My company has been using Jamf Pro to manage iPads for several years.  I’m trying to get our Jamf Pro account configured with SSO using JumpCloud SAML and I have a few questions.First of all, I’m new to jamf and not too familiar with the nomenclature.  I have an account in our Jamf Pro subscription but not in Jamf Account (apparently).  I created a Jamf Account but it doesn’t seem to be connected to our Jamf Pro subscription in any way.  I’m assuming that the Jamf Account is some umbrella account that manages all the other Jamf subscriptions (education, pro, etc.)  Is a Jamf Account necessary if we only have a Jamf Pro subscription?If I’m reading the docs correctly, SAML is the deprecated way of managing user logins for Jamf Pro and we’re supposed to use OIDC from our Jamf Account account.  Is that correct?  We are not looking to do anything fancy through SSO, I just want to manage my employee’s Jamf Pro accounts.  We’re not building apps or anything else that need OIDC.Can I just use

New Fortinet customer here. We are testing always-on IPSec VPN (split tunnel) on macOS 26 Tahoe.I have all the Fortinet recommended MDM profile payloads deployed to my test Macs (SEXTs, TCC/PPPC, Notifications, Content Filters, Login Items, etc). But Im still seeing a couple issue, including these 2:1 ​How do I suppress this user-facing pop-up: "FortiTray" Would Like to Add VPN Configurations All network activity on this Mac may be filtered or monitored when using VPN.2 Once approved (which is required for some reason), a virtual ‘VPN’ interface is INSTANTLY created in macOS Network Settings. Yet this interface is literally unusable, and never becomes active. And users are able to remove it manually if they so desire (i.e. it’s not locked). If a user does NOT allow this VPN, this pop-up will appear persistently until action is taken.How can I remove this pop-up and related interface? I dont want end-users to see this in the UI since it isnt ‘real’ and will just lead to confusion and fr

Hi all,I hope I'm posting this in the right place, but I am experiencing an issue with my jamf school shared iPad deployment regarding display names.From the list of selectable users, most users have their first name listed, but for a very select few users, their accounts are listed with their last name instead of their first name. This has become confusing for the younger students here at the school I manage. Hope that makes sense.I don't know why this is, their first names only range between four to six characters, and there aren't any users who share the same first or last name as the affected users in the system. If I could list their entire name that would be ideal, but I'm willing to take any advice or solutions to this problem.My users are provisioned through SFTP sync and uploaded to ASM. I have checked their users through Jamf and it looks like the first and last name are being populated correctly.Thanks!- sammy

Hello everyone We are trying to deploy FortiClient VPN only from this link https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/76cde386-1f8c-11ef-8c42-fa163e15d75b/FortiClient_7.4_Jamf_Deployment_Guide.pdfthe Application installed perfectly but we have issue with configuration of the app1- To grant FortiTray permissions to load and grant network access.2- To grant full disk access to load the following FortiClient processesI have made the same as what they mentioned in the pdf but the user get popup to allow them.what I want is:1- These configuration only install if they install FortiClient.2- Not popup any thing to the user when install FortiClient to allow for permission3- If someone can please shared with me the configuration.

Hi all !How can I enable/disable admin rights to change wifi setup, by script or config profile ?It’s located graphically in the advance pane on the wifi preference pane. Thank for all of your suggestions :-)  

Hi all,I'm running into an issue with device naming in Jamf School (not Jamf Pro) and could use some clarification.Setup:Device: Mac mini (2024), macOS 26.6.2Enrollment: Automated Device Enrollment (User Approved Enrollment)Device Details > Name field shows "Set by policy"Issue:The Mac's local computer name was changed after enrollment (directly on the device), but this change is not reflected in the Jamf School console — the inventory still shows the old name. I tried the "refresh" button next to Details on the device page, but it does not pull in the updated name.Questions:What exactly does the "Enable Renaming Devices" checkbox under Organization > Settings > Enrollment do — does it affect already-enrolled devices, or only new enrollments/Setup Assistant?Since this device's name is "Set by policy" (likely from the ADE naming scheme/template), is there a way to sync the device's current local name into Jamf School's inventory, or does Jamf School always treat the naming poli

Through guided simulations, discussion, and some time with Jamf subject matter experts, you will get direct practice building and deploying blueprints in this workshop. It’s free, it’s two hours, and it’s hands-on: you’re not watching a demo, you’re doing the work.Register now and pick a date and time once you’re logged in with your Jamf ID. Can’t make this one or want to explore more first? Watch the Jamf Short video for Jamf Pro, Jamf School, or Elevate customers. Read the blueprints documentation for Jamf Pro, Jamf School, or Elevate customers. Check out the Jamf Nation Live demo session on the shift to the DDM only life. Learn how to configure identity and access management, a prerequisite for blueprints, with this training series.  Quick Reminders Blueprints will also be covered during the Level Up full-day, hands-on learning experience prior to JNUC in a few weeks. Come join us in person! Stay up to date with all the latest training videos, release notes, Jamf Shorts, and

Hello everyone,This year we’ve got aboout 300 Macbook Neo’s. About up to 5% on the get an error. We enroll them just like we always have. The users log in with their Entra credentials during onboarding. After a while when the login is processed an error message pops up as shown bellow:The only thing for us to do is to format the drive and reinstall the computer. Then the users does the same without any problems. We had never had this error message before until Macbook Neo.Does anyone know we we get and/or what we can do to prevent it in the future?

If you are using SSO configuration and receive the following notification in Jamf PRO or your Jamf Account:“ SSO configuration will be read-only from Thursday, Sept. 10, 5 p.m. CDT to Friday, Sept. 11, 10 a.m. CDT due to maintenance. Creating or editing connections will be unavailable. Login won't be affected. “  Please prepare a standard user account (not an SSO account) in Jamf Pro under:Setings → System → User Accounts and GroupsThis account can be used as a backup to ensure that you can still create or edit configurations in Jamf Pro if there are any issues with your SSO login.

Hello!I am building a package to install FortiClient vpn (the free vpn standalone client) for our users.After several tests, a policy authorizing the security extension is indeed present and allows to avoid blocking it during installation, but a popup asking me to authorize the addition of VPN configuration appears right after the installation.This popup is generated by the "FortiTray" binary and after several tries and I don't know how to authorize it ahead of time so that the installation is totally invisible.It says that ""FortiTray" would like to add VPN configurations"Any idea on how I can authorize this or setup ahead of time ?

Hello everyone,I'm one of our Admins (jPRo) and I work for a very large hospital chain and I've been tasked with exporting all of our mobile devices and asked to create a spreadsheet and a PDF file for presentation for our leadership team to review in their budget meeting coming up soon so they may plan on what we need to purchase as far as EOL devices are concerned.I don't know why, but I seem to be struggling with making this list based on exporting all of our devices which come out to 5,077 devices. I attempted to report my spreadsheet into AI and asking you to make me a list of EOL devices, Near-EOL, and future EOL devices. Well, the numbers that I ended up sending to my manager to review or not accurate, and I looked like a fool and was very embarrassed.Have any of you been tasked with this before and if so, how did you do it and do you have any advice on what the best way to go about doing it is besides trying to use AI. Or, if any of you have been successful in doing this using

Long ago we distinguished between our Staff  and Student Macs by “installing” a DMG that just created a folder. We used the search term of “Packages Installed by Jamf Pro” with that DMG name. This has worked fine for us for the past 10+ years. We installed this package on Student Macs and didn’t install it on Staff Macs. If we needed to convert a MAc from Student to Staff, we just used the Jamf Pro capability to “Uninstall” that package. That removed it from the list of “Packages Installed by Jamf Pro”. It seems that with the (no longer recent) removal of Jamf Admin and the ability to index packages, the ability to “Uninstall” packages and DMGs has gone away as well. So we can still install that DMG to tag the Mac as a Student Mac. However, we can no longer “Uninstall” that DMG.  Which brings me to my question: How do I remove an item from the “Packages Installed by Jamf Pro” list? This isn’t the same as the package receipt list that you get from running pkgutil --pkgs. I am hoping tha

We use Apple TVs with Playlister throughout our sites, and we’ve been having some audio/video sync issues that are resolved by rebooting the Apple TV. From what I’ve gathered, the only way to reboot all Apple TVs in a group is to manually navigate to the smart group in Jamf Pro > View > Action > Send Remote Commands > Restart Device. This is not ideal not only because it isn’t a process that can currently be automated, but because we would like to have these Apple TVs reboot outside of operating hours.

I’ve had people complain about not being able to get admin rights.  It turns out they’ve hidden the Self Service plus app which Tahoe allows.    It’s a stupid thing but is it even possible to prevent folks from removing certain apps from the menu bar.  And if it’s possible, how do I do it?  

The devices that I am managing Shows as MacOS 15.3.1 and shows as up to date. I don't have any restrictions on MacOS update. somehow users are unable to see any new MacOS update? When I try pushing the update through Software update, it's failing. possible it's because these devices were user enrolled. I am trying to  get a MacOS 15.5 Pkg and make users download from Self service and update.  How to get the latest Pkg or any script that i can use. It's been 2 days of me trying all sorts of scripts and nothing works.  Thanks in advance

Does anyone have any guides for getting the dev environment setup for Jamf platform? I want to run a set of platform APIs to verify a user case.

I am looking to report the status of Location Services on our fleet.  I found the following script online and tested it but it only reports back disabled even when LS is enabled.   Does anyone have a working extension for this?  Or can some assist in making this one work? #!/bin/bashuuid=$(system_profiler SPHardwareDataType | grep "Hardware UUID" | awk '{print $3}')domain="/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd.${uuid}"plist="${domain}.plist"if [[ -f "${plist}" ]]then    status=$(defaults read "${domain}" LocationServicesEnabled)    if [[ "${status}" == "1" ]]    then        result="Enabled"    else        result="Disabled"    fielse    result="Unavailable"fiecho "<result>${result}</result>"

Recently, the ability to manually type in strings to smart group criterion has changed.  Now, you have to hit the ellipsis (3 dots ...) button to match your entered string to a smart group before it is accepted and can be saved.  Previously, I could just type in the name and if the name matched a smart group, I was able to save, otherwise, the UI would give me an error saying that group name couldn’t be found.  But it was easier and quicker because I didn't have to deal with the lookup process.Has anyone else seen this? I submitted a support ticket on this and was told by multiple reps this is now the only supported option and is the expected behavior.  Therefore, I have filed a feature request to bring back the old entry method so I (and you) can manually type in a group name.  Please look at the request and upvote to get Jamf’s attention on this.https://ideas.jamf.com/ideas/JPRO-I-2243Thank you.

What is learning and do you like to learn?Do you know what content would be relevant for you?Hey, I thought you are here to teach me and not to ask questions.Yes, but questions are a method of teaching and I have a bunch of those.But what about learning, how do we learn or more precisely:What type of learner are you?Auditory / Visual / Read&Write / Kinesthetic(more acronyms, just like a Jamf Class on day one)"So let’s explore."Learning something new has so many options today, not all of them are made for you and me and sometimes I need multiple choices. Not because a resource is wrong, just it connects better with my brain. I remember teaching ski lessons to a bunch of teenagers and I was stuck with one of them on day two. No progress, tried it all, nothing clicked. So we decided to switch training groups. And it clicked, I saw them going down hill super nice. I asked my fellow ski instructor what he did, "same as you before" he said, "maybe just another perspective".While we can’t

I’ve been using iCloud Mail ever since, and I still can’t understand how a mail app can be so frustrating when it comes to basic things like text formatting, copy pasting and handling email attachments, working notifications,…On iPhone, the mail attachment is really horrible… If I want to attach an image the image, it is not separately attached as an own attachment but just lies below the text I wrote… Why??I’ve tried a few other mail apps, but either had security concerns or didn’t want to pay for the Pro features.So this is partly a rant and partly a question: how have you guys managed to make Apple Mail work for you? And if you’ve switched to another mail client that you really like, I’d love to hear your recommendations.

I've got an issue with Screen Sharing on to a lab of Macs where the screen is completely black apart from the cursor moving being visable. Using Screen Sharing via Finder or using the Apple Remote Desktop application presents this issue.  The only fix I've found so far is to send the "Disable Remote Desktop" command from Computers > Management > Management Commands, force the device to check into Jamf Pro, then send the "Enable Remote Desktop" command to the device. After these steps, the black screen issue is resolved and screen sharing/ARD works as expected. When this issue occurs, I can easily log into Jamf Pro, send the management command to a smart group of my lab Macs, another management command to force them to update inventory, then a third command to force them to re-enable Remote Desktop.  Is there any way to automate this process into a policy so an engineer doesn't need to log in and manually run the commands?

I am using the “Mac Apps” to install and maintain a couple of apps. This includes Chrome.I noticed something weird there. For colleague X “Mac Apps” says her Chrome is up2date. But looking at her Macbook and at “Patch Management” she is a whole bunch of Chrome updates behind. Any idea where this comes from?

After wiping and re-enrolling lab machines, approximately 23 out of 29 are showing the native macOS username/password login window instead of the Jamf Connect Login OAuth window. The remaining 6 machines show the correct College branded Jamf Connect login screen. What I've confirmed on the broken machines:JamfConnectLogin.bundle is present in /Library/Security/SecurityAgentPlugins/ Jamf Connect Login is fully registered in the authorization database (security authorizationdb read system.login.console shows all JamfConnectLogin entries) Jamf Connect Login v3.10 and Jamf Connect v3.10 configuration profiles are both installed A StagedPlugins folder appears in /Library/Security/SecurityAgentPlugins/ after every restart but is always empty No autologin configured A conflicting LAB: Login Window Settings profile (com.apple.loginwindow payload) was previously scoped to these machines and has since been removed but this did not resolve the issueHas anyone experienced Jamf Connect Login silent

Hello all, We have been having huge issues with the standard account; cannot update software(Chrome), cannot add personal network printers, cannot add WiFi, etc. So it was the consensus to promote the standard account to an Admin account. I am hoping there is an script to perform this very act, because updating 900+ devices is a little daunting. I see there is a script to demote and we have it in the wings for deployment should this entire Admin rights thing go South. I am no scripter, but know enough to follow through what will happen when things are run. So any and all help is appreciated.

Hi everyone!We recently ran into an issue with our push certificate renewal on our Jamf Pro instance that I wanted to share, along with the workaround we found — in case it helps someone in the same situation.The problem:We had renewed our push certificate several times using different Apple accounts instead of the one originally used. This caused the Topic ID in Jamf Pro to no longer match, which broke our ability to send commands to our devices.It took us a while to notice, and by the time we did, MDM had expired on a large number of our Macs since no commands were getting through anymore.To make matters worse, we had disabled the ability to manually remove the MDM profile on the machines, so we ended up with a fleet of Macs stuck with an outdated/expired MDM profile that we couldn't remove or replace.We contacted Jamf support, and the only official solution was to recover the correct Topic ID by renewing the original certificate — but that wasn't possible for us since we no longer h