Hi there,  When setting up a new laptop for someone, what's the best practice for what Apple ID they should use? I know this all depends on what the user wants etc. But would it be possible for them to just create an Apple ID using there work email for example to sign in? It's just they want to stop using there personal ones.If they have a laptop that is being used by 2 or more people what Apple ID should they use, or is that not a problem as when they sign into the other account it will prompt them to sign into another apple ID?  Thank you!

Our Macs are now coming in NOT added to ABM. So I need to spend a little extra time adding them in to ABM first, before setting them up. No big deal.However - about half the time I am having a problem getting the "Fuzzy Bubble" to appear so I can point my phone at the Mac and add it to ABM. It just never shows up on the Mac, or, if it does, the phone doesn't recognize it to add it in to ABM.Todays blog post talks about how it is supposed to work when everything goes smoothly:https://www.jamf.com/blog/use-configurator-2-with-apple-business-manager/But here is where it breaks down:"5. After the Mac restarts, you’ll be presented with the Setup Assistant. Click Continue on the Mac, then stop at the Country or Region pane.6. The mobile device host must be paired with the Mac to proceed. Bring the host close to the Mac and scan the image that appears in the Setup Assistant or select Pair Manually to pair the two devices."I have tried:On the Mac: rebooting, wiping and reinstalling the OS, dis

Hey Everyone,I'm looking to make an app available for employee's to use when their disk is getting full and to help them easily identify what is taking up space. I see a lot of people on the internet suggesting OmniSweeper or DiskX. I'm used to using TreeSize on PC, and that works really well. There is a macOS version, paid version but for something this lightweight I really don't want to shell out cash for something like this. I'm wondering what all of you use 😁. Edit: I suppose the cleaning portion is not 100% necessary, more so the ability to have visibility what is taking up all the space. 

Hello All,I just wanted to get a way to restrict the Office 365 activation for company devices only, I dont want user to use their company license on their personal device after installing the office 365 app from https://software.macadmins Is it possible to use conditional access in Azure AD, so that only registered company device will be able to activate the office license else no, if yes then still user will be able to register their mac in Azure AD what I think, please clarify me. Thanks in advance.

Simple modifications to enhance your users' experience when using swiftDialog and Installomator with Jamf Pro's Self ServiceBackgroundAs a self-proclaimed swiftDialog evangelist, I was especially excited when Installomator v10.0 was released earlier this month with Jamf Pro-specific examples from Armin Briegel and Søren Theilgaard.This article presumes you’ve successfully implemented Installomator with swiftDialog into your Jamf Pro Self Service policies and then builds on Armin’s, Bart’s and Søren’s work by adding some so-called “racing stripes” based on previous posts, which we’re still testing out in our lower-lanes.Continue reading …

We have some internal websites that are http only.  Without getting into the history: iOS 16 the website launchesiOS 15 or below they get "This Connection is not Private".  I've asked if they click Show Details and the option to continue to the site what happens but haven't heard back yet.  Is there any way with supervised devices to allow Safari to skip this message?  I do have this site on a allowed content filter.

Is there a way to automatically enable location services for the Jamf Connect app?

Hi, someone is selling Mac book pro in fb marketplace and the price is very reasonable and in my price range. Seller added a note saying that the device is jamf locked. I really don’t know what jamf means and Is it okay to buy the jamf locked Mac and is there away to unlock the Mac?

Since the new version of JAMF Pro has been released we are having issues with categories.2 main issues:When we create a new policy the policy does not display correctly in self-service - shows fine in Admin UIUpdating an existing policy with different category does not update in self-service - shows fine in Admin UI Wanted to see if this was happening for others before raising a support ticket. 

If you are using a decrypt string like the one below, you will encounter an error on macOS Ventura when attempting to decrypt. See below:#!bin/bash ## Decrypt string using salt and phrase. function DecryptString() { echo "${1}" | openssl enc -aes256 -d -a -A -S "${2}" -k "${3}" }bad decrypt4370875948:error:06FFF064:digital envelope routines:CRYPTO_internal:bad decrypt:/AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libressl/libressl-2.8/crypto/evp/evp_enc.c:521: SOLUTION:You will need to add "-md md5" to your enc string. This will work across macOS versions 13 back through at least 10.12.#!bin/bash ## Decrypt string using salt and phrase. function DecryptString() { echo "${1}" | openssl enc -md md5 -aes256 -d -a -A -S "${2}" -k "${3}" } 

I was able to do the pre-requisite for Falcon, The install appears to be fine however the script to license doesn't appear to be working and i know why i use a script from the older version and i guess the structure has changed does anyone have the license script for falcon Here is the log detailsScript result: Executing Policy Install CrowdStike Falcon SensorDownloading FalconSensorMacOS.MaverickGyr.pkg...Downloading https://use1-jcds.services.jamfcloud.com//download/0e4976be1fe242abb3ce80e8556253bd/FalconSensorMacOS.MaverickGyr.pkg?token=cdf519ed75c141bea4937d44500440715ar4dxxmrcbdr8m9y5e95veg10tvlnij...Verifying package integrity...Installing FalconSensorMacOS.MaverickGyr.pkg...Successfully installed FalconSensorMacOS.MaverickGyr.pkg.Running script License Falcon...Script exit code: 0Script result: /Library/Application Support/JAMF/tmp/License Falcon: line 2: /Library/CS/falconctl: No such file or directory

So here's something weird - I have a Mac running 13.3, it enrolls just fine - get through the setup screens and to the desktop and DEPNotify launches, and my policies run.  I upgrade to 13.3.1, erase and reinstall because I'm testing...and the machine gets stuck at the Time Zone screen during setup.  Meanwhile, the system is enrolled in Jamf Pro, all the policies run successfully...it just never progresses past that screen and to the desktop.  Wipe, install 13.3...and it works.  Anyone else having anything odd going on with 13.3.1 enrollments?

Hello there, does anyone have experience integrating CI/CD tools with Jamf Pro on prem? Thinking of tools like Jenkins, Bitbucket etc. Specifically looking to establish if it is even possible to interface between Jamf and the CI/CD application, and if so, is there a guide to go about establishing the integration?Thanks in advance.

Is it possible to use the API to install a configuration profile on to a device? We have a network profile that has to be manually installed by our techs as they're setting up the machines. If I can run a policy that has a script that runs an API call to install it that would cut down on some workload. The profile is scoped to domain membership of the device, and it can't be an automatic install since right now the AD cert inside the profile only lasts 1 year and we need to let techs remove it in Self Service and reinstall it to get a new one every year (don't get me started on this, this is being worked on already). I looked at /v1/mdm/commands but got "[ ]" returned when I ran it. And /v2/mdm/commands gives me a 400 error.

tl;dr - Getting an "MDM-enabled user" and user channel for configuration profiles has become unobtanium.  Pretend that macOS is like i[Pad]OS where all configuration profiles and certificates are scoped to the whole machine."Managed Users"A user who is "MDM-capable," "MDM-enabled," or in the Apple MDM spec a "managed user," can be achieved in a few ways:First user created by Setup Assistant when machine is first set up via automated device enrollmentA user with administrator rights initiates a user enrollment via an enrollment URL or renewing the automated device enrollment with a profiles commandMobile accounts (aka bound to a directory service) where during login there is a token registration with the MDM.For reference, see Enabling MDM for Local User Accounts and from apple.com Prepare for changes to kernel extensions in macOS High SierraFor a configuration profile or a certificate to be issued to a single user account on a Mac, the user must be a "managed user" as of macOS Cat

Hi,I'm trying to update a user's site using the Jamf Pro API, though I can't find anything on this in the documentation.I managed to successfully overwrite the list with another one, or a single site. Though I don't know what I can do tu specifically remove one site. If I could avoid filtering the current list in XML to remove the said site from the string and then re-push it, that'll be great. Because this solution seems.. Barbaric.

Anyone deployed RedSky MyE911 with JAMF? RedSky E911 is a cloud-based emergency call routing service that helps organizations comply with E911 regulations Kari's Law and RAY BAUM'S Act. Both are separate pieces of legislation that were passed in the United States with the goal of improving public safety and emergency response.I believe a configuration profile will be needed to allow access to system events. Not too sure if I will need to get the Team Identifier or Bundle ID.Also, looking for a way to automatically input the host address https://anywhere.e911cloud.com/ so users won't have to manually input it.If anyone already has this set up and don't mind sharing, that would be awesome.

Recently, a customer inquired about whether macOS can block AirPrint via a configuration profile. Unfortunately for the customer, the allowAirPrint restriction is iOS only (https://jamf.it/jpRgP). Because it can't be blocked, I decided to look into how to Jamf Protect could be used to report on print usage in macOS.    Jamf Protect Jamf Protect offers the following for generating alerts on a macOS endpoint: Threat Prevention Analytics Unified Logs Telemetry Device Controls Threat Prevention and Device Controls are out of scope for this use case, so let’s take a look at Telemetry, Unified Logs, and Analytics.    Jamf Protect Telemetry Telemetry is a new feature in Jamf Protect that allows customers to send audit events generated on their macOS devices to their SIEM of choice. Telemetry currently uses the BSM implementation in macOS, so I can use the pre-existing binaries that I would normally use to analyze the logs locally.    Running sudo praudit -sx /d

Hi guysI am out of ideas, I'm hoping someone here can help me.We use Global Protect in our company, and have set up the jamfconnector to retrieve the certificates.We have an ADCS configuration profile, which has been working fine up until now. Newly enrolled computers aren't getting their certificates anymore. When I go to check this in 'management' for that computer, I get the error 'Failed to inject certificates into the profile'. Any ideas where the issue could be? Connection to the jamfconnector and issueing server should still be ok. Thanks!Valérie

Just ran into this for the first time when trying to boot an M1 Pro into Recovery mode-- laptop was just reset using "Erase all content and settings" and has macOS 13.2.1 installed. I was intending to update the macOS to the latest by reinstalling the operating system from the Recovery console-- but alas, I ran into this "Recovery lock" blocker for the first time. So, with a little research, I find that the password should be cached in Jamf Pro, and I look it up-- a freaking 39-character password??? And when you type it in slowly on the computer in question, it doesn't show up as you type. Is this all the default behavior Apple has created? What a fricken pain in the butt.I don't see the need for this overbearing security roadblock. All my users are local admins and living remote, and in eight years of managing Macs with Jamf, I have not regretted that once. Everyone's remote now, and they need to be able to do some troubleshooting, Jamf Pro helps us keep the drives encrypted, no auto-

I have a policy to push some new printers we installed after login and startup . I have tested and it seems to be working. On this one specific user her laptop has not "checked in" or had an inventory update since early march. I have tried restarting multiple times to see if the policy pushes but I see nothing in the logs. Why hasn't the laptop checked in or had an inventory update since March? Could that be part of the issue as to why the policy is not pushing?Thanks 

Hello,We would like to enable FileVault when preparing our Macs, during the enrollment prestage.We would like to know the best way to do this knowing that:- We have a support team that pre-configures the computers.- During the enrollment of the computers, a management account is automatically created with a random password and a local administrator account.- During enrollment, Jamf Connect is installed.- Once the computer is enrolled, our support team logs in to the local admin account to install applications and do some different settings according to the targets.- Once finished, the end user will come to pick up his computer or the computer will be sent to the user.Today, we are beginning to deploy Filevault through a configuration profile with encryption at logout.Thank you for your help.

Looking to do a binding to a LDAP server. I can get the base binding with this commanddsconfigldap -a lookup.example.com -n lookupThe problem I'm running into is that I can't find a programatic way to set the LDAP Mapping to RFC2307 with the associated search base suffix.Can do it manually in the LDAPv3 settings in the Directory Utility UI no problem.

Hi everyone, I was looking at the various Jamf training & certs, and the X00 certs are geared for Jamf Pro, and the X70 certs are mainly security/Jamf Protect. Are there any training/certs for Jamf School or Connect?

Ever since updating our student iPads to iOS ver. 16 or later their iPads no longer "Automatically join Classroom classes without prompting" as configured in Jamf Pro under configuration profiles > restrictions > functionality. Instead of joining classroom classes automatically student iPads now show as offline in the Apple Classroom app until the teacher selects a student and clicks connect, at which time student iPads receive a notification to join the class and students have an option of either accepting or declining the invitation. Obviously this is a huge issue because students can decline the invitation and not join the class. I find it a little strange that a Jamf Pro configuration profile stopped working after an iOS update but it doesn't surprise me at all since Apple is notorious for releasing updates before giving developers time to update things on their end.Has anyone else experienced this?