Can anyone clarify what happens if our server is not connected to the VPN, but all other devices are connected to the GlobalProtect VPN? Currently, I have content caching enabled, and it works for devices on the local network that are not using GlobalProtect. My settings: Content Cache for: Devices using a custom local network (with all IP ranges added) My local network: Using a custom public IP address and added TXT record in local DNS.

Need to whitelist / blacklist some URLs.. for all browsers.. toying with Parental Controls.. which now invokes ScreenTime... while it kinda works.. the user is presented with this dialog... and they can 'add' the site.. and even get a dialog that its now allowed.. but.. its not.. all rather clunky..  Any way to disable this dialog?  Any other suggestions for blocking / whitelisting..  trying to not add another product / cost / overhead      

I am having a handful of systems with Configuration Profiles stuck in pending state. Does anyone know of a fix for this? These systems are all Automatic Device Enrolled, they are checking regularly to jamf. I have tried having them reboot, sending blank push from management commands.  These commands have been pending for months. 

Happy Monday all, is anyone having any luck resolving the outlook issue of Error 1001? noted and acknowleged here "https://support.microsoft.com/en-us/office/error-something-went-wrong-1001-signing-in-to-microsoft-365-desktop-applications-6f63238d-d83c-437c-a929-de72fe819793#:~:text=Some%20of%20the%20scenarios%20that,to%20Microsoft%20365%20desktop%20applications."  MS says its ONLY affecting macOS 14.1, but we're seeing it on all versions at this time.  the root cause, in my opinion and tested as well, is that theres an issue when connecting to the MFA portion of the outlook authentication. taking away that MFA in testing resolves the issue, but certainly not a risk anyone wants to take! office online is aour current workaround, but I'm hoping someone has had better luck.  FYI we're on the current version of office for mac and using Azure/entra to authenticate. 

Can we enable location access to specific app on MAC if yes what is the best way. Can we deploy a code on MAC using Jamf or Mosyle. Or any config profile, any help would be appreciated.

Hi, Is there a plist or config I can manually push to devices that allows me to defer an update for more than 90 days? When Apple releases a new major OS, we typically wait until they are in the 14.3.or 14.4 version since I started working in a company with Apple enviornment as we have see many bugs popup for various apps. Some of the apps we use on company level take couple months as well

Tried resetting the dock, reinstalling self service but the icon is always larger than the other icons in the dock. Any reason why? Theres no magnification enabled or anything obvious I can see, the icon uploaded to Jamf is 512x512 as per the recommendations, even the stock icon appears larger than other dock icons.

Posting this for anyone experiencing an Office 365 login loop (Usually happens with Outlook). If reverting to legacy Outlook doesn't resolve your issue, run the keychain removal script below. It will restart the device. (The script is sourced from Scott Feit on the MacAdmins Slack channel and has resolved the issue multiple times for me)      #!/bin/bash # Define the target directory TARGET_DIR="$HOME/Library/Keychains" # Function to log messages log_message() { echo "$(date +"%Y-%m-%d %H:%M:%S") - $1" } # Close the Keychain Access app log_message "Closing Keychain Access application." pkill -x "Keychain Access" # Check if the target directory exists if [ -d "$TARGET_DIR" ]; then log_message "Starting cleanup of directories in $TARGET_DIR" success_count=0 fail_count=0 # Find all directories within the target directory and delete them, logging each action find "$TARGET_DIR" -type d -mindepth 1 -print0 | while IFS= read -r -d $'\\0' dir; do

Hello,As you know, some applications have separate installation files for Intel and Silicon. For example, I write 2 separate policies for Android Studio.1 - Android Studio for Silicon2- Android Studio for IntelBy creating a single policy instead of these two policies. Is it possible to distribute this policy according to the processor model of the machine in scope?In short, I want to design 1 policy and 2 packages.Thank you.

I'm trying to create a smart group of our labs (static groups) but its not working, it can only take one at a time. I've tried re-creating the static groups, still no luck, it will only show one (7 devices or 43 device but never 50).  i did add the site location and the "(" ")'' & "and".  Is anyone else experiencing this? our current instance is 11.10.2

I’m looking for advice on how to integrate Apple Configurator into our workflow to streamline the setup process for new iPads. Here’s some background information: we receive iPads purchased from Apple that are already enrolled in Apple School Manager, with Jamf Pro designated as our MDM server. Our goal is to minimize physical setup time and reduce network strain from updates. Ideally, I’d like to prepare new devices using Apple Configurator with minimal touchpoints. However, I am encountering issues with Configurator, as the setup consistently fails at some point in the process. iPads that have already been set up connect without any problems, but I am facing challenges with new devices. Is anyone else using Apple Configurator in a similar setup? Any tips, best practices, or troubleshooting advice would be greatly appreciated. Thank you in advance for your help!

Today we are releasing a maintenance version of Jamf Pro; this release addresses the following product issue: Jamf Pro Server [PI122414] Functionality for distributing in-house apps and books that were uploaded to a cloud distribution point prior to Jamf Pro 11.11.0 has been restored.   For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. To access new versions of Jamf Pro, log into Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Pro.   Cloud Upgrade Schedule Your Jamf Pro server, including any free sandbox environments, will be updated based on your hosted data region below. Review this guide if you need assistance identifying the Hosted Data Region of your Jamf Cloud instance. If you would like to upgrade manually, log in to Jamf Account and select Jamf Pro Info >; click Upgrade on the appropriate instance. Note: This capability is not

Hi all, I was wondering if anyone had any experience setting up a configuration in Jamf for computer cert auth using freeRADIUS. I am in the planning stages of moving our Macs over to cert based wireless auth and have a few questions regarding the deployment to Macs. Should I be using the X.509 Certificate payload for the computer certs created by freeRADIUS? If not, will the AD Certificate payload work to fulfill this? I will be using pfSense to host the freeRADIUS server, and we are using Ubiquiti APs.

Recently, my organization's Compliance and Security Operations teams requested visibility into how macOS apps are patched. They needed a report showing deployed apps via Jamf and their version status. After two manual reports, I knew there had to be a better way and developed a Python script for automation. Initially, I didn't plan to share the code publicly, thinking it might not be helpful to others. However, a friend, Chris Ball, encouraged me to release it—leading to the creation of Patcher. Manual reporting takes time away from critical tasks like CVE remediation and policy setup. Automating these processes allows MacAdmins to focus on more pressing matters. The time saved with Patcher has been invaluable for myself, and I hope others will benefit from it too. What does Patcher do? Patcher leverages the Jamf Pro API to automate patch management reporting, transforming data into actionable insights. Designed as a Command Line Interface (CLI), it integrates easily with LaunchAgents

Hey everyone, I have been going through different posts across here and Reddit, and I could really use some help. I am attempting to use the Jamf ADCS connector to push a machine certificate to a MacBook, which I can get it to do successfully. In the same profile, I have the network configuration in place there as well.   The issue that I am running into is not anything with the certificate/Jamf side, but with the Windows RADIUS server. I have an unbound AD object for the machine created, but I am unsure what I need to do with the object. The machine currently is successfully attempting to authenticate with the certificate, but NPS is rejecting it for error 8 - User account does not exist.   Does anyone have this set up in their environments, and is there a better way to do things? My security and systems teams won't let me domain bind the Mac devices, so I am using Jamf Connect for authentication, and I assume this is also why I am having account issues.

Have have been testing the removal of admin rights for some of the users in our environment running on MacOS. One issues that has come up is the ability to change the password for Keychain "login". For a standard user that options is greyed out. If we grant them admin rights again that option returns. I know they could just use the Users and Groups option in System Prefs to change the password, but some of our users change their password using a windows box and then want to come sync up the mac after the fact. Just doing a logout and log back in using the new password doesn't always prompt the sync. Is there a plist file or some system file we can change permissions on to allow a standard user to change the login keychain. It seems strange that that would be locked down as its not really a system change. Also just incase anybody wonders, yes the "lock" icon has been unlocked already, but the menu item still shows as greyed out. Thanks for any help!

Hi there,  We have an app that has 44 total licenses, and on Jamf Pro it says there are 24 in use. But only 4 are showing up on the scope. There were 20 pushed into Jamf School with a different token. I am wondering if anyone could help me figure out where I could find these missing in-use "scoped" devices could be, or a starting point? I've tried looking at the static group I think they could be at, but I didn't see anything on one of the devices that are in that static group. I wonder if deleting the static group would help, but I didn't see the app on one of the groups device listed anyway.  Thanks  

We are a mix of Windows and MAC devices. The MACS are Domain joined. User logs in the first time connected to our wired ethernet in the office to create their account using their Active Directory information. Over time the user has a local password for the MAC login screen (the very first password they made) and an AD password which is different and needs to be changed every 120 days.   Scenario: User is on the log in screen trying to get in to their local account with invalid or forgotten password   Attempt: Using the recovery code the user gets to the screen where they reset their password however it always gives an authentication error in the end to complete the change. Seems like even though this is to reset the local account password it needs to be in communication with the domain server. User can reset password if they go back into the office and hook up to a wired connection.   Attempt2: Creating a policy to reset the local user account. Fails to send push to comp

We use JAMF pro and our end users travel a lot. If they forget their Mac password on the road what is the best way to get them back in from Jamf? Thanks!

Updating MAC O/S using JAMF is hit or miss - mostly miss- even with the new "Software Updates" feature recently rolled out. I followed a JAMF Training video https://trainingcatalog.jamf.com/update-macos on the 3 ways I can push out updates. I'm using the first method of creating a Configuration Profile and enabling the Software Update payload. Should there be a specific URL (Software Update Server. Specify a URL of the form http://server.net:8088/index.sucatalog) as suggested? I'm thinking this profile won't work if there isn't an update server to check with? 

Has anyone encountered this issue when trying to use 'Local Login' with Jamf Connect?It has been working fine for me up until now. I didn't make any changes to the config profile so I'm not sure how this has happened. 

Hi all, I don't think this is related to Jamf per se but I am still looking for feedback. We recently updated our stock to use various M3 models. On first connect with previous wodels, we would be greeted by the basic "language selection", then the screen to connect to a wifi network, then the SSO login using O365 logins. With the M3s, after the langauge selection screen, the wifi icon shows wifi is activated but there aren't any networks appearing an we get a message saying that "wifi networks aren't availabe "as if wifi is deactivated. It sometimes works if we hard line it but so far the only 100 percent of the time solution is to reimage the machine. This is going to be an issue since we want to start direct shipping these things to employees who request them when onboarding or changing laptops. Has anybody come across something similar?

Hi all,I have not found anything on the below on the interwebs, anywhere, and am pulling my remaining two follicles of hair out!As of last Thursday, new users on our Macs now can't log into Office for Mac, we're using the latest version of Office (this is the only change).We use JAMF Connect and a custom script to deploy the logged in users email address to OfficeActivationEmailAddress in com.microsoft.office which has been working perfectly up until last week.I've done some testing and tried removing the script from login and just using a PLIST with two entries in:OfficeActivationEmailAddress is set to a manual entry of a test users email addressand <key>OfficeAutoSignIn</key> <true/>With these two set we get the email address prepopulated, as expected but are told we can ONLY use PERSONAL accounts, remove the email address but leave OfficeAutoSignIn set to true and we don't get the email address prepopulated but can manually enter it and all is well in the

Update 11 November 2024: Standard cloud upgrades are scheduled for the weekend of 15–16 November (details below). We appreciate your patience. Today we are releasing Jamf Pro 11.11. Highlights include: Managed Device Attestation Using MDM RequestsJamf Pro now supports Apple's DeviceInformation attestation, a Managed Device Attestation method that verifies the computers and mobile devices in your fleet are legitimate Apple devices. Computer and Mobile Device Inventory Reporting EnhancementsNew inventory information for Battery Health and FileVault 2 enablement are gathered by declarative status reports. Support for New Mobile Device RestrictionsUsing mobile device configuration profiles, you can now restrict the use of RCS messaging, block the transfer of an eSIM to a different device, and preserve the eSIM on an erased device due to too many failed password attempts or the Erase All Content and Settings option.     For additional information on what's included in thi

Is it possible to enable non-admin users access to "system preferences > date & time > date & time"? Subpoints of system preferences > date & time are: -date & time-time zone-clock We want to allow (non-admin) users only to change the "time zone", nothing else. Is this possible or do we really need to open the complete "date & time" preferences for non-admins? Thx! Note: macOS 10.12.x