I asked this same question on the Clearpass forum, in case there are more people there that are doing similar things, but I'm hoping for someone with the conceptual understanding to just give me a nudge in the right direction regarding this setup. We have been using 802.1x with Machine certificates issued by AD, with ClearPass and Windows machines for a couple years now. I understand the process that the windows machine joins the domain, get's a certificate, and then our clearpass servers are domain joined and can authenticate the machine with Active Directory using some of our various AD servers. All of that works well, and makes sense to me. Now we're extending it to macbooks and adding Jamf, so that we can also set up certificates on the macbooks (they will not be domain joined) via SCEP/NDES integrated with our windows CA, with the goal of them also doing 802.1x with EAP-TLS. So far, we have the SCEP process working fine, and the macbooks obtain their certificates from our CA via S

Hello everyone, still a beginner with the 14 days trial.   I know what I want but I don't know how to archive that. I would like to give out a device and the user logs in with his MSO365 account. (name@comapny.com) So the device gets entrolled to "his name".   - Cloud Services connection is on. - Cloud identity provider is configured with our Entra ID. The test shows I can search for users and groups and see if they are part of a group   How do I need to proceed to get the users in Jamf Pro?   Thanks a lot in advance.

Hello - we have iCloud accounts disabled for our staff. However, many of them would like to use Apple Music as a quality of life issue, and some have a longstanding workflow of purchasing music from iTunes for work functions. In my restrictions profile I have "allow Apple Music" checked, however, in my testing I still cannot log in to either Apple Music with a subscription account, or even the iTunes section of the app.  Is there a way to enable Apple Music and iTunes for users without enabling iCloud accounts? Thank you!

We upgraded our on prem Jamf Server from 11.1.5 to 11.13.1 and after that when open Self Service is says "Self Service Cannot reach a JAMF MDM server".When I download a new Self Service from JAMF I just got version 11.1.3? 

Hi, I want to enable set time zone automatically using your current location radio button on system settings for all my org Mac on bulk. How do we get it, I want all the Mac date and time settings to be like it is on this image.

We have a lot of users who aren't updating Chrome. How are you enforcing updates and relaunches to apply the updates? 

I am looking for a way to remove a firmware password via JSS policy. I work for a school district and we try to lockdown the computers so that the student don't have access to the recovery panel amongst other things. The problem is that there seems to be an issue with at least one of the computers not recognizing our firmware password, so we have no access either. Is there a way to do this using the built in policy (under accounts), or am I going to want to write a script based on the firm passwords article? Possibly helpful information:MacBook Airs (Mid-2011)Lion 10.7.4 and some 10.7.5current JSS 8.61

Hello !I made a smartgroup for macOS greater or equal to 15 Sequoia. It should be simple:Criteria: Operating SystemOperator: matches regexValue: ^1[5-9]I have NO computer running Sequoia, but I have 3 results. 3 Intel computers with macOS version 10.14.6 (2 of them) and 10.15.7 for the last one.I searched all around and can't find where is the problem. I'm not really used with regex, but this one should be simple.Any help is welcome

Hi! Please! I'll need to know what SQL syntax I need to run in the Mysql database to get the scope (and also exclusions) of profiles and policies. Thank you very much

When we open a policie and look at the logs which computers are completed or failed the button under actions called details is not working anymore. The button next to it called flush i functioning just fine. Does anybody noticed the same problem ?? we are using jamf pro cloud and i got some mails that there was a update so not sure if it has anything to do with that.

I set up a push certificate with the intention of being able to send non invasive messages to IOS devices through the APN and Self Service app as opposed to locking the screen on a user. Notifications are typically temporary so in order to verify they are seen by the user, I would like to change the notification to persistent so it doesn't go away until the user views the message. I see in the IOS settings menu for the Self Service app, I can manually change the notifications to persistent but I don't want to touch each device. Is there some XML I can add the Self Service app in Jamf that would be associated with the app level notification settings? Or is there another way to do what I want?Thanks,Rob 

we execute a script that prompts them to enter their current Mac login password along with the 6-digit PIN they wish to use as their password moving forward. Upon setting the Mac login password to a 6-digit PIN using the script "sudo dscl. -passwd /Users/"$LoggedInUser" "$currentPassword" "$newpin, successful password conversion occurs. However, post-restart, users who are logged into iCloud receive a prompt stating "This Mac can't connect to iCloud because of a Problem" and are asked to log in to iCloud again. Additionally, the Touch ID configuration removes previously added fingerprints, necessitating the need to reconfigure Touch ID and log in to iCloud after setting the password as a PIN and rebooting. Has anyone seen this or any hints about this

What is the best way to stop the macOS Sequoia install app from downloading automatically? The problem that this creates is when non-admin users try to upgrade to macOS Sequoia, the install app launches. The install app requires an admin user to run the install. If the upgrade is done entirely through Software Update, a non-admin user can run the upgrade. The install app doesn't launch since it wasn't downloaded. This was an issue last year when I opened up upgrades to macOS Sonoma. I had to create a policy that would temporarily elevate users to admin. They would be demoted back to a standard user at the first check-in after the upgrade. This worked well, but I prefer not to have to do this again.

I believe Scheduled updates should work, but I probably did something wrong.So, I created a smart computer group where I added my machine. Then, I opened software updates and tried to force macOS updates for this group (I have used different flags to force the update). My machine is Apple Silicon (m1). I don't see a proper way to check scheduled updates on my machine, so I use API (v1/managed-software-updates/plans) for it.In answer, I see already 14 plans, and most of them failed with the error "EXISTING_PLAN_FOR_DEVICE_IN_PROGRESS" .That means at least the plan should be executed, but nothing happened.What did I do wrong?{ "totalCount" : 14, "results" : [ { "planUuid" : "09487431-7d17-4c4f-baa2-5b5d03f7c076", "device" : { "deviceId" : "579", "objectType" : "COMPUTER", "href" : "/v1/computers-inventory/579" }, "updateAction" : "DOWNLOAD_INSTALL_SCHEDULE", "versionType" : "LATEST_MAJOR", "specificVersion" : null, "maxDeferrals" : 0

Hello,   Apologies if this is not the right place to ask questions like this. I tried searching before posting, but did not find anyone else already asking about this recently.   I have set up a prestage enrollment with the option "Minimum required macOS version" set to "Latest version based on computer eligibility". I thought that this would update a computer to the latest version of macOS that is compatible with the device, but it seems to just install the latest version of macOS that came with the device. In my test case, I am using a MacBook Air (M1, 2020). When I get to the desktop after the Setup Assistant finishes, the first thing I get is a notification about a macOS update available, which is not what I expected. Here's what I did:1) the MacBook Air had Sequoia installed before, and I used the Jamf management command "Wipe Computer" from the web interface2) the computer reboots, does its thing, and brings up the Setup Assistant3) the prestage enrollment seems to be w

Good morning, simple question about Jamf Connect Deploy & Updates integration in Jamf Pro. Currently my configuration is: deploying Jamf Connect not in the prestage via .pkg (only launch agent) but via the integrated functionality of Jamf Connect combined with the Jamf Connect Login Configuration Profile, as shown in the screenshot. It works. Two questions. 1) In your experience is it a stable configuration? Up to now it has never given me problems, but I would like to update to 2.44 (I'm stuck on 2.39) and since the profile is in scope on All Managed Clients I'm wondering if it's stable and the best option. 2) If I remove this integration in the configuration profile, nothing would happen to existing clients, right?That way I could simply deploy the update via policy and reinsert the Connect .pkg in the Prestage, just to have more control. What do you suggest? If the integration works well in your experience i could simply choose the new version and keep this configuration :)Tha

I've tried deploying Mohs Surgery iOS app(https://apps.apple.com/us/app/mohs-surgery-appropriate-use-criteria/id692790649) to managed Macs through Jamf Pro w/o success. I've made sure to match the short version, bundle ID, and app link. I can deploy this to iOS devices just not Macs.I've confirmed on a vanilla M1 unmanaged Mac that it works through App Store.Through self-service it attempts to install but spins infinitely.Through automatic install it shows 1 license used but never shows up in /Applications.Included below are the configs for Mac and iOS:

Very recently we've had some users who have upgraded their version of macOS beyond Monterey up to Ventura or Sonoma (I know, we need to get away from it ASAP, but we're stuck a bit longer because of the Microsoft/Adobe SMB hidden file issue).Our staff are all standard users and do not have admin access to their computers. In the past, any attempt to upgrade macOS to a new version would not be possible without entering admin credentials.Why is this suddenly being allowed to happen and what is the best practice using Jamf to prevent it?

Hi all, Having a bit of a struggle figuring out how to package and send out an application without having user have to sign in to an apple account. See image attached. Is there anyway in composer to bypass signing with an apple account to open the app?

Hi  Can someone please help me with the nudge custom launchagent? I am trying to run Nudge in every 3 hours instead of default 30 mins.  So far, I tried to edit the .plist file in /library/Launchagents and repackage Nudge from Composer and deploy from JAMF, but no luck so far. Got the error saying unable to move files in final destination while running policy.   

Background information: I need to mass remove all devices from all groups via api I've been reading through all the API Calls available from jamfs /api page, i've come to the conclusion if it would be anywhere, it would be here [https://ENTERJSS.URLHERE] :8443/api/#!/mobiledevicecommands/createMobileDeviceCommandURL_post but via "Delete" (assuming a Remove From Groups Option is an available command) instead of "Post" but "Post" is all that's available. Am I missing something? Does anyone know of a way to remove an iOS Device from all static groups via API Call? Thank you

Hello everyone, I hope you are well and can answer my questions.   We are currently on-boarding a new client and they are using MaaS360 at the moment with another MSP. I have everything just about finished up in JAMF, except Auto-Enrollment which requires connecting to the Apple Business Manager Server. Once I do, that is usually what bring in the devices (If I remember correctly). If the devices are currently already setup with a MDM profile on them with another MDM service provider, would that be interfered with if I would setup the connection between ABM and JAMF? I am wanting to make this transition seamless and have zero down time as the customer works 24/7 and needs access to these devices.  I have only done setup of new users to JAMF and not migrated from another MDM Provider. Any insight would be helpful.    My Plan was to have the users setup and tie that to Groups and profiles so that when he sees the users account it downloads the appropriate profile and

We are a young company and have been on Jamf Pro for less than a year. We were not able to start our operations with Apple Business Manager (ABM) so we will need to bring our existing inventory (all purchased direct from Apple) into ABM. I have been reading about the process here and I am concerned about the part that says:If you want to add a Mac that’s currently configured, you must first erase all content and settings.Important: All your data will be erased. Make sure you have an up-to-date backup of your data because it will all be erased.We have more than 100 active computers in Jamf. Is there a way to bring them into ABM without erasing everything? I can't see how that is going to go over well with one user, let alone 100+.Needless to say I am looking for some guidance (and hopefully some reassurance) that there is a better way.

I would like to stop spotlight from indexing certain locations across all my Macs. I need it to stop indexing the mounted network shares. Is there a way to do that? I could not find a setting regarding that in Jamf Pro.

Would there be any issues with using the same ABM account to manage volume purchasing across multiple Jamf Pro servers/instances? Any particular reason you would want to avoid doing this? I tried searching for similar questions here and information in the docs, but didn't find anything relevant. Thank you.https://docs.jamf.com/10.26.0/jamf-pro/administrator-guide/Integrating_with_Volume_Purchasing.html