I've had this issue since about January 2022. It hasn't been a huge issue because I am operating in an enterprise environment with less than 100 Macs. However, we are growing and this is steadily becoming more prevalent. The reason I post this here is because I'm the main point of contact for Jamf, but I'm still fairly new to setup in this environment so I'd love to hear if anyone has suggestions for this issue. Here's what's happening:I utilize SSO sign-in through Azure AD. Since about 12.2 and later, any new setup of Mac OS (brand new or refreshed) I have not been able to get users signed into their OneDrive app. We launch the app, put in their email, and then it is 'supposed' to go to the SSO splash page, but OneDrive does not go there. It just seems to refresh the page and ask for the email address again. Once you click next, the app does not ask for the password and then asks where the folder should be synced. You select a location, the app thinks for a moment, and then gives the

For a computer policy that has a script object in it, is it possible to update the script parameters via the API? I found in the classic api documentation (seen below) that you can update some parts of a policy with xml. Would it be possible to update a specific parameter (7 in this case) for a script. Ideally that would be the only thing that would change.  <policy> <general> <name>Firefox</name> <enabled>true</enabled> <trigger>string</trigger> <trigger_checkin>false</trigger_checkin> <trigger_enrollment_complete>false</trigger_enrollment_complete> <trigger_login>false</trigger_login> <trigger_logout>false</trigger_logout> <trigger_network_state_changed>false</trigger_network_state_changed> <trigger_startup>false</trigger_startup> <trigger_other>string</trigger_oth

Hi, Which is the best practice to enroll the users via User Invitation Enrollment ?From Security Perspective it is not feasible to use share accounts amongst all users during enrollment process, would like to understand various approaches followed in other organisation 

I'm been experimenting with some scripts that we want to run at each user's log in. We're using Outset to handle them now, but it's been unreliable for us and seems to break part way through our semester, every semester. In light of that, I've been exploring new ways to get our users files and other things set up for them.I've had luck calling scripts using Jamf's Login Trigger, but the commands in the script are processed as a root user, not the currently logged in user, which causes the scripts to fail. I've found some documented fixes, but they're from previous less secure OSes and earlier versions of Jamf/Casper and I'm not sure they'd be successful under Ventura.Does anyone have some suggestions on getting the scripts ran as the user at login? Should I be going down the launchd rabbit hole?

I’m at a loss here. I’ve been suddenly fighting Zoom screen sharing being completely “blocked” with my JAMF Pro setup on all new computers. All machines are running 12.4, Zoom 5.11, and I have a PPPC payload deployed on some that allows non-admins to allow screenrecording and the other half does not have this. No matter which configuration I use, even when I allow full disk access and screen recording, Zoom still tells me to open my Security & Privacy to whitelist the app to screen record. I have tried both the IT installer PKG and the regular PKG to no success. Does anyone have advice on what I need to check for?? I’m at a total loss right now. Thanks in advance!!

Hey I was wondering if anyone else was having issues with the new macOS Ventura update? After pushing the new update to the students none of them are able to use Safari. When Safari is launched it will open for a split second then close. I rebooted and reinstalled update macOS but no changes. Please advise on how to correct issue. I tried: Holding Shift and click on Safari to openRight click and open methodRebootReinstallUpdate Safari

Hello friends,I am unable to get my Macs on 12.4 to update to 12.6.2. The update downloads, prepares to install, and the Macs restart but they are still on 12.4.I have tried updating through sending a command via Jamf Pro, and manually via the System Preferences pane.I have tried a Safe Boot.I CAN get the Macs on 12.6.2 by reinstalling the OS in Recovery.Anyone have any other suggestions?Thank you.

I have "AutoRenewTickets" set to "True" in our Jamf Connect config profile, but it doesn't seem to be automatically renewing the tickets. Do we also need to configure the SSOe payload or something? Alternatively, I'm just gonna set up a launch agent to renew the ticket but that's really more of a last resort. Thanks, Matt

I hope anyone in Jamf Support or in the community can provide some guidance since Jamf Support takes forever to respond...Objective: Install CA certificate to Mac's processed Pre-Stage enrollment. Problem: The configuration profile used to install the CA to enrolled Mac's works great for "User-Enrolled" Mac's. For some reason it is not working with Pre-Stage enrollments. The configuration profile should be available for distribution from the profile settings section but it is not available for Pre-Stage. Troubleshooting:- After Pre-Stage enrollment I signed in and out of the Mac computer to see if that would trigger the config profile to run on the computer, but no success there.- For testing, I changed the distribution method from install automatically to Self Service and that did not worked as well. Config Profile Details:- Profile is configured with a Level of "User Level".- Distribution Method is "Install Automatically".- AD CS Server Integration configured and worki

Not being a troll, just want to know the real world options for me here.I have about 20 devices in JamfNow, and its going pretty well. I dabbled in Intune and there is just too much going on there, and I run into more issues than not.That said, Im looking to commit to either going back full time to JamfNow, which is where this question came from. Is there a value to going to Pro if Now seems to be just fine?

Hello, do we have any other way to block major os update aside from using the configuration profile (restriction - > functionality then defer for 90days) and restricted software in JAMF? Is there a plist that we can configure and upload or maybe a script to block the OS update and stop it from checking an available update?

I'd like to create a new user via policy that is enabled for FileVault 2/has SecureToken. As noted in the Local Accounts payload, the "Enable user for FileVault 2" no longer works in anything beyond 10.13. After doing some digging, the only solution I have come across to do this is using sysadminctl to grant SecureToken to the account after creation. This is something I'd like to avoid if possible since it requires passing not only the credentials for a SecureToken-enabled admin through a script, but also the credentials for the account to be enabled.Are there any secure methods to achieve this? 

Hi all, since system 10.14 we have been using a script that calls some policy triggers during "enrollment complete" and forces certain apps to install (chrome, firefox, microsoft company portal, office365 etc).  Since using 13.1 as the base we are seeing random installs failing during this process.  Sometime chrome is failing, sometime office365, so it's randomly not liking the install.  I feel like it must be another process that is running that is causing a conflict (perhaps the app store installs of pages numbers keynote and GarageBand and iMovie?), but I'm not sure. Anyone else seeing this?  Also running the same installer again seems to go through without error.  Wondering if i can maybe modify the script to check for errors and try a 2nd time if it fails."Installation failed. The installer reported: installer: Package name is Microsoft 365 and Office for Macinstaller: Upgrading at base path / installer: The upgrade failed. (The Installer encountered

Hello all!We have been having an issue lately where machines will start their prestage installation process (policies, app installs, scripts, etc) that we run on first setup BEFORE the user is able to even log into the machine via Jamf Connect 2.Previously the user would boot the machine for the first time and it would go through language selection > warn them about Company MDM setup > ask for location > then prompt for a Jamf Connect 2 login. It would wait there until logged in by a user THEN begin the full 10-15 minute setup. It would finally end with a reboot and come back up to a local login and the user would be able to log in without issue because it created a local user for them during that 10-15 minute setup.Now, the setup will begin nearly immediately after warning them of the Company MDM setup (about the same time as it asks for location. If a user gets distracted and doesn't log in at the JC2, it will go through its install then finish with a reboot and come back to

Hi Jamf community. I've been having some trouble understanding if the following is even possible, so I thought I'd post here to see if anyone has any ideas or has tackled this in the past.I have an EA I created, which gets the expiration date of the machine 802.1x issued certificate. It converts the expiration date into a "Jamf friendly" format, such as 2023-08-10 10:05:00. It reports that (if found) as the result in the EA.The problem I'm having is, I want to build a Smart Computer Group that uses this information to show me any Macs that have these certificates that are going to expire in say, 30 days from now. I can't seem to use any of the built in date operators to make this work. Neither the more than x days ago or less than x days ago criteria will give me what I'm looking for. They seem to only work properly with dates in the past and not ones in the future. And the before (yyyy-mm-dd)and after (yyyy-mm-dd) options wouldn't make sense to me it seems, since these would be consta

Here's our setup:Enrollment Customization with SSO login that passes the username and full name to Jamf Connect so once the user hits the Jamf Connect login screen for the first time they are only prompted to verify the password.They enter the password and their account is created We recently got SecureW2 setup and it is passing certs to my test machine at the computer level, so it is a system cert. The machine connects to the Wi-Fi automatically if you are on the desktop already, or if you do the setup while connected to ethernet.  So now the problem:If I connect to our Wi-Fi network during enrollment, I can sign in using my credentials and approve the on-prem server issued cert and connect and go through the enrollment process, which includes Jamf pushing the SCEP cert and checking the logs on SecureW2 the cert is pushed back to Jamf and so Jamf should be pushing it to the machine. Unfortunately, as soon as I hit the Jamf Connect Login screen to verify my password, I h

So I'm distributing app via Policy + Package, but I'm not sure how to "enable" the option to install such app only when the user wants to, so something that people can click as "available to install", not mandatory installation that all pc get.

HiI'm looking at maybe using Jamf Connect, with our Okta environment.So if i understand this correctly, during a login process for a user, they would turn their MacBook on, already be connected to their wifi, and just login using their Okta creds.Our Okta environment is configured to only allow login from trusted IP's (e.g our VPN)How can our users login using Jamf Connect, if the VPN hasn't been activated/enabled yet (e.g before the macbook login process has occured)Thanks

Hi! I am guessing I can use the Jamf Pro API for this on a wrapper script cronned on GitHub Actions.Could you please provide an example of using the API to re-apply en existing profile to the current laptops it is scoped?Thanks!IMPORTANT: If you wonder why I want to do this: It is because users need to disable Wandera for accessing certain wifi hotspots and sometimes they forget to re-enable it. Therefore, re-applying the profile to all the users will automatically re-enable Wandera for them.

Oh, hello there! Welcome to the Jamf Nation forum! As a member of our fine community, you may need to occasionally post a question or comment specifically about the Jamf Nation platform. That’s the purpose of this forum.    If you have product feedback in the form of a feature request for any of Jamf's products, including Jamf Nation, continue to submit those via the Feature Request portal.   As always, thank you for being a part of our great Jamf Nation!   -Calley

Hello. I work for a small school district. We only have the Elementary and Middle School buildings. One of our staff constantly goes between buildings. However when they do so they begin to lose apps etc. This is due to the different network ranges we have set up.Same SSID name just different ranges. Any advice? Thanks

Hi folks,for a few weeks now we've been getting messages that the inventory has failed. The log looks like this:An error occurred while running the policy "Update Inventory" on the computer "xxx". Actions from policy log: Executing Policy Update Inventory Running Recon... Retrieving inventory preferences from https://xxx.jamfcloud.com/... Locating accounts... Locating package receipts... Searching path: /System/Applications Locating software updates... Locating plugins... Locating printers... Searching path: /Applications Locating hardware information (macOS 12.2.1)... Software update timed out after 300 seconds. The complete policy log is available in the JSS at: https://xxx.jamfcloud.com/policies.html?id=1&o=l Computer Info: ID: xxx IP Address: xxx Serial Number: xxx Can someone tell me what's going wrong? The inventory there for too long and then he breaks it off?Regards

Hi Jamf nationFor user level configuration profile to get applied, is required that the account is MDM-enabled User.We no longer bind our Macs to the active directory, instead we use local admin account with Apple SSO Extension for the connectivity to the AD.Using ADCS, we were able to deploy certificates in computer-level configuration profile and everything works smooth and flawlessly.As most of our users still have incorrect MDM-Capable user, is a reenrollment to fix this issue not an option for us.Did someone find any solution for fixing the MDM-Capable user?Any other ideas to fix this without reenrolling the device?

I'm hoping that someone else may have gone through the same workflow that I'm attempting to follow and may have some advice on how to solve this conundrum.Background:We have around 130 Intel Mac laptops and desktops in our environment, all are currently running Catalina. Unfortunately, we haven't been able to consider updating to Big Sur or Monterey until recently due to some issues with software compatibility, but now that those issues are resolved, we can finally start looking at migrating our Intel fleet to Monterey. We also recently migrated our users away from logging in with AD on-premise via Jamf Connect and Azure authentication, and as a part of that migration we deployed computer certificates with a WiFi profile for 802.1x authentication to our internal wireless network. Prior to the Jamf Connect and WiFi profile deployment, upgrading Catalina to Monterey was flawless, with the exception of the security software conflicts. After the Jamf Connect deployment, however, things hav

Hey folks, Im trying to create a Self-Service policy that will Disable or Enable the "Smart Quotes" keyboard feature in system preferences. When I run this code in my Coderunner app it works perfectly, but as soon as I load the script in the into a Self-Service policy I seem to have issues. The policies behavior looks good, popup comes up but the setting does not change. Any ideas? Thanks in advance   #!/bin/bash #Grab current logged in user user=`ls -la /dev/console | cut -d " " -f 4` #Check smartquote status currentstatus=$(defaults read NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled) #SwiftDialog Location dialog="/usr/local/bin/dialog" #DISABLES if [ $currentstatus = 1 ]; then $dialog --message "You are about to disable Smart Quotes" --icon "/usr/local/images/deepwatch-Logo.png" --mini --button1text "Disable" --button2text "Cancel" sudo -u $user defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -bool false sudo killall Finder fi #