We are reviewing the permissions given to people that need to enroll their device (macOS only) by either DEP/ADE or user initiated permissions.First question, do DEP/ADE and user-initiated require the same permissions?Second question, what are the minimum required permissions?The strange thing is that the permissions for :Allow User to EnrollAssign Users to ComputersAssign Users to Mobile DevicesEnroll Computers and Mobile Devicesare not assigned, but no one reports any issue.When looking to the default role that allows people to enroll their device it seems to assign way to much.Anyone that knows the ins and outs?

Today we are releasing a maintenance version of Jamf Pro.   Jamf Pro 10.42.1 fixes the following product issues:   [PI110600] Updated a third-party library to resolve a known vulnerability (CVE-2022-42889). [PI110632] The device inventory record no longer fails to load due to a blank "priority" value in a database column.   Review the release notes here.   To access new versions of Jamf Pro, log into Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Pro.   Cloud Upgrade Schedule   Your Jamf Pro server, including any free sandbox environments, will be updated to Jamf Pro 10.42.1 based on your hosted data region below. Review this guide if you need assistance identifying the Hosted Data Region of your Jamf Cloud instance.   Hosted Region Begins Ends ap-southeast-2 4 November at 1300 UTC 4 November at 2200 UTC ap-northeast-1 4 November at 1400 UTC 5 November

Long story, but I'll try to keep it short. We have Jamf Connect in our environment linked to Azure for user authentication. We wanted this product because it has built in password change features that would synchronize the local system password with the users Azure (network) password and remove the need to bind our Macs to on-prem windows domains. Also we're a mixed environment of Windows and Mac system moving towards Azure cloud services and this would allow us to us ZTI for mac users. When we click "Change Password" nothing happens. We were able to temporarily resolve this issue by updating our Jamf Connect installs, but this only resolves for maybe 2-3 weeks before we noticed the same issue return, this is effecting all our Jamf managed macs. I engaged with Jamf support and they requested logs, suggested updating (again) had me try different default browsers. All the same results. Nothing happens, EXCEPT for a short time after updating the Jamf Connect client when it

Hi, We have recently deployed Azure AD SSO (and Azure AD DS) to login to our Jamf Cloud instance. It works great apart from SSO, every 24 hours we have to reset our web browser data to login to Jamf Admin. Any ideas on how to make this more reliable? I's guessing its something to do with 'Token Expiration (Minutes)'. Should I just increase this to a few weeks?

Currently Running:iMac 21.5"macOS Big Sur 11.7.2 When attempting to log in, we receive a pop-up screen from "Managed Software Center" it has the loading bar bouncing back and forth and it is attempting to install "HPPrinterDriverxxx.dmg" and perform "Postflight Tasks..." Our postflight tasks are running jamJAR v1.1I have removed the HP Printer Driver from Munki and any other places it might be trying to pull from. But we are still getting this pop-up message at the login screen attempting to mount the DMG (HP driver) and perform the postflight task. Sometimes it's on the postflight task in the "Managed Software Center" pop-up.This pop-up is preventing users from logging in because it is stuck on a loop. It will disappear for a couple of seconds and then reappear. Restarting the computer resolves this issue for about 15-20 minutes but then the problem presents itself again.We have attempted to completely re-image these machines from JAMF to no avail. Removed any policies/packa

Hi All,Wondering if anybody else is seeing this. On two Macs running Sierra - one is on latest 10.12.1 beta, I'm getting a Killed: 9 error when trying to create USB install media using createinstallmedia command: $ sudo /Applications/Install macOS Sierra.app/Contents/Resources/createinstallmedia --volume /Volumes/Install macOS Sierra --applicationpath /Applications/Install macOS Sierra.app Ready to start. To continue we need to erase the disk at /Volumes/Install macOS Sierra. If you wish to continue type (Y) then press return: Y Erasing Disk: 0%... 10%... 20%... 30%...100%... Copying installer files to disk... Killed: 9 I can run the command over and over, sometimes it is killed immediately, other times after a few mins. Can't find a single thing in the logs about this. Any ideas? Just me? Thanks!Matt

Hi everyonei'm trying to understand the best way to configure Jamf Protect with our jamf instance. I set up a smart group in jamf to alert users about security issues and that works fine.Unfortunately the jamf protect documentation is a bit incomplete imho. What are the next steps i need to follow? Any suggestion or guide to suggest?Do i need to manually remove the mac from the smart group?Jamf Protect has some removing capabilities or i need to clean the mac manually?

created a new policy for a 2023 version of some software. Tested new policy in prd in a limited scope. result=successThen widened the scope of the new policy to include the actual production machines. In the logs for the new policy, I'm seeing results from the old policy. it shows completed but the dates caught my attention so I looked at the details and sure enough it's the logs from the previous policy for an earlier (2019 software version) package install.  

Is anyone having an issue enrolling machine this morning?I get this error right after the remote management page, This Service is Temporary Unavailable.

I'm setting up the Jamf Pro on Windows Server 2022 and getting this error: Not sure how to get past this. Tom cat is already installed and running..

Greetings Jamf Nation denizens, I've recently tried to begin utilizing Patch Management features within JAMF Pro but have met some issues. I'm attempting to use the automatic distribution method instead of administering it through Self Service. I have confirmed that the Patch Policy has a defined scope with an eligible machine, but it remains stuck on "Pending". In this particular example I'm trying to update Google Chrome. Upon reviewing the logs, it appears a patch policy called just called "macOS" is being distributed to the device. This particular patch policy is titled "Google Chrome Patch Policy" so I would expect to see that being pushed in the logs.  There are no Patch Policies set up called macOS in our JAMF Pro server. Other Patch Policy logs show this same policy. When running a sudo jamf policy command on the machine, it returns the "No patch policies were found" message, and remains "pending" in JAMF Pro. Is there a way to fully reset or flush

Hey Jamf Nation Community members! I'm Kate with Research & Insights team here at Jamf, and we're looking to learn more about Mac admins! We've put together this quick survey. It will take 5 minutes to complete. And all survey responses are collected anonymously.SurveyMonkey Link

Hi,Have a few computers with Visual Studio Code installed. Users do not have admin rights on the computers, And should not have this. Now the users want to run the debugging process in Visual Studio Code. But they are prompted to write credentials to be able to run Developer Tool. Users need to be part of Developer Tools group to be able to run this. How do I solve this from Jamf Pro ?

Hi,I need some suggestion for local account creation using Jamf Connect Prestage. I am using Azure SSO part for account creation. Now all the local accounts are created with Admin privileges. I am planing to bring admin restriction in place. No one get admin rights from the beginning. I am using below Jamf Connect Config profile to create local account. I need some suggestion to make changes here, by default users creation should be without admin privileges.-----------<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>CreateJamfConnectPassword</key><true/><key>EnableFDE</key><true/><key>LAPSUser</key><string>admin</string><key>OIDCAdmin</key><string>Admin</string><key>OIDCAdminAttribute</key><string>roles</string><key>OIDCClientID&

Im trying to create a self-service policy with a script that will disable the "smart quotes" system setting but am running into issues getting this to work.   defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -bool false   Above command seems to work fine when using it on my local device but when trying to use this command in a jamf policy, no luck. any ideas on how I can get this to work? Thanks in advance. 

Godo evening,a quick question, please: One of our applications is available as pkg installer but also as a "Jamf App Catalog" application in the Devices > Mac Applications tab. My understanding is that for the Application install pathway I can "enforce" updates via a configuration profile for System updates (or it should be enabled as the specific app says "Auto update disabled: no" whereas for the pkg installer I can create a patch management with subsequent definition of the latest package and a corresponding Patch Policy. The pkg pathway has the benefit of more granule scoping, however I am wondering what the general consensu on best practices is here?

Nudge Post-install (0.0.17) includes updates for Nudge (1.1.10)AboutConfigures Nudge via the Nudge Post-install script to create:LaunchAgent: Opens NudgeLaunchDaemon: Redirect LogsLocal JSON: Configures NudgeHides Nudge: Finder & LaunchpadReset function: Policy Script ParameterContinue reading …

Hello!I'm trying to use VPN Idle timer for mobile devices in Jamf Pro. After setting Idle Timer parameter for "1 minute" example, after saving configuration profile, Jamf sets this back to "Do not disconnect". Does anyone have ideas why Jamf doesn't save my option correctly?

So I have been looking for a way to have an extension attribute that reads all of the email address inside outlook and in mail. I am new to this and still learning on how to make things work and write code.  If anyone knows of anything that could even help me out I would appreciate it a ton.

We are getting the above error on few devices with VPP app. I saw lot of post regarding the same but no solution worked. Any alternate working solution?  ThanksJamf Pro 10.35.0macOS 10.15.7 

Hi,I'm currently experiencing an issue regarding pushing out ibooks to our student iPads. Out of the 400 students we pushed the books out to, only 30 have received them. I'm aware that books can only be distributed to Apple IDs and all students have MAIDs created in ASM and synced over to jamf school, and the ibook licences were purchased in ASM. Looking at the users where the process failed, the status for each student reads, 'The VPP user can not be found, please try to invite the user again'. However, looking at each students' profile, their service token status reads as associated and valid. As a side note, some staff members are having the same issue. Other staff members are having different error messages which reads one of the following:'Device owner is not associated, current status is Registered. Service token status: Invitation sent''The device’s user has not been sent a volume purchasing user registration invitation. Service token status: Associated'Any h

Hello,Can anyone help me, how we can change the JAMF cloud host name I.e, url for login JAMF console. For Example, I am having an URL x.jamfcloud.com and i am wanted to change it to y.jamfcloud.com Regards,sahasrarka

I have a 90 day delay in place as well as restricted software payload to kill the installer. However, some computers Ventura still show up on and is still able to install, others it displays correctly "your on the most current OS allowed by your administration". These are both applied to the same static group I don't get what is going on. I'm frustrated and feel like nothing works right in Jamf. Help!  

xpath is not super intuitive. Maybe I can clear up 1 tiny little thing here...First, a resource I go back to again & again: Xpath cheatsheetSecond, xpath is a querying language. It can look complicated, but, a way of simplifying it is to think of the syntax as an analogy: exposing xml data as a "file system" & the thing you want to "get" as a "file". Your xpath query is the "file path". Elements, in the analogy, are "folders" with stuff in them: one thing, many things, etc. E.g., you might want all IDs for some object in Jamf Pro (let's say policies) so maybe you tried: curl -Ss -X GET -H 'accept: application/xml' -u "$apiuser:$apipswd" "$jamfurl/policies" | xmllint --xpath "//id" - | tr '</id>' '\\n'​ Not great because you are stripping the xml data structure & tr often outputs strange results.Then maybe you looked at the xpath cheat sheet or took a Jamf course & discovered the magical text() command which strips xml tags! curl -Ss -

Hello, I've been using Jamf Pro at our school for a while. We manage approximately 350 iPads that are loaned to students.Occasionally we will put a device into "Lost Mode" if we need the student to contact us for some reason.Now our problem: If the lost mode was activated and the students switch the device off and on again, there is no longer a connection to the WLAN.Now I can't turn off Lost Mode and have to do a full reset via iTunes.Is there any other option? Can I connect the iPad to the computer running Jamf Pro with a cable to unlock it?If I reset the iPad, all of the student's notes are gone. He didn't make a backup.