anyone getting this Sync failed: Communication error. Awaiting next sync. ????when creating a new prestage enrollments ?what's the sync interval? even after the sync interval has passed it is still displaying this Sync failed message

We have enabled Azure AD as a Cloud Identity Provider, as well as Azure AD SSO. We also have some iPads assigned to a Prestage that features an Enrollment Customization that includes an SSO Authentication pane. The pane is displaying as expected on the device, and I can sign in through that pane using my Azure AD credentials.We have enabled "Collect user and location information from Directory Service" under Inventory Collection settings.However, the "User and Location" portion of the device inventory remains blank. We've gone through multiple wipe and re-enrollment rounds with this device, as well as an "Update Inventory" MDM command... nothing.Jamf Pro’s documentation says that assigning a user to a computer or mobile device can be done “during user-initiated enrollment (LDAP users only)” - does this not include the Cloud Identity Providers such as Azure AD? Or do we have something misconfigured somewhere?

If you are wondering what the “Login Window Size” Options of WIDE, COMPACT and MAX looks like for Jamf Connect. Here they are, especially for Okta on the login screen. Not the prettiest of Login windows but at least they will give you a good idea what to expect.This was changed in 2.45.1 I believe and is still the same in 3.2.0CompactCompact Settings for Login Window SizeWideWide Settings is the same as Compact, except stretched side waysMax

Another significant update — now including detection of outdated Electron apps which can slow down macOS 26 Tahoe — to the practical and user-friendly approach to surfacing Mac health information directly to end-users via Jamf Pro Self Service Overview Mac Health Check provides a practical and user-friendly approach to surfacing Mac health information directly to end-users via Jamf Pro Self Service.Built using the open-source utility swiftDialog, the solution acts as a “heads-up display” presenting real-time system health and policy compliance status in a clear and interactive format.Administrators can customize the user interface using swiftDialog’s visual capabilities, making the experience both informative and approachable.The tool logs results for review, while not

Anyone else using DUO on Chrome and get this new Chrome "bug" to allow DUO to access devices on the local network? I put together a teeny Config Profile to allow local network access to duo security. I’m told it will work with other Chrome extensions, such as Okta Fastpas as well.Here’s what the Plist preview looks like:<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”><plist version=“1.0">  <dict>    <key>LocalNetworkAccessRestrictionsEnabled</key>    <true/>    <key>LocalNetworkAccessAllowedForUrls</key>    <array>      <string>[*.]duosecurity.com</string>    </array>  </dict>&

I am trying to troubleshoot some problems I am having with a few of my machines. I keep seeing this error in the log files and am not sure exactly what it means JMFCommons.JamfKeychain.JamfKeychainSecurityError.failedToReadJmfKeychainPassword  is what I keep seeing and I believe it is the root of all the other errors I am seeing. Can anyone shed some light on what causes this problem and how I can fix it. Thank you in advance

Does JAMF Sync suddenly require a your JAMF server to be cloud based?  I’m suddenly having issues syncing jamf sync to our on prem jamf server and it has an error referencing a cloud based server which we dont have.  

We experience blank/black screens after the Welcome to Mac screen. We performed a full reinstall via recovery, but experience the same again.Also tried to go into recovery, terminal, and remove /Volumes/Data/private/var/db/.AppleSetupTermsOfService but no success. Similar issues have been reported online - is there a fix for this?:https://www.reddit.com/r/mac/comments/1o3tt1i/does_anyone_know_why_its_stuck_on_the_welcome/ https://www.reddit.com/r/MacOS/comments/1kh2nbg/macbook_air_a2681_black_screen_after_welcome_to/

Today we are releasing a maintenance version of Jamf Pro; highlights include: Resolved IssuesJamf Pro Server: Security IssuesJamf provides the CVE-ID for security issues with high or critical severity when possible.[PI135989] Fixed: A broken access control issue.Jamf Pro Server[PI120239] Fixed: A failed declaration storage service (DSS) health check during Jamf Pro Server startup can cause an unhandled exception that prevents the server from initializing completely. [PI143843] Fixed: When opening a mobile device configuration profile's scope and returning to the Options tab, the Scope pane remains on the screen and blocks the view of the Options tab. [PI143897] F

I am in a conundrum here.  Fresh out of the box I need all Office Apps deployed to our users.  Word, Excel, Outlook, OneNote, PowerPoint, Teams.  In the last wipe and reset on a device, it was taking forever for the apps to become available.  SelfService did not show them either as they are set to install automatically through the Jamf App Catalog.  I am looking for advice from the community to help me figure out the best method for deployment.  I need the apps to be there after deployment, my company requires them to be on the Current Channel and updated after each release of an update. I like having them visible in SelfService, but I do need the push method as well. Jamf App Catalog seems to limit this possibility unless someone has figured out a way around it.  I am not on SelfService+ as of now.  

Is there any way to get the password sync status from the new Self Service+ as Extension Attribute?Would be really nice to see if Google and the local user are in sync. Other ways to archive it are welcome 😀

Has anyone had luck getting Accessibility to "allow" or "let standard user approve"?Similar to the post here https://community.jamf.com/t5/jamf-pro/enabling-privacy-accessibility-setting-for-ms-teams/m-p/245576#M230198 we've used the PPPC Utility to "let standard users approve" Screen Recording but does not seem to work for accessibility. We have a handful of apps that needs Accessibility to "allow" or "let standard user approve" for non-admins but cannot get it to work. Apps like MS Teams, Logitech Logi Options will not work for the "Accessibility" section. I've attempted to use the PPPC utility and though the other options work it's "Accessibility" that will just not work.

We are trying to load an in-house app into Mobile Device apps.  We started to make the new record, uploaded the file in archived app file, but had to cancel the attempt.  Trying a 2nd time, it reports there is already an ipa with that name.  Where can I go to delete that or can I just select that??  I did not find it in Settings > Packages.

Hello,I am trying to update our method of deploying out the essential sounds for GarageBand through Self Service. In the past, I had leveraged the Carl Ashley AppleLoops script (it worked great!). After Apple removed Python from the base installation of macOS, I had been limping along with installing Python on the devices that were needing the sounds. This has posed other complexities.Currently, I am testing out installing all of the sound packages needed for the Essential Sounds from a cached copy of those packages on the laptop. This has not produced the desired results yet. The user is still prompted to install the sounds when launching GarageBand. All of the sounds that should be available from the Essential Sounds are present in GarageBand. The loops have also been reindexed in hopes that would resolve the issue.I would appreciate any help that anyone has to offer.Thanks!

Have a weired Webex issue that started a month ago. When the user opens his Webex, to join a meeting, he get's the error message "Webex quit unexpectedly and you can click reopen, report or ignore. The first time it happened, we just did an uninstall/reinstall and it worked for a couple of weeks. It's happened a couple more times. I recently tried using the webex uninstaller, we also checked the webex dependicy folders they provided to make sure there wasn't anything left over. I updated webex on my Mac and it worked, so I created a package using composer, but it keeps getting the same error. Below is a script I found that the user ran and after the uninstall, he restarted an not luck after. I do see something about checking keychain and resetting the TCC permissions which I'll try today. #!/bin/bash# Get the currently logged-in userCURRENT_USER=$(stat -f "%Su" /dev/console)USER_HOME=$(eval echo "~$CURRENT_USER")echo "St

Hi everyone, we’re currently testing Platform SSO (Secure Enclave) in combination with the Kerberos Single Sign-On Extensionon our Macs (managed via Jamf Pro).Since enabling Platform SSO, we’ve encountered issues with password synchronization as well as Single Sign-On authentication for ADFS-based web applications. As soon as Platform SSO is enabled, users receive the following prompt either after some time or following a reboot:Password SynchronizationVerify your Active Directory and Mac passwords. If they do not match, your Mac password will be synced. The passwords are identical (local macOS login = AD password). However, this prompt appears repeatedly — and only when Platform SSO is active. Additionally, our

I’m trying to create a policy for a screenshot repository that save screenshot to another device. Hope someone can help me.

We are having an issue with our managed Apple TVs since upgrading them to TVOS 26.Sometimes this message can be cleared by pressing the menu button on the remote or hitting “Not Now”, but most of the times it comes back, and it then takes multiple presses to clear the message.We thought we had rectified the issue by re-enrolling. But, after about a week the issue returned.We don’t sign into the Apple TVs with an account, but some of the teachers do if they are in the constantly in the same classroom. For example, the Primary school teachers. The issue still happens to them. 

Hi there,A bit of background — I recently took over for our previous Jamf admin, who left unexpectedly. I have some Jamf experience (completed the training about eight years ago), but I’m still building up my troubleshooting skills.I’m working with an older iPad Pro that appears to max out at iOS 16.7.12. When I wipe the device, it doesn’t automatically grab the MDM profile or configuration during setup like our other iPads do. Instead, it just activates with Apple and sets up as a normal iPad. I can manually enroll it, but I’d prefer not to.I’ve confirmed that it’s listed in Apple School Manager, assigned to our MDM server, and included in the same PreStage Enrollment as the other iPads that work correctly after a wipe. I also tried deleting it from Jamf to see if it would re-sync, but it didn’t.One thing I’ve noticed is that under Automated Device Enrollment (DEP), the status shows “Sync Failed — Awaiting Next Sync.” However, o

Hello,Is it possible to configure Custom Analytic if someone unenrolls their device from Jamf Pro (i.e., uninstalls the Jamf MDM profile)?

Not sure I’ve seen a CVE list quite like this one... But where is 18.7.2? • macOS 26.1 - fixes 100+ CVEs• macOS 15.7.2 - fixes 50+ CVEs• macOS 14.8.2 - fixes 40+ CVEs• iOS 26.1 - fixes 50+ CVEs • watchOS 26.1 - fixes 30+ CVEs• tvOS 26.1 - fixes 29 CVEs• visionOS 26.1 - fixes 40+ CVEs • https://support.apple.com/en-us/100100

Connect 3.4.0Self Service+ 2.12.0OS 26.1 Tahoe (Many other machines on 26.0.1)I can not get this prompt to close no matter what I do. Everything in the back end seems fine with my machine and my connection to Jamf, self service, connect, everything, it all seems fine. Anyone have any ideas?  I did not see this issue prior to updating OS from 26.0.1 to 26.1 and that is the only thing I can think of that may be triggering it. I have tried deleting associated keys and allowing them to regen, I have tried flushing and re-pulling Config Profiles and Policies. P&S settings are all good. I have fond that if I leave the window there for 30min or more, it will finally close after entering PW and selecting Always Allow, but then comes back up after Reboot.

This past July, I gave my third-ever presentation at a large conference: "swiftDialog for Overworked MacAdmins," at the Penn State University MacAdmins Conference. It wasn't my first time: I also presented in 2024 at MacAdmins on the topic of Compliance, and at the Consortium of Liberal Arts Colleges as part of our security response team on a phishing response workflow. I'm not a big name speaker. I'm not a well-known blogger, or tech writer, or popular person on Slack. I'm not on LinkedIn. I don't have any particular expertise, or much formal training. I'm not even a people-person. So what do I think I have to contribute to the community? I think, like you, that I have a lo

I have an issue were computers are retaining a profile even after the computer has been removed from the scope of the profile. I have a need to allow users to create computer level WiFi Profiles using their own user level credentials.  Having been advised (by JAMF back when they offered support to customers) that it is better to remove a computer from scope then to delete the profile I have another script for de-scoping the WiFi Profile. Unfortunately this does not result in the computer removing the profile. I have a hunch this might be caused by a fault in our Managed JAMF instance since previously we had a very similar issue that could only be resolved by marking a profile with a duplicate UUID as deleted. Since JAMF no longer provide support to their customers I have no way of getting this resolved. Does anyone have any suggestions on how to ensure a de-scoped profile is removed? or how to get support from JAMF?

We have historically given users who teach in Xcode the "Privileges" app from SAP because they insist that they need to run every update that comes out from Apple. Recently we noticed that one user has been abusing this app and installing various unapproved applications without going through IT first. We are wanting to see if there is a way that we can give a standard user the ability to run updates on Xcode only without having administrative privileges to do anything else or install any other applications.It looks like, in the past, a device (or user maybe?) could have been put into a Developer group which would allow them access to do things in Xcode that a standard user wouldn't, but still not be an admin. From what I have read, this doesn't seem to still be a possibility. Does anyone know if there is a guide to allow this? Or are we stuck using the Privileges app or someone from IT manually entering the admin credentials every time there is an update?