I'm working a customer setting up macOS Onboarding and we had it going, then at the end of the for some reason they started getting this message: " Cannot reach a Jamf MDM Server" after Device Enrolment, when the desktop came up, and SelfService Opens to start installing policies as per onboarding setup. At this point the onboarding froze of course as it cannot connect to mdm... -Jamf Pro is On PRem in this installation: - Only change the local tech made was in the prestage, setup assistant.   Originally they left unchecked the location services, so on enrolment the user would select their location... He remove this in setup assistant and then all of sudden this message started coming up.-Server Reboot was done - no change-Ticket has been logged with Jamf - still waiting on resolution -We were able to get it going again by once again removing the check on the setup assistant skip, so no again the user selects the location services.- we also saw once the checkbox was removed, that

I am attempting to set up pre-stage enrollments for Jamf, but am running into some issues:I manually assigned a device to our business manager account for testing purposes. When I sign into the account, everything looks like it works correctly, but the device isn't assigned to any user. Is there a way that it can be automatically assigned?I would love to get Google SSO set up for creating the local user account. Would I need Jamf Connect to accomplish this?Thank you in advance!

A follow-up to this ticket, but different enough I wanted to start anew.Essentially, we're trying to do zero-touch with our next batch of MacBooks, so I've been working on a new Enrollment Profile. We want to primary account information (name and username) to be filled-in and locked during setup. Initially we tried to pull the data via prestage (see prior ticket), but since that isn't working, we tried via Google SSO and Secure LDAP:I followed these directions for the Google SSO:https://docs.jamf.com/technical-articles/Configuring_Single_Sign-On-with_Google_Workspace.htmlAlong with adding the SSO pane to the prestage. The pane seemed to work fine — asked for login, went through two-factor authentication, continued the setup afterword — but it never passed the variables to the Create a Computer Account screen, so the name and the username were still blank. I tried both Custom Details and Device Owner's Details in the Pre-fill Primary Account Information, neither worked.So

Running a long standing (and working) script to do updates on Macs and got this error today with a Jamf cloud client:   Install action:Download and schedule to install (2025-01-15T15:00:00) Update action:Specific version (15.2) Current state:PlanFailed Error reasons:SpecificVersionUnavailableForDeviceModel   Part of my script verifies that the Jamf Cloud client recognizes the requested version (like sometimes the trailing ".0" is not recognized). So that shouldn't be it.   The plan is actually created but is "immediately" rejected:{ "events" : [ { "type" : ".PlanCreatedEvent", "managementUUID" : "e163182f-ea49-440e-967c-b5840bcf0366", "processManagerUUID" : "85980caf-557a-411e-99b9-94a07a478ead", "id" : 2469, "deviceObjectId" : 1, "eventReceivedEpoch" : 1736956458301 },   { "type" : ".PlanRejectedEvent", "managementUUID" : "e163182f-ea49-440e-967c-b5840bcf0366", "processManagerUUID" : "85980caf-557a-411e-99b9-94a07a478ead", "id" : 2470, "deviceObjectId" : 1, "event

Following the use of JAMF Mac Apps to update Chrome, some users have reported an issue where they are unable to access any internet or intranet sites from Chrome. The browser becomes unresponsive, and the issue is resolved only after a device restart. Has anyone else encountered this issue, and are there any insights or suggestions available?

Help! I have been trying to endlessly to get this to work...what am I doing wrong? I know for a fact that the logged in user has the workplace join key in their keychain but for some reason, when trying to run this for an EA it doesn't report correctly.  I know the jamf runs with elevated privileges, but should it be able to run this without prompt for user credentials (like root), or is this not going to be possible?   #!/bin/zsh currentUser=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ { print $3 }' ) uid=$(id -u "$currentUser") haswpjkey="No" wpjkey=$(launchctl asuser "$uid" sudo -iu "$currentUser" security dump-keychain | grep "Workplace Join Key" | xargs) [[ "${wpjkey}" == *"Microsoft Workplace Join Key"* ]] && haswpjkey="Yes" echo "<result>$haswpjkey</result>"  

If I wanted to test a script locally on my mac before deploying it out - how would i go about doing it?Do I open my terminal and drag the".sh" file in there?

I'm trying to configure my updates to run via S.U.P.E.R finally, and I keep running into the error: Warning: Inaccurate deferral found for macOS major upgrade 1 of 1 is: DeferredUntil:2025-01-10 00:00:00,Title:macOS Ventura 13.7.2,Build:22H313,Version:13.7.2 I have config profiles setup for Apple Software Updates and  SUPER the following: Apple Software Allow installation of macOS beta releases Automatically install macOS updates Automatically install app updates from the App Store Restrict software updates to administrator users only Automatically check for updates Automatically download new updates when available Automatically install configuration data Automatically install system data files and security updates   MacJutsu.Super <key>AuthJamfComputerID</key> <string>$JSSID</string> <key>InstallMacOSMajorUpgrades</key> <true/> <key>InstallMacOSMajorVersionTarget</key> <strin

Instead of using the Okta Authentication API, Jamf Connect can also use the Custom identity provider type with an application set up for OIDC/ROPG in the Okta tenant. This allows for granular application of Authentication Policies in the new Okta Identity Engine tenants. Create App Integration in Okta Navigate to the organization Okta administration page.  Select Applications → Applications and pick the Create App Integration option.     Select the options for OIDC - OpenID Connect and Native Application.  Select Next to continue. Select a name for the App integration name.  In Grant type, select the options for: Resource Owner Password (this enables ROPG for ongoing password checks) Implicit (hybrid) Scrolling down for more options, remove the default entries with the X option for Sign-in redirect URIs and Sign-out redirect URIs.  Enter a new sign-in redirect URI with the value https://127.0.0.1/jamfconnect Optionally, assign users to the Jamf Co

Hello everyone. We recently setup Kerberos SSO and are having some issues with it syncing passwords after a password change. Upon initial setup it works as intended. User logs in with their AD credentials, it asks for their AD password and their Mac password, it then syncs the password to match the AD password. However, when a user changes their password, they are able to log into SSO with their new password, but it never prompts to sync the mismatched passwords, so their computer still uses their old password.  Has anyone run into this issue?  Password sync is enabled and the system currently running into this issue is running 10.15.2

Hello  We have a group of iPads which need to have their time zone moved forward one hour. I'm using Jamf Pro Cloud version 11.11.1-t1731016358 and I have administrator rights. I've checked the configuration profile for this group of iPads and can't find the correct setting to specify the correct time zone. There is only the setting Restrictions - Functionality - Automatic Date and Time setting, which doesn't allow me to set a specific time zone. Can you please tell me how to change the time zone setting in Jamf Pro Cloud interface? Thank you.

Has anyone had success setting up SMTP in JSS using Google's SMTP relay? We are struggling to find settings that work. This is the doc I'm referencing: https://support.google.com/a/answer/2956491?hl=en

Can anybody share what smart group criteria you're using to see what mobile devices in the environment are using eSIM? Or is eSIM compatible? 

We have added a new reward to Jamf Nation Rewards: the ability to donate using points to Los Angeles County by supporting organizations providing emergency relief. Dangerous wildfires, including the destructive Palisades fire, are burning in Los Angeles County. The wildfires have burned more than 60 square miles and destroyed over 12,000 buildings. More than twenty people have died, dozens more are missing and more than 90,000 people are under evacuation orders.  It is the most destructive fire in LA history. It only takes 50 points to donate $25! To find out where the donations are heading, check out this page -https://jamf.benevity.org/community/fundraiser/24332 Donations can be made under the reward '$25 Donation to Emergency Relief LA County'. Please reach out to jamfnation@jamf.com should you have any issues. Haven't joined Jamf Nation Rewards yet? More info can be found here!  As always, thank you for your kindness. Jamf Community Team

Hi Nation,  We have an issue with keychain while we are trying to make google chrome as a default browser via our prestage script. So, basically we have two scripts: 1. PreStage script (trigger set to immediately after the enrollment) 2. Script 1 enables another trigger which sets google chrome as a default browser.  We are using Jamf setup manager to install chrome.  The first script looks like this   #!/bin/bash # Initial PreStage Script # This script runs a manual policy trigger to # allow the policy or policies associated with that # trigger to be executed. waitForSetupToFinish() { # Wait until setup is complete and the user is logged in. logToFile "Waiting for Setup to complete" currentUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) while ( [[ $currentUser == "_mbsetupuser" || $currentUser == "loginwindow" ]] || ! ( (pgrep -x "Dock") && (pgrep -x "Finder") ) ) ;

Hi, Can anyone please help me with this??We had a restriction payload to delay major macOS for 90 days, which is working fine even more than we wanted. Since it has been more than 90 days after the release of macOS 15, this should be available to update for every device. But macOS 15 is still not showing up when trying to update! I thing I did was, I modified the same profile but only disable ChatGpt integration didnt change macOS Settings and re-pushed the same profile couple of days ago. JAMF Support confirms that re-pushing the same profile for macOS restrictions doesnt restart the timer, as this timer is depend on the release date by Apple. Really lost in here! And btw we dont have any profile controlling the macOS except disabling the macOS betas.

Is there any way to detect if a computer was enrolled through User Initiated Enrolment? JAMF Pro Cloud 10.610.13.4 Clients the only way I can think of is to use exclusions for other enrolment methods i.e DEP but I am very reluctant to use Exclusions.

We would like to create a Smart Group for computers that has IP addresses within xx.xx.243.1 to xx.xx.255.254. From other posts, we have the condition as IP Address Like xx.xx.243.x. However, this doesn't include all the IP within this DHCP range. How should we create the condition so it captures all IP within xx.xx.243.x to xx.xx.255.254 without creating xx.xx.243.x, xx.xx.244.x,...? Thank you!

No text available

Good afternoon All, I tried multiple times to get S.U.P.E.R.M.A.N script to work in my Jamf Pro instance. If anyone have a basic configuration profile that works well with their instance please share. I read the Wiki page but I do not see how the policy uses the configuration profiles to run and control when "super".

Hi, After updating macOS to 15.2.0, not able to sign in to Kerberos Extension. Showing Network credential not available. When trying to sign in getting error as "Your organization is not available". I tried command like kinit, kdestroy. Any other suggestions? Would Appreciate any help.   Thanks.

Hello !For some reasons, I would like to change the default icon of FileMaker Pro. I install the app, change the icon in the information tab and package it using Composer.But when I deploy it on some test computers with a Jamf policy, I have different message errors like "The app is damaged and cannot be opened", sometimes with a message telling me to drop it in the trash. If I right click on the app or it's dock icon then click "Open", it will open.I would like to be able to avoid this message,  allowing the app to open using command line or Apple Script to bypass that security, or another way to customize the FileMaker Pro's icon without having this message.I found that it could be possible to make appear again the ability to choose to open apps from any source, but I would like to avoid that option for security purpose. I want to keep it as "Open from Apple and identified developers".Thank you !

Since our client is renting an Apple device(Mac), client are using the user-initiated enrollment method to register the device with jamf pro. Also, through Jamf pro, the profile item was disabled to use jamf pro restrict configuration profiles -> restrictions -> preference -> disable profile item. The end-point with Monterey installed is normally graded out, but the profile is not disabled on the end-point with Ventura installed. Are you experiencing any issues like this or have you solved them?If you have one, please share it with us.

Hello everyone, We are currently using Jamf School to manage our devices and would like to automate the process of assigning configuration profiles to specific device groups like Group 4 students. While reviewing the API documentation (https://api.zuludesk.com/docs/), I could not find a dedicated endpoint for this functionality. Could you please confirm if there is an existing API endpoint or method that allows us to: - Assign a configuration profile to a device group. - Remove a configuration profile from a device group.   I really appreciate any help you can provide.

I migrated over to S.U.P.E.R.M.A.N. late last year (ok...the company didn't even have any type of policy in place...it was the wild Wild West over here...).  I am sure that this script is not perfect in anyway, but it is working for me, so I thought I would share it in case anyone starting out would like a starting point.  For you seasoned admins, any feedback on better improvement(s) is greatly appreciated!     #!/bin/zsh # Writen by: Scott E. Kendall # Last Revision: 01/10/2025 # # Execute Superman script with passed parameters from JAMF # Options include Allow on minor updates, install major updates (speicific versions) and donwload only # # Parm #4 - Update Type (Major, Minor, Download, Defer, Reset) # Parm #5 - Force OS Version # Parm #6 - Deferral Time (in minutes) # Parm #7 - Deferral Count # Parm #8 - Deadline Date # Parm #9- Icon path # Parm #10- Test Mode On/Off # export PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin LoggedInUser=$(echo "show State:/