We would like to restrict our admin user from installing any applications via installer files (pkg or dmg) on their Mac. There is a functionality in the configuration profile under Restrictions that allows us to check "Restrict the App Store," but this only prevents users from opening the App Store. They can still download package files from the web and install them. Is there any way to restrict admin users through a script or configuration profile?

I’m currently rebuilding our enrollment process and testing everything in a Jamf sandbox. So far it mostly works as expected, but I’ve run into an issue that I can’t fully explain.This is how my flow looks right now.macOS 26.2In PreStage Enrollment I deploy: JamfConnectLogin-3.5.0.pkg dialog-2.5.6-4805.pkg (used for Setup Your Mac) icons.pkg (icons used by Setup Your Mac) When it comes to configuration profiles related to Jamf Connect, I’m using: Jamf Connect License Jamf Connect Login (login window configuration) Jamf Connect Menu Bar The flow itself:I start the Mac, choose Enroll, and no local account is created during enrollment. After configuration finishes, I get the Jamf Connect login window (which is exactly what I want and how it works in production). I log in with Okta credentials, the local account is

Hi everyone,I’m trying to set a default font in Microsoft Outlook (macOS) using Jamf Pro, and I’m running into some trouble.By default, Outlook uses Aptos, but I’d like to change it to Book Antique, which is already available on the device.What I’ve tried: I attempted to use the 3rd-party tool OutlookFontPoke by Paul Bowden @ Microsoft. Here’s what I did:• Deployed the OutlookFontPoke script and TemplateRegDB.reg via a package (both located in /private/tmp/OutlookFontPoke-master).• Created a policy in Jamf that:• Extracts the current logged-in user• Fixes permissions• Run the command as that user: sudo -u "$loggedInUser" /private/tmp/OutlookFontPoke-master/OutlookFontPoke 'Book Antique' '11.0pt' 'black' Issue: Despite several variations of the above, I keep getting this error in the script logs:

Today we released Jamf Connect 3.8.0; this release addresses the following product issues:[PI-995] Fixed: The Jamf Connect login window presents the following error after a failed ROPG password verification: ERROR: Unknown error. Message: The credentials provided were invalid., STATUS: 400. [PI155825] Fixed: Jamf Connect configurations with Okta Identity Engine as the identity provider fail to use the preferred_username attribute during user creation, causing the user to have the incorrect login information assigned to them. To access new versions of Jamf Connect, log in to Jamf Account with your Jamf ID. The latest version is located in the Solutions section under Jamf Connect.Product DocumentationFor additional information on what's included in this release, review the

Using Escrow Buddy. Its rotating keys as expected, but the keys are not working to unlock the disk. I have run sudo fdesetup validaterecovery and it returns with false. I re-run the Escrow Buddy policy and get a new PRK, still says the new PRK is false. Anyone experience this? It seems like no matter what, even though Jamf is saying the PRK is Valid, its not escrowing properly.

We launched Phase 1 of our new Jamf Learning Hub today. In addition to a cleaner layout and crisper learning experience, we now have a better performing and more extensible platform that gives us the foundation to deliver the new features you have been asking for.A few things to know as you explore the new Jamf Learning Hub:📌 BookmarksIf you had pages bookmarked using the Jamf Learning Hub bookmark functionality, you'll need to re-save them: Sign in to the Jamf Learning Hub. Go to the page you want to bookmark. Click the

Hello all,  Today and last week Friday, we’ve been seen users get the Jamf Connect Keychain pop up. Computer will show JC 3.5 is installed and it’s getting the latest Self Service + and the popup reoccurs on restart.  I’ve opened a ticket but wanted to reach out here and see if something clear and apparent is happening.

Hello All,We’ve just started to implement Jamf Pro in our company. Nearly all configurations are completed except sending compliant information to Microsoft Intune. We have to do this because we’re using Azure (Entra) Conditional Access rules in our company. If a macOS device is not compliant it cannot reach internal company resources. Just a simple rule. Steps CompletedJamf <> Intune compliance partner connector connected successfully. Microsoft Device Compliance configuration policy prepared in Jamf Policies -https://learn.microsoft.com/en-us/intune/intune-service/protect/jamf-managed-device-compliance-with-entra-idProblem SummaryAfter enrolling to jamf, we are trying to sign in to Company portal and jamf compliance popup appears. Then we

Hi everyone,I'm working on upgrading our Mac fleet from Jamf Connect 2.39 to 3.7.1 and running into some cleanup issues I'd love some guidance on.Environment:Jamf Pro 11.26.1 macOS 15 Sequoia Apple Silicon and Intel endpoints Devices enrolled via Apple Business Manager (ABM) using Automated Device Enrollment (ADE) Identity Provider: Azure AD / Entra IDCurrent situation: All of our managed Macs have Jamf Connect 2.39 installed. I have already built and validated a Jamf Connect 3.7.1 configuration profile in Jamf Pro and scoped it to a handful of test machines successfully.The problem: When pushing JamfConnectLogin.pkg (3.7.1) via policy, it does not remove or replace the existing 2.39 installation. After the policy runs I can confirm:Jamf Connect.app (2.39) remains in /Applications The 2.39 men

Hello,I have multi-user workstations on which I do not have FileVault activated so as not to have a problem when connecting a new user with Jamf Connect. Unfortunately, the TAHOE update automatically activates FileVault and suddenly at the start of the station an account is requested that can activate FileVault before having the Jamf Connect window. How can we get around the problem or how can TAHOE not activate FileVault?

As a Jamf trainer, there are two questions I’m asked time and time again:How much scripting is involved in the Jamf certification courses? How can I prepare before attending a remote instructor-led course?If you’re planning to take a Jamf certification course and want a clearer idea of what to expect, and how to set yourself up for success, this guide is for you.The Jamf Pro Training PathThere are three core Jamf Pro instructor-led courses, each designed to build on the previous one as your skills develop:Jamf 200 – Core understanding of Jamf Pro, as well as an enterprise-focused examination of the macOS and iOS platforms Jamf 300 – Deeper understanding of the macOS and iOS management capabilities within Jamf Pro Jamf 400 – Automation and APIsLet’s take a look at what scripting knowledge is expected at each level, and how you can prepare. 

I have had success with scripts to insert the auth code for SPSS in past but SPSS 30 will not apply code through script. Popup still comes up. Script that used to work was this one. I have tried few option using the SPSS instruction manual but no success. What's working for you all?   

Reading over the Jamf documentation it’s not clear how to schedule MySQL backups using the Jamf pro server tool cli on windows when the DB is on its own server. I have Jamf server tools copied over to the DB server and I see you can set a schedule in the config file but that will not actually do anything since jamf-pro is not running on this server. It says you can use Schtasks to schedule this but what command do you put in the schedule task? jamf-pro database backup ?If i do it this way should I have no schedule task in the config? Also what account does this need to run as?

Like many of you, part of my job involves erasing and reimaging test machines over and over. This morning I attempted to do something I've done hundreds of times before - erase the drive on my M4 Tahoe test machine and reinstall Sequoia. This time, Sequoia is not available, only Tahoe.It's possible Apple may have restricted the Sequoia installer from Tahoe machines, much like they did with the iOS 18.x installers on iOS 26.x devices.I wanted to get word out there as a word of caution.

BLUF: ASM shows 314 devices assigned to our Jamf Pro (cloud) server, but Jamf Pro is stuck at a 255-device count, preventing macOS Tahoe's native migration lockout from triggering for 50+ migration targets.Hi everyone,I’m running into a sync issue between Apple School Manager (ASM) and a new Jamf Pro instance. For backstory, we are migrating from several independent Jamf Cloud installs to a centralized version. While many of the devices will need to be manually touched, I have more than 50 that can be migrated between Jamf instances. Those devices are on Tahoe, have a T2 chip on Intel hardware or are Apple Silicon, and are DEP enrolled with a valid MDM Profile (not expired) on the legacy Jamf instance. I successfully migrated a separate Jamf Cloud instance into our new, centralized Jamf instance using ASM just a week ago, so the process has proven valid.Currently, ASM shows 314 devices (all endpoint Macs save for 5 iPads) assigned to our MDM ser

My Jamf Connect environment is interfaced with Entra ID. In our testing and pilot phases the deployment went well. However, now that I’m deploying to production we’ve had a sporadic issue where the Jamf Connect login window will claim that the network password doesn’t match the local password and also temporarily locks the account. The user might have to reboot and try again to get it. Anybody else deal with this? 

Hi All,AD bound Mac’s with macOS Tahoe 26.4. When a new user login I got “Sign in to Your Apple Account” and “Age Range” message , any idea how do disable these?thanks   

Today we are releasing a maintenance version of Jamf Pro; highlights include:AI Assistant in Jamf Pro General AvailabilityYou can use Jamf's AI-powered conversational assistant to support your organization's device management and security. AI Assistant consists of individual functionalities called "tools" that are organized in tool groups by product. When you enable AI Assistant, you enable AI Assistant Core, a foundational knowledge tool that can assist you with technical questions about Jamf's software and services. In addition, you can enable read-only tools for Jamf Pro. AI Assistant is disabled by default.To enable AI Assistant for Jamf Pro, log in to Jamf Account and navigate to Organization > AI Assistant.Note: This feature was made available on 31 March 2026 for Jamf Pro environments that support the AI Assistant, regardless of version. For more information, see

Hi,I work at a small creative arts UK University and our IT department has recently contracted a service provider to manage all our Mac devices via JAMF. I am being told that as a new security policy any new OS must be deployed via JAMF within 7 days and any Mac devices not updated will lose web browser functionality.As a Faculty that uses a wide range of audio, video and graphics software on our Macs - often simultaneously on the same device- we have never previously adopted the latest OS for at least a couple of months until any major bug/conflict fixes from Apple and software providers have been implemented. We have also refrained from updating Mac devices whilst in use for art installations in exhibition or live events in rehearsal/performance - so as to ensure continuity of service over a period of weeks.I am wondering how this is handled in other University or education institutions? Do other institutions reasonably manage security concerns through a polic

I understand that it’s expected behavior, but when using the “Preserved Apps” option with the Return To Service feature, OS updates can’t be installed.Has anyone found a way to work around this limitation?

How is everyone handling cleaning up stale devices in Entra? I have the Jamf Compliance Connector setup to register macs with Entra. The compliance reporting is working fine, but the computers show in Entra as registered and last activity as the same date, no activity after registration completed. I normally have cleanup scripts running to disable computers with no activity in the last 90 days but my Jamf macs are not showing activity and I don’t want to disabled them if they still active. My mac used daily shows no activity for over 60 days (since it was registered) in Entra (Company Portal shows connected today):  

  Your Mac is Ready for FileVaultFileVault keeps your Mac safe by encrypting your data andprotecting it with the password you use to log in. If youforget your password, you can use your Recovery Key toreset it.  

Hi Jamf Nation!We are excited to announce Beacon by Jamf Threat Labs.What is Beacon by Jamf Threat Labs? It is a Mac-only threat hunting service delivered by Jamf Threat Labs. It’s designed to help you detect, analyze and respond to threats impacting your macOS environment. Whether you’re building your Mac security program from the ground up or looking to elevate an existing one, Beacon delivers the expertise, visibility and operational support to make it happen.Beacon by Jamf Threat Labs is currently available to limited customers in Private Beta. If you want to learn more, read our blog here or contact your Jamf representative.

On Saturday, April 11, 2026, Jamf Cloud Infrastructure will be patched. During this time, you will be logged out of your Jamf Pro instance. The purpose of patching is to ensure that Jamf Cloud infrastructure and the database service are up-to-date, stable, and safe from security threats. Please see the times for our regions below. Hosted Data Region Date Start Time End Time us-gov-west-1 April 11, 2026 0800 AM CT 1200 PM CT

Hi,our macOS Sequoia clients get the macOS Tahoe Upgrade offered by Notifications since 25th of March.Despite a distributed Configuration Profile which includes the 90 days delay (and worked fine passing those 90 days), Clients get the Upgrade Notification.Did anyone experience the same issue?Is there another way to turn off those notifications?Thanks!