Last year, when I was working on getting moved over to using LAPS instead of using an admin account that we installed using a Jamf Policy, some of my support team members discovered that the password for the Jamf management framework LAPS account was not working on several Macs. We could see in the managed local administrator account history that the password was being rotated on the schedule we set. So, why was the password not working? I recently discovered that the reason for this is that these Macs had been re-enrolled in Jamf Pro for some reason, likely using "sudo profiles renew -type enrollment". This appears to have broken the ability for Jamf Pro to change the account password on the Mac. I tested this idea on my test Mac. I checked the password, saved it, then re-enrolled the Mac. I waited the period of time we have set for rotation. I checked the password in Jamf Pro again, and found that a new password was recorded. I tried that new password on the Mac with the LAPS account

Jamf Nation was created to promote growth and success in the community that supports Apple in the enterprise. It’s a place to share ideas and information and learn from each other. We want Jamf Nation to be a community that is a welcoming, engaging, respectful and useful space for all. With that goal in mind, please remember the following Community Guidelines (“Guidelines”) when posting in Jamf Nation.    Getting Started There is no obligation to post on Jamf Nation, and contributions are voluntary. If you want to post messages, comments, images, content and other materials ("User Content") on Jamf Nation, you will need to create an account.  Do not use an inappropriate or misleading name, and don’t try to impersonate someone else with your username. Keep your account details secure and don’t share them with other users.    Content Rules Jamf Nation is meant to be an engaging and educational space. Before posting, ask yourself if your post contributes to t

Hello there, maybe someone has an idea for solving this issue. We have started to enroll MacBooks to employees without admin rights. We was using first the visual studio code installer from jamf mac apps. The problem with this, is that i cant add some configuratio (for example creating a symlink for this app) within the jamf mac app installer config. So at the moment i am using a normal policy with a pkg for vscode. Everything until here is working fine.  When an update is released for vscode, the user (without admin right) can't install it. The first window which pops up is for the helper tool (updater) for visual studio code  So i was searching for a solution and found this page here, which explains this problem: https://github.com/microsoft/vscode/issues/115805 I am able to do all this changes for the group and ownership for the logged in user but the problem still persist.   My script #!/bin/bash set -x # Get the current user's home directory loggedInUser=$(stat -f "%Su" /

Grace and peace to all,We currently have Sel-Service+ enabled in our QA environment.  It is blocking access to corporate resources when the Mac is connected to a VPN.  We use Zscaler.  I cannot find any documentation on Sel-Service+ configuration.  It is using our JAMF Connect license and profile.   Do we need to register Self-Service+ as an application in Entra? 

I need to force install a Chrome Extension.I have looked in Jamf Nation for solution but latest ones were in 2017 and they currently do not work (from my testing).Has anyone got them to work with Monterey?

I'm integrating with JAMF MDM to get mobile devices. I have a standard JAMF pro user created and assigned Auditor privileges(grant all read). I'm able to get device info with the following info under the security object."security": { "dataProtected": , "blockLevelEncryptionCapable": true, "fileLevelEncryptionCapable": true, "passcodePresent": true, "passcodeCompliant": true, "passcodeCompliantWithProfile": true, "hardwareEncryption": , "activationLockEnabled": true, "jailBreakDetected": false },I have to capture the compliance info as well when I try to access compliance info using the following API callBaseURL/api/v2/conditional-access/device-compliance-information/mobile/{deviceid}it is showing null results. Please advise how can get the compliance status of the device. Do I need to get more privileges or can we capture from a security object?Thanks.mythdhr

Hello everyone,Some time ago we’ve moved from eDirectory to Entra and everything has just been work great. But yesterday I stumbled on a problem, error with calculating profiles in scope and same with apps.Has anybody else run into this? 

Hi,I have a question haw can I setup on managed device via Jamf Pro (and Protect) configuration that restrict local account from some features, apps, internet, usb mount but on another account - admin account user can use all this features. Local restricted account enroled by Jamf, admin account added after enrolment manually. When the device will be login to the local restricted account should lost the connection with the internet, block some sharing features like bluetooth, airdrop, blok mount external usb devices/disks, block apps not needed or give only 2-3 apps what is needed. Tried wit configuration profiles with Restriction but working with all local account, trying some script on login but not working as it should. Could be a workaround solution…. but to get secure when restricted user use the device. Please give me some advice. Thanks!

Hi everyone,Apparently there is a loophole to leak data according to our cybersecurity team on the MacOS Outlook client using the “Share to Teams” feature I am trying to disable the function for “Share to Teams” via a configuration profile on JAMF with the following configurationsApplication & Custom Settings > UploadPreference Domain: com.microsoft.OutlookPLIST:<plist version="1.0"><dict> <key>com.microsoft.Outlook</key> <dict> <key>DisableShareToTeams</key> <true/> </dict></dict></plist>I am wondering if anyone have any insights about thisThanks in advance!!

Hey all, If you missed the PSU conference this year, not to worry. You can check out the videos of sessions here and slides can be found here.

Hi All,    I have issue with login into Self Service with SSO, I am able to login to access the login process, but once I approve my MFA it doesn't approve my access, does anyone have any information this process?    

Hello Jamf NationThe JNL London 2025 sessions are now available here on Youtube. Catch all the sessions in case you weren’t able to attend. Happy watching!

Hey All,We are working on determining the best way to manage our assets. We are a Mac/iOS only environment. So all of our equipment goes into Jamf Pro. We don’t do touchless deployment (management decision although its practically touchless). I’d imagine we’d need to get MUT involved to update purchase status.How do you handle new equipment or equipment that goes back into inventory? Also, we are looking to get physical asset tag stickers for the devices. Any suggestions on using Jamf as a complete solution? Or addition tools that people use for Asset Management to track items?Thanks!

I have a script that worked before OS15.5. After updating to OS15.6, the script became abnormal. Even if it connected to the allowed SSID and obtained the IP address, it would turn off and on WIFI infinitely. The following is the script. Thank you for your help~~ #!/bin/bashallowed_ssids=("SSID_1" "SSID_2")wifi_port=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $NF}')[[ -z "$wifi_port" ]] && exit 1  lockfile="/Library/Application Support/JAMF/.wifi_cleaner.lock"mkdir -p "/Library/Application Support/JAMF"if [[ -f "$lockfile" ]]; then    pid=$(cat "$lockfile")    if ps -p "$pid" > /dev/null; then        exit 0      else        rm -f "$lockfile"      fifi{      echo $$ > "$lockfile"    trap 'rm -f "$lockfile"; exit' EXIT INT TERM          check_and_clean_ssid() {          local connected_ssid=$(/usr/sbin/ipconfig getsummary "$wifi_port" | awk -F ' SSID : ' '/ SSID : / {print $2}')                  local ssid_list=$(networksetup -listpreferredwir

Today we are releasing a maintenance version of Jamf Pro; highlights include: Changes and ImprovementsJamf Pro 11.19.1 includes Tomcat 10.1.43.  Resolved Issues Jamf Pro Server: Security IssuesJamf provides the CVE-ID for security issues with high or critical severity when possible.[PI136944] [PI138128] Fixed: A known vulnerability in a third-party library (CVE-2025-48976). [PI138965] [PI138090] Fixed: A known vulnerability in a third-party library (CVE-2025-5878). Jamf Pro Server[PI135178] Fixed: In a computer configuration profile with a Restrictions payload configured to allow integration with external intelligence services, users may be prevented from enabling ChatGPT on computers in scope. This is due to the profile containing the key "allowedExternalIntelligenceWorkspaceIDs", even if the corresponding setting is not selected. [PI139029] Fixed: Modifications to smart groups are unable to be saved when the group is a dependency of a blueprint and impact alert notifications are enab

Need help with installing GarageBand Loops for users without admin rights.

How do I set up so that students are not able to use the Messages app on their Mac. 

Update 06 August 2025: Standard Cloud upgrades are scheduled for the weekend of 15-16 August (details below). We appreciate your patience with the revised schedule. Today we are releasing Jamf Pro 11.19; highlights include:Impact Alert Notifications for Scopeable ObjectsThese notifications provide enhanced visibility and control when modifying group configurations. This feature helps prevent unintended large-scale changes by giving administrators insight into how their modifications will affect devices and existing group configurations across their organization.   Automatic Redistribution of ACME CertificatesYou can configure Jamf Pro to automatically redistribute ACME certificates to computers and mobile devices at a specified number of days before the certificates expire. To support this function, a $PROFILE_IDENTIFIER is automatically inserted into the Subject of the issued certificate as an organizational unit (OU). Note: Your ACME certificate authority template must also support t

Hi all, we are using cloud instance of Jamf Pro, with user-initiated enrolment for iPads, iPhones, etc always been unticked (all boxes, inc account-driven and profile-driven), while computers were enabled.Everything was fine till iPads with Apple M-chips were released - now users CAN enrol them manually… Is it because Jamf Pro mistakenly taking them as MacBooks? Is there a way to fix this?Thanks!

We just got the Jamf AD CS Connector set up for our environment. It's awesome considering we were using an ancient, user-initiated script through Self Service for a long time to accomplish the same thing. However, I am wondering what the best practice is for pushing the wireless config during or after enrollment is. As part of our zero touch efforts, we have the user enroll using our guest wifi network when on site. I'd like to get the wifi profile installed as close to enrollment time as possible so when it does its post-enrollment tasks (installing security software, settings, etc) it will pull from on-site distribution points rather than our Internet facing distribution point. Has anyone had success with this? I seem to find myself getting railroaded installing this profile as it either interrupts the enrollment or post enrollment when it automatically switches from our guest network to the corporate network. Thanks in advance for any thoughts.

I am running into this issue where after pushing an app, updating inventory or enrolling a device, the apps are going straight to the failed command list and display the “No license was found for app”. I have tried wiping and re-enrolling, updating OS, restarting, sending a blank push, or update inventory command but the issue persists. I check the apps and we do have enough licenses available. Any solutions or ideas on what can be causing this?Thanks

I just wanted to say they really helped me get across the finish line with a script I needed to move computers from one pre-stage to another.Also special shoutout also to ​@mattjerome for getting the base script started with me.Anyone else have cool stories of how Jamf Support came through for them when you were hitting a brick wall with things?

Hi,  Is it possible to block widgets with the Home Screen Layout but also allow apps to appear (at least on the second page) while not having those apps lumped into a folder? Here is an example I have setup -- Main group (All Student iPads): Has normal student iPad apps. These apps and profiles appear on the first page as intended according to the home page layoutSecond group (LMC): Has specific apps set to auto-install. Sometimes these apps appear after the first set of apps. But if wiped and returned to service, the apps will move to the second page of the home page and get lumped into a folder called “Managed”. Is there a way we can have this setup so the apps on the second page DON’T get grouped together while also hiding widgets/blocking students from removing apps? It would theoretically be nice to just have all the apps together but having the layout locked on page 1, and other apps on page 2 (if more then two groups) be together, that is fine too.  Thanks 

I am attempting to import a new VPP token that I have downloaded from Apple business manager. Every time I try to do this, I get an error saying "The file received was not valid". I have tired using a different web browser. I have rebooted Jamf Pro, and I rebooted the entire Ubuntu server VM. The Jamf Pro server log does show an error at the time I attempted to import the token. I have an open case with Jamf for this, but if anyone knows how to solve this, that would be wonderful 😊

We are deploying ClearPass OnGuard to our macOS fleet using Jamf Pro. The ClearPass application installs successfully via the Jamf policy, but it fails to establish a connection with the ClearPass backend. Manual installations, however, are fully functional. The root cause has been identified as a missing or misplaced .agent.config file, which is a hidden file essential for the initial configuration and backend communication. This file is present within the ClearPass DMG but is not included in the standard PKG installer.The challenge is to devise a deployment method using Jamf that ensures both the ClearPass installer PKG and the .agent.config file are present on the client machine at the time of installation, allowing the application to connect to our backend successfully.