Hey everyone Since a couple of Sequoia releases the version of Safari is not being updated on our Macbooks !  As example this morning I've updated my (enrolled) machine to Sequoia 18.4 but my Safari remains on version 18.2 (19620.1.16.111.6, 19620). Of 88 devices (all up to date with macOS -> 15.3.2) 77 devices only have Safari in version 18.2 ! softwareupdate -l doesn't show any available updates. Does anyone else have seen this behavior ?

My organization has opted to index the /Users/ directory for various reasons.  This hasn't been a big deal until I got a request to patch an application where the dev reused their app name and bundleID on the macOS and iOS versions.  As a result, searching for either the Application Name or BundleID catches machines with it in /Applications/ and machines that have a placeholder in ~/Library/Daemon Containers/<device info>/Data/Library/Caches/Placeholders-v2.noindex.  I'm kinda stumped on the best way to scope a smart group to include installs in /Applications/ or ~/Applications but exclude that placeholder directory.  Usually, the devs have slightly different bundle IDs we can use to make things more targeted. Does anyone here have any recommendations for the best way to scope a group so that it doesn't catch those placeholders locations?

Has anyone else had issues with a very slow to load dashboard with Jamf Pro 11, nothing I seem to do improves the load time as well as information that was present before, like build number etc... are all missing, which is fine, but it does make it give you less information and with slow load times it's just very cumbersome to use now.Any potential fixes for this, cleared cache, incognito, different browsers, no hardware acceleration, different OS, nothing seems to work on load times.

Any idea what this means? OSUpdateStatus - The software update request for this process was denied as another process is currently performing an operation. Please try again later.

Hello! At the school where I work we are planning to convert the mobile user accounts (connected to AD) to local user accounts, and make them admins.I saw the fantastic script on rtrouton's GitHub. I tested it on a test machine and works like a charm, though the issue I have is that it asks for user input, and trying to push it via policy in Jamf, it simply waits. So the question is: is there a way for me to achieve this via Jamf Pro, without the use of Jamf Connect (we currently don't have it)? Thank you

I swear I stumbled upon the ability to do this once but cannot for the life of me remember where or how I did it. So... can you re-order the search categories as seen in the screenshot below? For instance, is it possible to set it so that "Name" comes up first, then "Serial Number" then "Building" instead of how it shows up now (Name, Device Phone Number, Lost Mode Enabled)? It's nitpicky, but I was almost sure it could be done to re-order these categories. 

Doing testing in my office and pushing out several commands and profiles to a device. The device is connected to WIFI and has 5 bars signal strength. Everything works great until the screenlock kicks in, at which point, all progress comes to a complete halt. Any commands not executed going into pending with the status message "Device was busy. Will try again".Seriously, if a device has a good WIFI signal and connection, we should be able to send updates to it. This is clearly related to the screenlock kicking in. Question is, why? Is there some helper service that stops responding if the screenlock is on? Or does the WIFI stop transferring data if the screenlock is on?What if we tell our people to leave their devices plugged in over night to do a bunch of updates? Will they be pending all night long and then basically make the device useless in the morning when they unlock the screen and want to get to work? 

I created a script that prompts users to run the latest macOS update. The script works perfectly when run through a policy, so there are no issues with the overal functionality of the script. The policy is scoped only to Macs that are not yet running macOS 15.4. We have not decided to allow updates to 15.4.1 just yet. I noticed that the policy ran on a Mac running macOS 15.4. It's likely that this Mac had not yet ran a current inventory that would have put it in the macOS 15.4 smart group, which would have excluded it from running the policy. I decided to add a function to the script to check the current installed macOS and then compare it to the required macOS version. If the Mac is already running 15.4 or higher, I want the script to exit without doing anything. The idea is to run this function before doing anything else. If I fill in "15" for "reqosMajor" and "4" for "reqosMinor", this works perfectly. I put this function into a script by itself to test. Each time the function runs

This was specific to our environment but I could see other environments might run into this or something similar. Running nightly updates and reboots we ran into an issue with Intel devices that would would boot into recovery mode after updates. We did a bit of troubleshooting and realized it won't happen when you run command line softwareupdate --iaR. We couldn't have full OS updates run on these devices so we had to build a script to do that cleanly. Built a script out that looks for the macOS full installers then does a compare and skips any with the full OS update titles.    #!/bin/bash echo "Checking for updates..." # Get list of full macOS installers (e.g., macOS 14.x, Sonoma, etc.)full_os_install=$(softwareupdate --list-full-installers 2>/dev/null | awk -F': ' '/^ *Title: / {print $2}') # List available updatesavailable_updates=$(softwareupdate --list 2>&1) # Exit if no updatesif echo "$available_updates" | grep -q "No new software available."; thenecho "No u

Is anyone else experiencing multiple reauthorization prompts per day/week with Platform SSO? I have several users reporting this issue, and it's been ongoing for weeks without a clear cause.

Simply put we are looking for a way to disable the ability to save passwords in the major three browsers (Safari, Firefox, Chrome). Through all of our searching we're unable to find which preference files, or settings we can push out via Jamf to disable this. It seems the modern versions of the browsers make this complicated. Ideally if it was a package we could deploy via a policy that would be perfect, especially if the users themselves couldn't go and manually enabled this option later. Also if it was something we had to run say, once per day, we are probably open to doing that as well. Just seeing if anyone has any ideas or methods they are using.

Is anyone else experiencing an issue where Configuration Profiles are being removed? Every morning, these profiles disappear from over 30 devices, and I can’t work out why. I’ve raised it with Jamf Support, but thought I’d ask here in case anyone else has come across something similar. We’re running Jamf Pro Version 11.14.1, which we upgraded from 11.6 a couple of weeks ago. I’m not sure if the upgrade is the cause, as I didn’t notice this behaviour before the upgrade. I'm seeing this under Management History section.    

Hi Jamf Nation,I’m happy to announce that Identity Automation is now officially part of the Jamf family! This exciting milestone represents a significant step forward in our mission to help organizations succeed with Apple.   Identity Automation brings industry-leading expertise in identity and access management, and their addition to Jamf strengthens our ability to deliver seamless, secure access for organizations managing a growing number of devices. This partnership is particularly exciting because it combines two crucial elements of modern device management: Jamf’s expertise in device management and Identity Automation’s advanced identity solutions.   What does this mean for you? Simplified Access Management: Streamlined user authentication across your ecosystem Enhanced Security: Integration of cutting-edge identity solutions including Single Sign-On (SSO) and Passwordless Authentication (PSSO) Improved Compliance: Stronger identity management and policy settings t

With Jamf Pro 11.15, utilize declarative device management with new Jamf Pro blueprints, get ready for compliance benchmarks, and enforce new restrictions for computers and mobile devices! Be sure to check out the Jamf Pro release notes for all of the exciting new features and enhancements. Thank you for your continued support and feedback! https://learn.jamf.com/en-US/bundle/jamf-pro-release-notes-videos

Despite documentation that seem to indicate that Bootstrap Tokens are automatically escrowed when using ADE, it still requires an admin to log in for the first time for this to happen. In order to force it, we are using scripts during Enrollment to create and activate a Secure Token for the Managed Local Admin account created during PreStage with a known password. Once it is created, the Bootstrap Token is escrowed by another script also during Enrollment. For both scripts, we pass the known password for the admin account as a parameter.   So we've now achieved our requirement to have computer labs' Bootstrap Tokens escrowed during Enrollment without an admin having to physically go to each lab PC and logging in.   However, we're concerned about the Managed Local Admin account having a fixed password. If we enable LAPS on the Managed Local Admin account, will there be any potential issues? The way we see it, the known password will just be used twice during Enrollment when th

  Hi everyone,Has anyone recently tried using the softwareupdate --fetch-full-installer --full-installer-version 15.4 command—either directly or through a Jamf policy? This applies to any version, not just 15.4. I tried running it earlier today and consistently got the error: “Install failed with error: Update not found.” I’m not sure if Apple has changed something behind the scenes, but it doesn’t seem to work anymore. I came across this recent discussion where someone else ran into the same issue:https://discussions.apple.com/thread/256042015?sortBy=rank

Hey Jamf Nation, I'm currently trying to uninstall Cortex XDR from company devices, but I'm encountering an error that says "Uninstaller not found." The uninstaller is located in the folder '/Library/Application Support/PaloAltoNetworks/Traps/bin/'. Do you have any recommendations or suggestions? Here is my script for the uninstallation: #!/bin/bash # Set your master key here MASTER_KEY="master-key-here"   # Path to the uninstaller app UNINSTALLER_APP="/Library/Application\\ Support/PaloAltoNetworks/Traps/bin"   # Check if the uninstaller exists if [ ! -d "$UNINSTALLER_APP" ]; then   echo "Uninstaller not found at $UNINSTALLER_APP"   exit 1 fi   # Launch the uninstaller and enter the tamper protection key osascript <<EOF tell application "$UNINSTALLER_APP" activate end tell   delay 2   tell application "System Events" tell process "Cortex XDR Uninstaller" repeat until exists window 1 delay 1 end repeat   set frontmost to true  

Despite documentation that seem to indicate that Bootstrap Tokens are automatically escrowed when using ADE, it still requires an admin to log in for the first time for this to happen. In order to force it, we are using scripts during Enrollment to create and activate a Secure Token for the Managed Local Admin account created during PreStage with a known password. Once it is created, the Bootstrap Token is escrowed by another script also during Enrollment. For both scripts, we pass the known password for the admin account as a parameter.   So we've now achieved our requirement to have computer labs' Bootstrap Tokens escrowed during Enrollment without an admin having to physically go to each lab PC and logging in.   However, we're concerned about the Managed Local Admin account having a fixed password. If we enable LAPS on the Managed Local Admin account, will there be any potential issues? The way we see it, the known password will just be used twice during Enrollment when th

Hello, How would I go about allowing Sidecar through the block all incoming connections toggle for MacOS's firewall? I've added the bundle ids com.apple.sidecar-relay and com.apple.sidecar-display-agent to the allow list. This did let Sidecar through but for some reason it's stopped working after a few days. No changes were made during this time.   Any help would be appreciated. Thanks!

I have an issue in most of the mac, after enter the password it will stuck by showing loading like below image. This is happening for while restart and login or after un lock the device, to login need to do force restart the MacBooks. Does anyone faced this issue? Any solution for this?    

Challenge - Using Computer-Based Certificate Authentication after Microsoft's’s Implementation of Strong Certificate Mapping while leveraging ADCS requires some extra steps to gather Computer Information from Active Directory.   As per Jamf Tech Document - Supporting Microsoft Active Directory Strong Certificate Mapping Requirements Microsoft implemented their changes on the 11th February 2025. The existing article provides detailed guidance on how to overcome these changes and adhere to the new requirements from Microsoft. The method provided via an LDAP Extension attribute works great for User-based certificates. The recon information is going to pull the SID for the user and not the computer. We also have no way to query computer records from Entra ID or LDAP connection, as we using Inventory Update LDAP Connection to query user info only   When binding a Mac to Active Directory. A computer record is created which will contain the SID that is required to adhere to the new

Hi Teams! Migrating to Self Service Plus and started testing. Created the profiles\\configs and devices are getting the new Self Service Plus portal with no issues.  What is proper process to uninstall self service legacy? Do I create smart\\dynamic groups that check for self service + installed then create app block\\uninstall for self service legacy when those devices meet the criteria? Thank you!

There is a lot of information about custom macOS screen savers and how to implement, but it took me a long time to sort through everything and find answers, so i am posting my findings here. I am going to try to keep it simple. Task: Deploy a custom screen saver built by an in house developer using xcode in .saver format. Set the screen saver for the login window and the logged in user. Solution:Part 1 - According to an Apple KB article, you cannot set a "Custom" screen saver at the login window. The article publish date is a bit stale, but after working with Jamf Support and my own testing, this still holds true up to macOS 10.15.2 (also tested on macOS 10.14.6). https://support.apple.com/en-us/HT202223 Part 2 - You can however set a screen saver for a logged in user. Package up your custom screen saver, install it at the /Library/Screen Savers/ path. Add the script below to Jamf Pro. This script was provided to me by Jamf Support. Create a policy, set it for check-in once per co

Hi there Nation!  Recently my employer asked to track what employees do on their MDM managed laptop. For example, They want to track every little thing that the employee does on their laptop whether said employee is watching Netflix, Downloading documentation, working on personal projects instead of work related projects. Is there feature on JAMF that allows this? I wouldn't like to source out a 3rd party for this, but if not possible in JAMF then I could do that. I know we have logs but it's not detailed enough for them. Please and thank you!

Hey everyone, at the moment we're testing a new WiFi network. Some of our students iPads have been assigned a profile for that WiFi network, so they can log in while supervised with their teachers. The profile is set to not automaticly log into the wifi network, so the iPads don't just yet rely on that network. Now I tried to update that setting so that the iPads SHOULD automatically log into the wifi network, but the setting on the iPads themselves does not update, even tough the profile has been updated in Jamf School. The other way around (iPads connect automaticly and the profile is updated so they don't do that) the setting updates as intended. Is this a bug? Does anyone have an idea how to get around this issue without making the iPads forget the WiFi completly?