Today we released Jamf Connect 2.19.0. This release includes the following changes and improvements:   • The Jamf Connect menu bar now reports to Jamf what settings are configured on computers.This data is used to assist our development teams and align with customer interests. This data does not include any Personally Identifiable Information (PII).   • The Disable Update Watcher key for the Jamf Connect login window has been added to allow for the Update Watcher to be disabled. When the key is set to true, the login window will remain installed during any macOS updates rather than being uninstalled then reinstalled automatically after the update. The key is now available in Jamf Connect Configuration and the Application & Custom Setting configuration profile payload in Jamf Pro.   To access new versions of Jamf Connect, log in to Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Connect.   Product Documentation &nb

I'm planning on taking the JAMF 300 course but before I do I wanted to work on familiarizing myself with scripting. Any good recommendations for a scripting course I can take? Thanks

Team,If, netskope is deployed through Jamf Pro then as an administrator... is it possible to disable it for a while in the new macOS ventura because in Ventura we are not able to find the option to disable this and earlier it was there in macOS Monterey 

Hi all, I’ve recently set up and introduced Jamf Setup and Jamf Reset for use on our shared devices. I currently have Jamf reset set to a soft reset which should log the user out and end SSO session thus logging users out of any pages they signed into. However this doesn’t seem to work, the user is logged out of the JAMF Setup session but remains logged into any apps they signed in on specifically Google applications. I’ve attempted to have these apps uninstall and the reinstall when the user logs out and have also selected the option to prevent chrome saving data but as soon as the app is reinstalled the account is there again. Any ideas what I can do other than hard reset after each user? TIA

Hi all, I’ve recently set up and introduced Jamf Setup and Jamf Reset for use on our shared devices. I currently have Jamf reset set to a soft reset which should log the user out and end SSO session thus logging users out of any pages they signed into. However this doesn’t seem to work, the user is logged out of the JAMF Setup session but remains logged into any apps they signed in on specifically Google applications. I’ve attempted to have these apps uninstall and the reinstall when the user logs out and have also selected the option to prevent chrome saving data but as soon as the app is reinstalled the account is there again. Any ideas what I can do other than hard reset after each user? TIA

At JNUC, there was a presentation on an easy way to setup Wandera DNS filtering. I followed it and had a great configuration integrated into our Jamfcloud. It has deployed to all our clients and I'm seeing data. It was awesome.Is there anything like that for Jamf Protect?  A quick walkthrough of setting it up, configuring it, linking it to Jamfcloud, and deploying?  I know there's a lot of documentation, but it's a bit overwhelming. I'm looking for an easy deployment guide. Once it's deployed, I can go through more of the documentation and tune it.ThanksCyrus

Hello! I am very inexperienced with scripting, so tell me if i'm in the wrong place. I want to have a simple script execute the following (at a user level): defaults write com.apple.loginwindow TALLogoutSavesState -bool false I have a few scripts (for mounting network shares) that I run using Outset when the user logs in. I'd like to do the same with this one. Any guide on how to call this command as the user?

With Apple devices continuing to gain major prevalence within both educational institutions and businesses of all sizes, it’s becoming increasingly important for organizations to manage not only their devices but also the Apple ID that the user signs-in with. This is where Managed Apple IDs come in. While you can restrict the ability to sign-in to an Apple ID using an MDM solution (or our team can do this for members of our own managed service offerings), in doing so you are denying users key functionality and features, such as iWork collaboration and iCloud Backup. This article aims to highlight these benefits and discuss how to leverage your organization’s existing Microsoft 365 accounts as Managed Apple IDs to give your users one fewer log-in to remember. That said, it should be pointed out that it remains best practice to disable signing-in to any Apple ID on devices that aren’t permanently assigned to an individual user and Shared iPad isn’t being used. This is most common in smal

Certificates and the technologies surrounding them can be a difficult topic to understand. In this series, we’re going to break down the underlying concepts around these technologies in a straightforward, easy-to-understand way. In our first part we will cover the basics of certificates and how they work, and in the future we’ll talk about SCEP, AD CS, 802.1x, and more. What is a certificate? A certificate is a unique, digitally signed document which authoritatively identifies the identity of an individual or organization. What makes up a certificate? A signed digital certificate contains the owner’s distinguished name, the owner’s public key, the certificate authority’s (issuer’s) distinguished name, and the signature of the certificate authority over these fields. There are often other fields, such as Country, State/Province, City, Organization, Department, and more which can more accurately identify the certificate or the object which the certificate identifies. These fields aren

Welcome to Part 2 of our discussion of Certificates, SCEP, and 802.1x. In our first post we took a look at what certificates are and how they work. Today we will take a look at Active Directory and Active Directory Certificate Services. What is Active Directory? Active Directory (AD) is a set of roles and features which run on Windows Server. In essence, it is a database and set of services that connect users with the network resources they need to get their work done. Active Directory is often used as a broad term to describe several concepts and services. There is much, much more to AD but this isn’t a Microsoft AD course, so we’ll only cover what we need to know here. What does Active Directory do? At its core, AD helps administrators manage permissions and control access to network resources. AD uses several directory objects to do so: Users Groups Computers Security Policies (Group Policy Objects) Active Directory manages the security policies applied to its many moving parts

Easily allowing your end-users to opt-in or opt-out of your internal beta program is the first step to building your user-base of “trusted testers.” Let's take a closer look at how we implemented this via Self Service, and how we utilized the combination of an Extension Attribute and Inventory Update to populate our testing group, rather than the Jamf Pro API. This type of workflow can be used for implementing your own beta test group, or it can be used in conjunction with other workflows where you want users to self-report. This workflow was originally posted to my personal blog, which you can find by following this link. Additionally, I've documented some related workflows and spoken about our beta test program at JNUC. Feel free to take a look at the links below if you would like to learn more:Dan K. Snelson Blog - Your Internal Beta Test Program: Opt-in / Opt-out via Self Service (sans Jamf Pro API) Dan K. Snelson Blog - Invitation Only Betas JNUC 2019 - Your Internal Bet

What are Extension Attributes? Why were they added to Jamf Pro and why do they matter? These questions, and others, will be answered in this short post. Extension Attributes can be a powerful tool in the tool belt of the Jamf Pro admin, and we will dive into them a little deeper in this post. At the end, you should have a working knowledge of Extension Attributes, a few workflow ideas, and some further resources to continue on in your journey to become an Extension Attribute guru. So buckle up and let’s go on a journey!   What Are Extension Attributes? Introduced in the Casper Suite days, Extension Atributes are a method for extending the data stored in Jamf Pro for an object (computer, mobile device, or user). From our developer documentation: Extension attributes allow Jamf Pro to store additional inventory information about a device beyond what is collected by default. Their values can be set via API call, or through the Jamf Pro console itself. While Jamf Pro is designed to co

Originally this article was posted on Jamf Nation here, prior to the launch of Tech Thoughts. tl;dr - Getting an "MDM-enabled user" and user channel for configuration profiles has become unobtanium.  Pretend that macOS is like iOS or iPadOS, where all configuration profiles and certificates are scoped to the whole machine. "Managed Users" A user who is "MDM-capable," "MDM-enabled," or in the Apple MDM spec a "managed user," can be achieved in a few ways: First user created by Setup Assistant when machine is first set up via Automated Device Enrollment A user with administrator rights initiates a user enrollment via an enrollment URL or renewing the Automated Device Enrollment with a profiles command Mobile accounts (aka bound to a directory service) where during login there is a token registration with the MDM. For reference, see Enabling MDM for Local User Accounts and from apple.com Prepare for changes to kernel extensions in macOS High Sierra For a configuratio

First, let me start off by saying you should never use basic auth for anything, anywhere, at any time.   Next, let me tell you why you need basic auth or “Resource Owner Password Grant” or “Resource Owner Password Claim” (if you speak Microsoft) or “Resource Owner Password” (if you speak Okta) or just plain old “password” (if you read the ancient runes of the .well-known/openid-configuration endpoints).  I promise you it’s a good reason.   What is ROPG The basic password flow used by Resource Owner Password Grant (ROPG) is literally an endpoint receiving a user name and a password and returning something to say the password is good, bad, or other. curl 'https://login.microsoftonline.com/12345678-9abc-def1-0000-000000000000/oauth2/v2.0/token' \\ -X POST \\ -H 'Host: login.microsoftonline.com' \\ -H 'Accept: */*' \\ -H 'Connection: keep-alive' \\ -H 'Accept-Language: en-US,en;q=0.9' \\ -H 'Content-Length: 295' \\ -H 'User-Agent: Jamf%20Connect%20Configuration/2606 CFNetw

Maintaining user accounts in Jamf Pro can be daunting if you work in Education. Depending on the size of your district, you may have over a thousand staff and students enter and exit within a three-month span each school year. If your district is one-to-one, that’s a thousand new user accounts getting created each year. If you aren’t doing user-based app assignments, maintaining users may not even occur to you, but there are benefits to cleaning up user accounts in your Jamf instance. If your Jamf instance is on-premise, you know an integral part of the instance is the database. If your instance is in the cloud, you may not be aware of the significance of the database. With any database, it’s important to keep it healthy. By healthy, I mean stable, efficient, and secure. Bad data in a database can lead to inaccurate reports or, in the case of user base app assignments, wasted app licenses. Bloated databases can result in poor performance or the need to continually tune your Jamf instan

I originally posted this article on the Apple@CVTC blog, and you can find out more about JPS API Wrapper on our GitLab project. As a developer or anyone that writes code, managing APIs can be a time-consuming task. You need to a lot of time figuring out how to send requests, retrieve data, and process responses. In this context, API wrappers come to the rescue. An API wrapper is a package that simplifies the use of APIs by providing a unified interface for sending and receiving data. In this article, we will be discussing jps-api-wrapper, a Python package for the Jamf Classic API and Jamf Pro API. What is JPS (Jamf Pro Server) API Wrapper? JPS API Wrapper is a Python package that simplifies the use of the Jamf Classic API and Jamf Pro API. It provides a unified interface for sending and receiving data, making it easier for developers to interact with the Jamf APIs. With JPS API Wrapper you can easily retrieve data on devices, software, and other assets managed by Jamf, and even pe

Is there a way that we can delete printer that user added? we have a open directory that teacher can pick what printer they want to add. now we have new system that only uses one virtual printer, and we already push that one using LPD. what we want to happen is to remove all printer that they add and only printer one printer will stay the one that we push.

Have apple school manager setup, and trying to deploy iMovie to a test MacOS.  Using Self Service and when the user clicks install it spins then comes back with an error saying "Cannot Reach Jamf Pro Server".  We are cloud hosted, I have tried the machine off the district internet incase a Firewall issue was causing it.  No luck,I am able to deploy a custom package of Chrome from the Jamf Cloud distribution point.  I also have tried xcode also another free app and it still gives me the error of "Cannot Reach Jamf Pro Server"Mac Store Apps do not install 

Hey all, Not sure if this is the correct place to post this but here we go:Long story short - I'm new to Jamf (actually our whole company is). Now we are trying to renew the "client certificate(?)" because employee's are losing connection to the VPN due to the cert being expired. Eventually this will become an issue for our employee's in other countries as they cannot come into the office to retreive a new one. At the moment it's only valid for a year (if that gives you an idea what I'm talking about) I've seen a lot of people mentioning this issue but I haven't found a solution yet. We are in an on-prem environment using ADCS with Jamf. Feels like there should be a way to automate this? Is our configuration wrong somehow? Not sure why the Mac's are able to retreive these without issues when enrolling them but not renew them? Every suggestion on where to look are highly appreciated! I would also like to mention that i'm not familiar with everything so please be pati

Hey Jamf people! We are having a weird issue with our GlobalProtect certificate deployments.  We have deployed the certificate to our endpoints 10 days prior to expiration to make sure we don't have any expirations (leads to p0 outages).  This time is weird though, as we can see successful config profile (containing the new cert) deployments to endpoints, but on their machines, they retain the cert that is expiring soon.  Whats even weirder, is that it does not happen to all people we deployed the certificate to.  Has anyone ever seen this issue?Lukas

Below is a screenshot of the Jamf School Profile/Settings interface.I am confused about how to do this overall. Is the idea that you basically create holistic settings that are all encompassing for a type of device, and you put all of the things and stuff in one, and only apply "one per device" or is the idea to be granular and only for example configure the WiFi, Certificates, DNS Proxy if needed, and that's it.If the idea is to be more modular, is there any type of guide that covers which policies can conflict in which case it's a race condition to determine which profile is applied if there are conflicting settings that would prevent the other profile from applying?If I had to guess it should kinda look like this.Modular profile 1 - Connectivity related settings only. So WiFi, Certs, and anything needed to get your content filter to work on the device. Beyond that, I don't know. How should these things be chunked up, or should it be that beyond the connectivity profile, that it

is there a possible setting that erases all stored data on a supervised ipad after a certain time period of lets say, two weeks?I'm talking about clearing the photos, documents, files folders as well as app-specific folders like pages or keynote, or even third party apps.I don't know if Apple itself even has a function like that integrated, but maybe the jamf function may even overwrite that?Thank in advance already for your suggestions!Max

Good day JamF Nation.Hoping someone can provide some insight.i have a site that I manage and we use authchanger to either disable JamF connect or enable.1 of the policies is set to reset the mac to default login and the other is to enable jamfconnect. This works on all devices, except 1. The policies run without error, but the policy isnt applying to the device.Make:AppleModel:iMac Intel (21.5-inch, Mid 2017)Model Identifier:iMac18,1OS:12.6Id appreciate some direction here as i am not able to identify why it isnt applying to the device

We are a Jamf Shop and Jamf (currently until our instance is updated to 10.43.1) does not have a native mechanism for managing com.apple.servicemanagement. Jamf deploys their own com.apple.servicemanagement payload to manage the Jamf apps however since the ability to manage Login Items was added to MDM we have been using a separate payload to manage our 3rd party login items.This has been working fine until macOS 13.2. Now we are seeing very inconsistent behavior where our managed login items are no longer managed. When I look at the deployment guide it seems like com.apple.servicemanagement allows multiple payloads. e.g. "Duplicates allowed: True—more than one Managed Login Items (com.apple.servicemanagement, com.apple.loginitems.managed) payload can be delivered to a user." Up to macOS 13.2 the behavior was that multiple com.apple.servicemanagement payloads were respected. https://support.apple.com/guide/deployment/managed-login-items-payload-settings-dep07b92494/1/web/1.0 I rolled b

Can we integrate RSA with Mac for login screen authentication when Jamf Connect is also already deployed?