apps install everything fine, however some devices show apps either dark or with the bullseye placeholder and say "waiting", but when you click on them you get this message: Unable to install "Jamf Self Service"You must purchase this app to install itView in app store Some of them show as installing in the system but not all. They do not process unless I manually delete every dark app and restart the iPad. This is obviously not ideal when managing large fleets, or when devices are at home with students during remote learning situations. Wondering if anyone has dealt with this issue and found a resolution.

Microsoft released version 16.45 of their Office apps for Mac yesterday. I’m disappointed that Microsoft still has not released their so-called “new” Outlook for Mac users that promises better performance and better features. This new version is still not feature complete. They have been blogging about this software for months, and extolling the great new features and better performance. What did we get? More of the same. Switching to the “new” (incomplete) Outlook will not give users anything new, except a reskinned interface that looks like macOS Big Sur. When I switched to it just now, I was told that a shared mailbox that I had attached to the account that is logged in is not supported. Really? Shared mailboxes are not supported by this “new” and allegedly improved Outlook? I have no idea what they’re thinking in Redmond. Apple users are charged the same amount for Office but they get less product in return. Outlook for Mac has always been missing important features that the Window

I am looking for a way of scripting the account icon for a local user account used across multiple devices. Instead of a random picture, the idea is that this account would be singularly identifiable on any device.Using dscl seems to be the method and maybe it is just identifying the image path for default Apple icons or Monogram.There are scripts like this one that utilize a resource folder being placed so a custom image can be utilized, but in this case a generic user silhouette or Monogram is what I am looking for.In the past I found that attempting to set the user icon via script, if the path to the image didn't exist or was invalid, the icon would revert to a default grey silhouette picture. This worked for what I am trying to achieve but I would like to specifically set it using a known method, to a Memoji or already existing icon, even the headshot silhouette picture. 

A couple of my users have had an issue where they go to login with their Okta credentials in Jamf Connect login and they are then prompted for their local password to migrate the accounts. The problem is that the local password is always registered as incorrect. This happens even when I reset their local password and then try to sync again. The only work around I have found is to disable Jamf Connect Login on their machines and have them continue to use their local account for now. Reinstalling Jamf Connect Login has not fixed the issue nor has rebuilding my plists.Any thoughts?

This might be a dead horse at this point but since the posts I see are a little old, I am going to ask anyway...  When it comes to Office 365, what is your preferred deployment method? I see 3 main types:  Direct download from Microsoft and make a PKG, use Mac App Store applications, or use Jamf Catalog.  I have done a manual direct Microsoft method but am looking to more easily automate the updates for patch management purposes. The only downside I know of so far for the MAS method is that when Office updates are created they are first provided by Microsoft through their own channels, then passed along to Apple for approval.  Apple might or might not approve the update in a timely manner so it may be days to weeks before the MAS version update is available. I do not understand enough about the way Jamf Catalog titles are updated to know if they also go through a similar delay before updates are available. At this point, I am leaning towards

I am trying to add JAMF script variables to my script, the scripts function is to check user home folders and if it had not been modified in an X amount of days it will delete the folder. I want to be able to change the amount of days depending on the deployment location. Would I simply just need to add $4 to the area where the variable would be input?#!/bin/bash# Set the number of days to 90days=90 (<----- This would just change to days=$4, then in JAMF I would set the amount of days in the first variable section. # Set the excluded usersexcluded_users=("macadmin" "shared" "Shared" "admin")# Get current date in secondsnow=$(date +%s)# Iterate over all users home folderfor dir in /Users/*; do# Check if the folder is a directory and not one of the excluded usersif [ -d "$dir" ] && [[ ! " ${excluded_users[@]} " =~ " $(basename "$dir") " ]]; then# Get the last modified date of the folderlast_modified=$(stat -f "%m" "$dir")# Calculate the difference between the last mo

Just wondering if anyone has configured the Lansweeper agent for deployment on OSX yet. I tried to use Composer to capture the dmg install, but I'm not seeing the device agent checking in. I fear that it has copied the config of the Composer machine and that is how it is reporting. Here is the documentation on the package if anyone can think of hints: https://www.lansweeper.com/knowledgebase/silently-installing-lsagent-on-a-windows-linux-or-mac-computer/

The Standard Account on managed Mac get changed to Admin Account without any change done from Jamf Admin.User do not have a way to get default admin password to make changes to his account.And, I've already run a script to change the standard account to admin and next day again the account got changed to admin.Not sure what changes took place or what might have caused this change.It would be much appreciated if I can get some input on this.

Looking to use Active Directory groups to populate smart user groups. We currently have SSO and Azure AD as a Cloud Identity Provider setup. Do I also need to add an LDAP server? Thank you.Kevin 

Hello,I have a user whose computer has "Chrome" and "Slack" listed as separate storage drives. While both Chrome and Slack on running on their machine, Jamf is continuing to list their computer as "unencrypted" since neither the Chrome or Slack "drives" are encrypted. They have also complained that when they update their computer, they have to "reinstall" Chrome and Slack, though I am not sure how relevant that fact is. In any case, this is the only user who has this problem, and we have the same configuration profile running on the same model with different employees without this issue. I'm not even sure how I would recreate this problem on a separate machine, so any advice is appreciated.

So a bit of a weird one, we have a normal MDM control on chrome preferences (com.google.chrome), which is normal stuff, but then as we allow google account sign in.  when someone from a 3rd party who is using a goole workspace account now in the about chrome box its changed from managed by your browser is managed, to this browser is managed by xxxxxxx (third party) has anyone had this before, just working on how its going to impact our settings or if thats just an errant message?

I wanted to create a smart group that contains computers that have two different configuration profiles installed. That is, both of them, not one or the other.I created a smart group with the criteria:configuration profile identifier is XYZ-and- configuration profile identifier is ABCNo results. I know for a fact that with have 100+ computers with both installed, mine included. Tried both identifies separately and found all correct matches. But as soon as I add more than one to the criteria, it does not work. Is this expected or am I doing something wrong?Thanks  

Hi Jamf Nation Guru, We managed to block extensions in Chrome and Edge on our Macs by configuring custom settings in JamfPro.However, we couldn't find a similar solution for Safari. Have you had any success with blocking extensions on this browser? Thanks

Hello everyone!Need to know something about Intune integration with Jamf. What part, Jamf or Intune, will be the master service when you do it? Can it be any of it depending on how you choose to set it up? Or is it always Jamf?Do you need to install a Intune app on the Apple devices? I heard that if a device (iPhone or iPad) is too old it will make the device unusable because of a loop in the Intune app. Or can you skip it?Do you still use School/Business Manager connected to Jamf and not Intune?Right now I'm gathering so much information about this that's impossible. Later on in the fall we will convert our platform from eDirectory to AD and integrate Intune with Jamf. We'd like it to result the best possible way.

Wondering if anyone has a work around for this issue we're encountering.If I set up a new user in Okta and set a temp password and the user has never logged into a machine it pops up a window and walks them through setting a new password and MFA, however once that user exists on the machine and they forget their password if I reset the password and specify a temp password the temp password doesn't allow them to log in at all

I have been asked to block peer-to-peer sites on the devices campus-wide. Is web content filtering on macOS devices possible? What would be the best way to do it, if possible?

Super quick question you guys may know...  I'm having trouble finding documentation on this, but I ran into a JAMF nation post that suggested that JAMF Lock Commands can be issued to devices that are no longer checking in with our JAMF instance or have expired MDM profiles because it leverages APNS and just needs an internet connection (connection to my specific instance is not required, based on the post). So, some of these devices that are in still my instance and had profiles that expired months/years ago, would in theory, be able to be locked by the JAMF command. Is this true? Can I lock devices even if I seemingly have no other management over them? This doesn't seem right... in my experience with JAMF, once the MDM profile is expired it's basically gone from my management abilities until it's re-enrolled.

Need help with "JAMF Connect pulling wrong username when trying to change password". I have a user who is unable to change her password every time when her password is nearing expiration. When she opens Jamf Connect and clicks change password she puts in her old password and then her new one and immediately is presented with this error (screenshot attached).This is not the right username and it has omitted the C in her last name.  We don't see this account anywhere...not in AD, not in Okta our IDP.  Her local account is correct.  We cannot find out why it keeps pulling up this name.  We have removed the MDM profile and deleted Jamf Connect and re enrolled her machine..  We have set up an entirely new Macbook and it is doing the same thing.  We know that Jamf pulls from Okta our IDP but her account is right in Okta and AD.  If anyone knows why this is happening,  please let me know. 

Hello!In the Jamf Connect documentation it suggests that some scenarios require scoping a config profile solely during enrollment:Best Practice: Jamf recommends maintaining settings that only should be used during enrollment in a separate configuration profile. This allows you to remove the settings after enrollment without impacting other Jamf Connect settings.My question is this:What's the best way to scope machines into a config profile only during enrollment then immediately remove them from that after? Background: we use prestage enrollments and have an "enrollment only" configuration profile for the Notify Screen to install necessary apps, but that requires resetting the authchanger. We do so in the config profile, but one it's enrolled we no longer want to run the config profile with that authchanger reset. Thank you!

Any suggestions for troubleshooting computers that are checking in on a regular basis but not running policies (or collecting inventory?) I have looked at the jamf.log and I see a boat load of network change triggers, but no policy triggers. It appears the LD is not loaded either. Anyone else have this issue and any suggestion on how to fix? Right now, about 3% of my fleet is having this issue.

Hi all!Those of you in a K-12 setting, how have you handled subscriptions within iOS apps? I have an app that is going to be installed on 8 iPads that needs a monthly subscription, and previously I had created individual Apple ID's to create the subscription with but I was wondering if anyone has a more practical solution. Thanks!

My Big Sur workflow was great.Erase and Reinstall the OS either using Recovery or StartOSInstall, leave it to do it's thing, restart at the end of the build script and users can log in.I tried the same process on Monterey and every time it restarts after installing its config profiles.I had to do:  sudo profiles renew -type enrollment sudo jamf policy  for the EnrolmentComplete triggered policy to kick in.Has anyone got a fix for this?