We have JAMF Connect for Office365 but everytime we run a MacOS update it breaks the authchanger and we have to run sudo authchanger -reset -JamfConnect.  I was thinking of running a script that runs this every restart but assuming it doesn't run until after the login which won't work. What are others doing for this?

We currently have Activation Lock disabled in PreStage, and users are prevented from logging on to System Preferences with their Apple ID (personal Apple IDs, not MAIDs). However, we have not always had this in place and some users have enabled Find My. Further, for some Macs we are looking to fully decommission them and either sell to a reseller or give to employees (that is, remove from Jamf and ABM). An important note here is that a user isn't necessarily getting their old Mac, so they won't have the Apple ID creds.. So I have some questions on how this works to try to minimize work in either getting these out of Find My or identifying the ones that we can't clear:1. If I wipe via Jamf and clear Activation Lock, does that also remove it from a user's Find My, or is that separate? That is, once that device is no longer in Jamf or my org's ABM and the device is wiped, will the user get either notice that it's in another user's Find My or be activation locked?2. If the device is in a u

Might someone have some insight and clarity on how to deploy Digital Guardian via Jamf.I have a lot of experience with security agents in Jamf: Crowdstrike, FireEye, Tanium, Netskope, but it seems Digital Guardian is a mystery. I have a shell script and I believe the are some Config Profiles to configure. It could be extensive or rather straight forward, but from the version 7 documentation it's not clear at all. And I believe version 8 is for Big Sur 11.6x and Monterey, using SYSEX.... Thanks so much....

Hi All,I did integration between Intune with JAMF pro with could connect. Both sides the connections show as the active state. But mac machines "Machine Azure Active Directory ID" , "User Azure Active Directory ID" and "conditional access inventory state" are empty. I followed below steps and the connections showing as active. may I know any other steps need to be done to get the machine Azure ID in JAMF.?1. created app registration from Azure2. Created conditional access from JAMF ( Global settings -> Conditional Access) 3. Partner device management the connection showing as active 

Is it possible to create a configuration profile for either iOS or iPadOS that could automatically set my device to use the full brightness / auto-brightness? We have a few iPads deployed as kiosks, and we'd, ideally, like to be able to set the brightness to full on all of them. 

We just rolled out jamf connect to a test environment and we're noticing a few things.If you restart you don't get the jamf connect login window. It wants a user to login with their password. What is the workaround for this? Is there a way to force user log out after a restart or power outage?Also our file vault settings are set to personal (individual), but jamf is not recording the key. It says no key present. Any ideas?I saw a post on jamf Nation saying the only option is to disable file vault on computers running jamf connect. Is this true?

HiHelloI am looking for a solution to the problem of retrieving user information from google cloud.The problem is that I am connected to Cloud Identity Providers -> company name - mapping. I can perform a test and find people from my organization there, there is a full list of data from google cloud - what I need.However when enrolling a laptop where the user has to log in after SSO. Policies are downloading, laptop is configuring but I don't have any information either in user data or in Computer -user and location.What could be wrong here?I tried to wait, wait a long time (more than 24 hours even though I have a checkin for 5 minutes) - I tried sudo jamf recon and nothing.   

We had a bunch of devices stop checking-in, seems Jamf process had hung but we are not sure why.I’ve managed to get most up and running by asking user to restart or issuing a self heal via API which reinstall Jamf silently on the Mac, just had to exclude those devices from any enrolment triggers.I’ve still got 30 devices that look active as I can cross check in our IDP to see when the Mac last signed in.Self heals are pending on these Macs I’m guessing not running as also a APNS cert issue(?) and as said no check-in or inventory updates.Any other ways to silently fix, ssh is not an option. I don’t fancy raising 30 tickets internally for our Service Desk to look at.

Hello,We have noticed that several of our M1 MacBook Air are not accepting user password even though it is correct. Now we do have another admin profile that is added during enrollment for password reset. When we try to rest password for that user through other admin profile it says password reset failed. We have tried password reset with terminal same issue occurs. The OS is Monterey on most. This is happening with devices that have been enrolled almost year ago and newly enrolled device. Solution is to wipe it set it up again but we don't want to lose data. Any suggestions ? 

Hello, We are using google workspace & all the MacBooks are connected to Google LDAP for Login. Recently I saw an issue where the device are not accepting the password. It simply reject the password even if its correct. Initially I found out that if the device is connected to wired internet(Wired Hotspot) then it accepts the password. (But this is workaround & not feasible for all users).Also it doesn't show the wi-fi sign to make sure if the device is connected to internet. Any solution from Google/Jamf to avoid this issue? 

I've added "Number of Available updates" to my Computer Inventory display, and noticed every computer lists 0 for SWUS. This is very suspicious and in my experience pretty improbable with over 75 computers. On my own laptop I can see in system preferences:"Updates are available for your mac"macOS 10.14.5 UpdateiTunes Device Support Update After running a sudo jamf recon and policy for good measure, I've confirmed my computer information is up to date in jamf, but still says SWUS = 0. I'm not sure whats going on here, I've never had this problem with past organizations.

nwresolverstartquerytimerblockinvoke[C1] Query fired: did not receive all answers in time for API ADDRESSShows the same error even while using HTTP or HTTPS.Error persists even after updating info.plist with the security settings of the app transport Anything?Arlo login my.arlo.com 

Hi all,  i'm working on the CIS benchmarks for Monterey and i'm stuck at these points : Ensure Security Auditing Flags For User-Attributable Events Are Configured Per Local Organizational Requirements (Automated) Ensure install.log Is Retained for 365 or More Days and No Maximum Size (Automated) Ensure Security Auditing Retention Is Enabled (Automated) Ensure Access to Audit Records Is Controlled (Automated) Ensure Sealed System Volume (SSV) Is Enabled (Automated) Ensure Appropriate Permissions Are Enabled for System Wide Applications (Automated) Ensure the Sudo Timeout Period Is Set to Zero (Automated) Ensure a Separate Timestamp Is Enabled for Each User/tty Combo (Automated) Ensure the "root" Account Is Disabled (Automated) Alert when the log capacity is over 75% Alert user & admin about audit logging failures Dedicated user to decrypt the hard disk upon startup Shut down the system if audit logging stoppe

Hi,I've been trying to automate my package Management using AutoPKG but I could not find a solution to automate the Patch Management completely. I am using Title Editor for my patch definitions.However, I can not find a solution to automate the creation of new patches on Title Editor and without that the automation of the rest is not nearly as useful as it would be with that part also automated. Can anyone point me in a direction where I can find a solution for this?Also: What is your workflow for patch management? I am fairly new to this and could use some tips.Kind regards

Thanks to @brysontyrrell for all his hard work. Extending the JSS via the API. https://github.com/brysontyrrell/StaticGroupFromSearch

Hi everyone,I've set up a test PreStage Enrollment, where a local admin account is created. In addition to that account, the local user account that gets created during the Setup Assistant, is a standard account (we don't allow our users to be admins). Our FileVault 2 configuration profile is set to be enabled at login, which works fine for the standard user. The first time this user logs out and logs back in, the FV2 is enabled. However, that leaves the admin user, which is still not FV2 enabled. How can we remotely enable FV2 for this user, without the end user having access to the admin user's credentials and logging into that account, just to enable FV2?Thanks!

I'm wondering if there's the ability to apply a Mac's previous name as it is in Jamf, at the time it is reenrolled or as a post-re-enrollment process after it has been wiped and reloaded with a fresh OS.  Right now there is the ability to create a policy to run with the “Enrollment Complete” trigger and possess a Maintenance payload with the “Reset Computer Names” checked.Unfortunately though when enrollment completes, before the aforementioned policy has a chance to run, an inventory update is run (a built-in part of the enrollment process) which of course causes the Mac’s existing name in Jamf to be changed and overwritten to the default “iMac” name it automatically gets when installing an OS.By the time the above "Reset Computer Name" policy runs, the Mac’s name in Jamf has already been set to the generic “iMac” due to the forced inventory update at the time of enrollment.We currently name our Macs based on location (building and room number) along with the asset tag

We are trying to find a way to block the Freeform app on iPadOS 16.2 for our K12 District. We normally would use a Restriction Profile using the SafeList and Blocklist Payload but I do not see an option for that app. Does anyone have a script or way to block?

@pixeleyesltd We have 30 licenses of AutoMounter that we purchased through Apple Business. The app. distributes with no problem, but after maybe several weeks it stops working and I get an error message. At such time I have to un-scope, delete the app, and re-scope to reinstall to get the app. to work again. Has anyone else experienced this issue? 

When our Devices are wiped and setup for a new teacher the EDU Profile is not installing, thus Classroom will not show student devices online. I have had the profile installed on the device, but the moment we wipe the device the profile will not reinstall.  I have checked the Inventory Profiles / Mangement Configuration Profiles / and Management Groups  - Smart and static.  I have insured all the profiles are setup the same way.  same groups, etc. We are refreshing our teacher fleet of ipads and this is causing issues and making them unusable for classroom.

Is there a way to restrict End Users from viewing Profiles in Ventura?We usually block this on Monterey Macs, however on our test Ventura devices it appears to have been moved to Legacy Disabled Preferences:The only issue we have with people being able to see these is they can add profiles.

Wondering if someone could help me with Patch Management on Jamf Pro on version 10.42.1, Currently I am associating InstallAssistant.pkg's for the version i want to update to in patch management, i.e. installpackage.pkg for 13.1 from MrMacintosh's website and creating a patch policy to have it available in self service or force if not installed within 3 daysBut nothing is happening with either methods it downloads the package and does nothing with it. what would i need to do to make it actually install/update?

We’ve come across an issue with Cisco AnyConnect where the connection option we use (called client_installed_local) appears fine on Intel Macs, but does not appear at all using the same version of AnyConnect on M1 Macs. We’re using AnyConnect 4.10.04071.How our setup should work:User connects to the VPN serverUser is then prompted to choose options for connecting. Client_installed_local is the first option, and what the user will be choosing.This then kicks the user over to Azure MFA authentication.Once authenticated via Azure, the VPN connectsOther facts:The installer package is the webdeploy core vpn package, pulled from the predeploy package. I have been told we don’t need anything else.Our previous versions all used the webdeploy package. There is nothing special about these that I can see.Tested on macOS 12 and 13 on both the M1 and Intel sidesOlder versions ran on everything from 10.14 up to 11 without issue on IntelsHere’s what I’ve tried:Reviewing and implementing a Configurati

Hey guys, The management is thinking to move from Jamf Pro to Intune to manage our Macs, I've never worked with Intune before and would like someone who is using it to tell me about their experience : - Is it really good MDM for managing Macs?- Comparing to Jamf, which one is better?- Any downside of moving from Jamf to Intune?Hope someone can shed some light on these points.Thanks in advance 

I've read through a few posts already, stating to compress the pkg as a zip first, then upload to JAMF, but I'm having the same issue. When I try to install the package directly on the machine, it works fine. But if I install it from JAMF via a policy, it errors:The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance.Not sure what else to try at this point. It happens on both Monterey & Ventura.