We have a user who wants to run iMovie and Music on an iPad managed by JAMF.  They want to make promotional videos with iMovie and use Music to create playlists for events at our on-campus art museum. Both require the user to sign in with an iCloud account to launch the App (correct me if I"m wrong, I'm not a wiz at all this).  I don't want to encounter Activation Lock with this iPad so I'm wondering if a Managed Apple ID is the solution or if an email address that we create for the user (and know the password once they use it to create an AppleID and iCloud account) is the correct method. WWW research has not yet revealed this particular situation; can someone wiser than me offer help?

There is a notification in the Jamf Pro console showing that the Push Notification cert will expire in x days, but I can't find the option to send me an email to prompt me to take action. I do not live in the Jamf console! If this does not exist, does anyone have any suggestions for implementing a reminder/alert/notification externally to Jamf?  Thanks! 

Hi there,Does anyone have a working method of disabling FileVault maybe through a script? The FileVault user is not the prestaged local admin account but the users themselves. Most likely this will require input from the user which is completely fine.One of the ways of doing this I thought of but may not work is to enable FileVault on the prestaged local admin through a script and then turn off FileVault alltogether but I'm just checking if anyone else dealt with this issue in a more graceful way.

My district has been using Jamf School for several years now and we love it.  It is much better than the MDM we had previously, and made our transition to 1:1 very easy.  We are considering an upgrade to JAMF Pro to get access to possibly some more features.  I would love to hear some feedback from some who maybe have used or have knowledge of both and get your thoughts on whether we should do the upgrade.  What are some of the perks of pro that would make the upgrade worth it. Thanks in advance.

Hello community, currently having the issue that we have two different accounts (asm/jamf). for a better experience we want to consolidate these, but not sure what the correct way is and I can't find any relevant articles. all iPads on both accounts are DEP registered. 1. adapt the DEP registration from ASM account 1) to account 2) - then the devices automatically end up in Jamf? (if yes, can we do this on our own?) 2. remove the devices from an account (via ASM) and add them to Jamf via Mac and Apple Configurator 2 or is there another way? Thanks in advance.

Just wondering if I missed something ... Could it be that Apps from the Mac App Store do not work with Smart Groups in Jamf Pro 11.11 ? Since changing the target for some MS Office Apps to a Smart Group, those Apps do not receive any Updates on the Macs in the scope of the Smart Group. The MDM Management history looks like this:   

I'm deploying the following PLIST config to Macs but users can still sign into other OneDrive Business accounts and they can still disable folder backup. Is there anything wrong with the below config?   <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>AllowTenantList</key><array><string>482a4ef9-66e4-4e76-9f24-6da09a713ee5</string></array><key>BlockExternalSync</key><true/><key>DisablePersonalSync</key><true/><key>DisableTutorial</key><true/><key> KFMBlockOptOut</key><true/><key>KFMSilentOptIn</key><string>482a4ef9-66e4-4e76-9f24-6da09a713e5</string></dict></plist>

Dear all, on our Jamf Pro installation, an upgrade from 11.7.1 to 11.9 fails:   1. We first try to follow the instructions here to migrate from Java 11 to Java 21 which is required for Jamf 11.9: Jamf Lernzentrum -> We are not able to stop Tomcat ("failed to stop. exit status 5"). Nevertheless, the uninstallation of Java 11 works, also the installation of Java 21.   2. The installation of JAMF 11.9 also works with no errors.   3. Out Jamf instace https://jss.<domain>:8443/ is not available after the upgrade.   Any ideas?

Hey,  We have multiple sites in our Jamf pro because we are a group of companies. Now we want to assign sites during the prestage enrollment. So, when the user will connect a new laptop with the internet, then it should pop up an option with site names so the user can select which site he/she belongs. Based on that, he will receive the enrollment customizations and policies made for that specific sites.  It is working fine with user initiated enrollment but I can't figure out how to do that with prestage enrollment. Can anyone help? Thanks

HiWe have one student whose iPad is locked down.  Obviously we have to allow access to certain apps so that the student can work, however we discovered today that even though the student has his web browser restricted they are still able to open it when accessing a link from the gmail application.Has anybody come across this before? Thanks in advance!

Just a quick question. I have a problem where I cannot login with a Pre-Stage Enrolled admin account any longer. I was at first but not now. https://community.jamf.com/t5/jamf-pro/cannot-login-with-local-admin/m-p/332899#M281166 I was in Zoom call with a Jamf tech and I am able to login with a Standard Student account. He had me run a command in Terminal and Secure token is enabled for both my Admin account and Student account. He asked for the logs on the mac but I can't navigate to /Var/Logs because we found out that a Standard User doesn't see "Go to Folder..." in the Finder Go. To help him out does anyone know a way around this? He escalated the call to an engineer.I could also create a new policy to create an admin but I thought I would ask her first before I do so. Thanks!

We have discovered a large number of Macs in our fleet that appear to no longer have the Jamf agent installed on them. This may be because users used the "jamf removeFramework" command on them. I have been working on figuring out how we can get these systems re-enrolled. For years I have used the command "sudo profiles renew -type enrollment" command to re-enroll Macs that are in Apple Business Manager. Running this command requires me to interact with the Mac to complete the enrollment process. I tested this a few days ago on my test Mac to take note of everything that happens after the profiles command is ran. We would like to do this in the background silently. We have an agent called Aternity installed on all of these Macs. We know they're in use and active. They're just not connecting to Jamf Pro. Aternity can send scripts to the Mac, and my thought was that we could run the profiles renew command in a script pushed out to these Macs. Are there any options that can be used with th

New and somewhat confused JAMF-user here, and thus: silly questions.I'm using Entra as my Cloud Identity provider and I'm trying to create a smart user group based on membership in an Entra-group (JAMF_KLA) in order to build configurations for said usergroups. But I cannot for the life of me get it to work (nor do I know if it's actually possible).Looked at the mapping of both the SUG and in the CIP-setup, and everything there looks like it should work. Can also do a test against various users, and it works (User that is in the Entra-group gets green checkmark, user that is not in group gets red checkmark). Which tells me that the lookup is working.I see that I can also add users from a Directory Service from the Settings-menu. However, is that only for admins/auditors? I see that there's an option for Enrollment Only. Does this mean that the imported users do *not* have access to the JAMF-console?

Hey Jamf Nation! I have a short script set to run once per computer at recurring check in. I am also about tell Jamf to update macOS from 14.7 to macOS 15. I believe individual Macs check for macOS updates as part of the recurring check in (very easily could be wrong!). My question is, which happens first? If a Mac contacts Jamf as part of a recurring check in, and finds out it is due for both a script to run and a macOS update, which does it do first? Thank you all!

I don't know if my subject made sense, but here goes... Most of the software installs we deploy go through a two-step process: cache the installers, then run the installers. I'm testing different ways to run the Adobe CS6 installation (at logout, in the background, at startup, etc.), but to save cooking time, I'd like to be able to cache the hefty-sized CS6 .pkg file from a Mac that has a local distribution point, over either a Firewire or Thunderbolt connection instead of letting it cache from our JSS server. Occasionally we'll push out cached .pkg files through Casper Remote, but it doesn't appear to interact with the local distribution point the same way that Casper Imaging can. Am I missing something or is this not possible through the standard Casper suite? Thanks! JSS 8.62, etc, etc.

Does anyone know if it is still possible to prevent the removal of management profiles on Jamf Pro for iPads?I believe there used to be a iPad restriction to do this. I can't seem to find it now.Any help would be most appreciated. 

How do you guys have your road warriors login to Jamf Connect from public wifi with captive portals?I only have a few users that do this but wonder what the Jamf Connect config setup is like.

I attended JNUC in both 2023 and 2024 and finally have got around to implementing Installomator as per https://www.youtube.com/watch?v=p2J6fTQXIwU.  Lots of people were talking about it and in 2024 was convinced to at least try it.  The implmentation in the video uses two Smart groups. Smart group targetting "Patch Reporting" for the targetted application.  For example, the criteria would be Patch Reporting: Google Chrome is less than Latest Version. Smart group targetting the above group because you can't target policies using Patch Reporting directly as per the video. The first group using Patch Reporting updates just fine.  My issue is the 2nd group does not update correctly.  When I initially save it the numbers match but after testing by updating an app the 2nd group will not update to reflect the number of the 1st group.  The only way to update it is to go in and edit and resave the group.  Then it will update correctly until the next time it

Hello everyone, For the Chrome browser, I've created a PLIST for installing the extension and a second one for configuring the extension, and it works perfectly. That's why I'd like to do the same for Firefox. The PLIST for installation works. But for the extension configuration PLIST I don't know how to do it? I can't find any information about this if it's possible. Here's what I did for Chrome : Preference domain : com.google.Chrome.extensions.IDextension   <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>ConfigJson</key> <string> { "backend_servers": [ { "title": "Exemple title", "url": "https://exemple.com" } ], "base_url": "https://exemple.com", "allow_custom_server": false, "allow_registration": tru

I'm trying to install Nexthink by using the script that was provided that has all the information in it. I'm issues getting it to run.  In the path BASE_PATH="/Library/NexthinkInstall" should this be where I'm mounting the .dmg file? For instance, I created a composer pkg to add the Nexthink.dmg file to /private/tmp/Nexthink and then tried adding the completed postinstall script.   #!/bin/bash# v5i - nxt_collector_installer.sh## Nexthink Collector Installation script for macOS## This script makes the following assumptions:# 1) The 'csi.app' folder from the Collector DMG is deployed to the endpoint. The installation# only needs that folder and not the full DMG.# 2) The deployment directory is configured below as 'BASE_PATH'# 3) This script is located in the same directory as the csi.app folder from assumption 1.# # Instructions: # 1) Modify the Nexthink Instance Settings in the section below# COLLECTOR_ADDRESS - The data collection address from the welcome email# CUSTOMER

I am new to the community. I have a configuration policy for AD binding. The policy has been in place for well over a year. There has been no changes to the Active Directory settings, however its giving failing messages. What's causing this?  

Here's one out of left field, from my security group... We have a number of computers (Macs, windows, etc) reporting in CrowdStrike, Axonius, and other services.  Not all of the Macs are enrolled in Jamf, for reasons good and bad, and we need to get them enrolled. The security team is looking for ways to deploy Jamf without needing to visit the computer (identifying user and location can be a challenge).  I know nothing about whatever process CrowdStrike might use for this.  I do know that installing MDM software on Windows computers can be done via Active Directory, and apparently CrowdStrike uses a some kind of method for deploying MSI or exe installers to Windows computers. I also know at one time Jamf had a quick add package that could, maybe, have been deployed from CrowdStrike or other tool that can support macOS pkg files, but today Jamf deployment depends on having the user, at the computer, download and install, with authentication, the Cert and MDM files. &nbsp

Got an odd one. Anyone had this issue where Microsoft Word won't save anymore?I tried uninstalling, re-installing. Killed preference files and Microsoft Container files. Just on this Mac after he updated to 15.1 and Word 16.91.24111020. Tried an older version. User is signed into M365 okay. Other apps are fine, like PowerPoint and Excel. Other Macs are fine. Happens on every Word file, even a new blank one. Once we click Save As, just beach ball, freezes for a bit. No prompt or options to save from Finder.

Hey Guys, Is there a way to export a report that confirms which users have the screen and system audio recording setting toggled on? The goal is to export a list of users with any settings enabled in that area. 

Greetings! Having a bit of trouble with a host name mismatch on a ceritificate that's causing an issue with Outlook on startup. So far, I've added and exported the certificate in Keychain Access, uploaded it to the JSS in a configuration profile, and then tried to deploy it to a test computer but the problem here is that the trust settings are set to Use System Defaults. Then, I tried packaging the certificate up with composer and copying it to /tmp and installing it with this command: /usr/bin/security add-trusted-cert -d -r trustAsRoot -k /Library/Keychains/System.keychain /tmp/certificate.cer Which does add it and set to Always Trust... However, I still see the Verify Certificate message when Outlook is opened and Use System Defaults as the Trust settings even though the certificate is marked trusted for all users. Any thoughts on what I might be doing wrong or another way to go about adding this certificate to the keychain and setting it to Always Trust? Thanks!