How do I get rid of this message for good ? Even after I 'cancel all' the next day there are a bunch of them again. Is it trying to install a configuration profile that has been deleted from my configuration profile payload? What's actually causing this?  

I am experiencing an issue where iPad apps are not installing on certain devices. This issue started on November 12th 2024. The affected devices are only devices that have not been enrolled in Jamf before. If I wipe a currently enrolled device and reenroll it, the apps will load just fine.  All apps I have pushed are not installing (including self service).  The errors I get on the iPad are "sign into iTunes to allow domain.jamfcloud.com to manage and install apps" and "This Apple ID can not purchase App Store Apps" My organization has managed Apple IDs and we use VPP for all apps. I checked, and there are no apps that are not under VPP or have run out of licenses, despite Jamf Pro saying, "Pending - All licenses are in use or the license is not assigned yet" under pending commands. This has never happened before and I am extremely confused on why this is only happening to devices that have not been enrolled into Jamf before. Any ideas are appreciated!

I'm looking for an up to date extension attribute that checks to see if a mac has an account signed into iCloud and what that full account name is, if an account is signed in.   I've found several other EA's that look for this plist, MobileMeAccounts.plist. The mac I'm testing with is running on OS 15.1, and I do not see this plist under ~/library/preferences.   Any info on if the plist has changed or moved would be greatly appreciated as well.

I've been doing a bit of a clean-up on our Jamf Pro instance prior to us migrating to Jamf Cloud (which will hopefully be within the next month or two) and one of our extension attributes seems to be a bit out of date as I've noticed it's not been working properly.It's supposed to determine what the active/in-use network interface is (i.e. Ethernet or wireless) and has the following script:#!/bin/sh OS_MINOR=`/usr/bin/sw_vers -productVersion | /usr/bin/cut -d . -f 2` if (( $OS_MINOR < 5 )); then if [ -f /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup ];then echo "<result>`/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/networksetup -listnetworkserviceorder 2>&1 | grep $(/usr/sbin/netstat -rn 2>&1 | /usr/bin/grep -m 1 'default' | /usr/bin/awk '{ print $6 }') | sed -e "s/.*Port: //g" -e "s/,.*//g"`</result>" else echo "<result>The networksetup binary is not present on th

Just setup MacOS onboarding and working great for use.As anyone configured the MacOS Onboarding extension attribute mentioned here https://www.motionbug.com/jamf-pro-and-macos-onboarding/This does'nt appears to create tag usisng  touch /Library/Application Support/JAMF/.onboardingcomplete. I assume thats what its suppose to do, unsure if the path is correct shouldnt it be touch /Library/Application\\ Support/JAMF/.onboardingcompleteDoesnt create the file either way assuming thats what its suppose to do.Anyone got this working? think I missing something simple.   ThanksTom

Can some suggest how can we Managed Login Items to allow in background for the application Zscaler   We are implementing this in our company to ensure that users wouldn't have an option to turn off. We implemented something similar creating a Configuration Profiles for Ms defender using a some documentation from Microsoft but over ever I don't any documentation for Zscaler. 

Seeing inconsistent deployment of a Config Profile that is required for use of CISCO Secure Client. "the current system configuration does not allow the requested operation" My device it installed fine (15.1) on another device (15.1), it gets the above message in the JAMF device record.   The config profile does have one kernel extension being deployed Kernel Extension Bundle ID       com.cisco.kext.acsock  

The Autoactivationlink is not passing through to the application.  The mobileconfig provided is for Intune, the vendor does not have a Jamf version.  I am also having trouble getting it to pull the USERNAME and DEVICE_NAME from the system, I tried the original palceholders {{Username}} {{Devicename}} and the ones you see now..  I have obscured the link as it is unique to our license. <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><!-- This profile contains all CIRA DNS Firewall specific settingsFor detailed information on these options, please see the MDM specification"--><plist version="1.0"><dict><key>PayloadContent</key><array><dict><key>PayloadContent</key><dict><key>ca.cira.secure.remote</key><dict><key>Forced</key><array><dict><key>mcx_preference_settings&

Hey all,Does anyone have a solution to automatically install apps upon enrolment from the mac apps app store and then make them available in self service as well?Appreciate any help or advice, Thank you!

So I've created a new package using Jamf Pro web GUI, pointed it to a newly uploaded file on repository, and tried to deploy, but all installs are failing because the "package could not be verified". Never had this issue with Jamf Admin...just sayin' Jim

I haven't had to do much with extension attributes yet, looking for an easy way to determine if something is installed and the version number, and if it isn't installed, to also note that. So the command I run on a local machine is: sysctl cs.version That will return the version number of the Falcon Host installed, something like: cs.version: 2.27.4809.0 If the application isn't installed it returns: sysctl: unknown oid 'cs.version' Ultimately I will use a smart group to make sure Falcon Host is installed, and if it is not installed, to flag it for installation. The version number is just nice to know. Is there an easy way to do this that anyone would know? If it works, I'm happy to submit it to the EA list as well.

Hello, I have recently set up a device compliance connection between Jamf Pro and Intune.  I was able to successfully register my test devices without issue so I pushed it out to a handful of IT users.  When they try to register, they are receiving an error that states: "Helpdesk support required Your organization needs to enable partner device management for you before you can enroll.  Please contact your helpdesk" Our legacy conditional access policy is currently terminated and was never scoped out to any users, so I am unsure why this message appears.  Any advice?

Hi, I've currently got an extension attribute for "Brand" for our retail company and am wondering if there is anyway to have our iPads display a drop down during the enrollment stage to select the brand they belong to for the corresponding configurations to apply correctly? I've seen how I can add text to the enrollment page but unsure how to link the extension attribute Any help would be greatly appreciated. Regards, Danyon

Trying to deploy extensions via DMG, but everytime I deploy it and I launch Chrome, the extension simply disappears from the folder... anyone have any idea why?

We are looking to set up a content cache server in a network that has more than two public IP addresses, with devices connected through GlobalProtect VPN. Could someone please guide me on how to configure the custom Public IP address section to ensure that devices can access the cache, whether they are connected via GlobalProtect or directly to the local network? All devices are enrolled at Jamf.

I have been fighting with this issue for several years with a variety of Apple TV devices - all newer ones without the USB port built in.  The issue occurs because of two things:Through JAMF, we have placed the Apple TV in Conference Mode.The Apple TV has been turned off long enough to no longer have a valid certificate for JAMF.The end result is that the Apple TV is stuck in conference mode, but since it is no longer communicating with JAMF it cannot be taken out of conference mode.  The only option is to factory reset, which then leads to a NEW problem - when I get to the factory reset screen, the remote no longer works to actually select the "Reset" option.  Here is the general process I do:Boot the Apple TV that needs a resetPair a remote to the Apple TVBoot into recovery mode (power cycle multiple times, interrupting the boot each time, until the recovery mode screen appears)Attempt (usually unsuccessfully) to use the remote to select the Reset option and reset

I am seeing an issue where suddenly my App Installers that I have setup for automatic updates are no longer functioning, but Self Service app installs work fine.  Seems to have started when 11.10 was released.  I have tried recreating policies from scratch but issues remain the same. No App Installers set to automatic function, everything stuck in progress but no signs the update command is ever sent. When I look at the deployment status, none of the scoped machines are visible, but if I look at a Self Service policy, they are there. Is anyone seeing anything like this and any idea how to resolve it?  I do have a case open with JAMF but so far we haven't got it figured out.

Hello everyone, We use Jamf Pro Cloud 10.42.1 and we have an issue with macOS Ventura. When we prepare a Mac with our prestage enrollment, we have a message : You do not have permission to use the application "SafariSupport". We use exactly the same configuration profiles for Big Sur and Monterey and we never had this message. You can see screenshots of our Restrictions Configuration Profile. Applications folder is in Allow folders so we don't understand why we have this message.And if we add Safari in Allow Apps, Safari opens but we have the dialog box again.Anyone had this issue or understand what is wrong with our Restrictions Configuration Profile ?   

Hello, Jamf is running on my MacBook although its not part of any MDM system. I also don't have any profiles installed. How do I get rid of Jamf altogether? Removing it from Applications/LaunchAgents/LaunchDaemons doesn't help, it just reinstalls itself and starts up again. I can see that there is something when I run `sudo protectctl info` but I don't know what that is? Can this be a left over from migrating from an old mac that had a MDM running?  Any help is greatly appreciated as the jamf security extension is using all the network bandwidth which is extremely annoying when tethering. Thanks and cheers, Karsten

So, with new Opt-In to Beta versions on iOS and iPadOS 16.4, how do you disable this option on your managed iPhones & iPads? 

Hi Team, I'm working on deploying EndNote 21.4 to multiple devices, along with configuring the "Find Full Text" feature via script. My approach involves modifying the $HOME/Library/Preferences/com.ThomsonResearchSoft.EndNote.plistfile to include the required settings. However, when I deploy the script and launch the EndNote app, it doesn’t appear to recognize or pick up these configured values. For context, I’m setting up the "Find Full Text" preferences as described in the following guide: weblink: https://guides.library.uq.edu.au/referencing/endnote/find-full-textThis includes: Enabling checkboxes for Web of Science, DOI, PubMed, and OpenURL Setting the OpenURL Path to xyx.com Leaving the "Authenticate with URL" field blank Could you advise on why the app might not be picking up these settings from the plist file, or if there’s a recommended alternative approach to automate the setup of these preferences?

We are using the Kerberos SSO Extension, and every time a user logs in, a Mac centric box appears that says "Kerberos is trying to authenticate user" with an option to put in their password.  If they cancel that box, another box appears having them put in my password to connect to the domain.  This happens after they originally synced their local and AD passwords and got confirmation that it was successful and after testing, it was successful.  The first time they synced their passwords, a box appeared that stated "Would you like to automatically sign in from now on?" and they chose yes, but obviously that's not working.  I would rather not have my end users having to log in multiple times (Once to get into the device, and then another to validate password syncing).  Thanks in advance for any help.

Hello everyone, I'm having a problem with self service. When I download an app, it takes a long time to load and finally I get the message 'operation could not be completed' When I don't get this error message, I get this one: no license was found for the app "xxxx" I have this problem on all of my iPads (gen 9 and gen 10) iPadOS 17 and iPadOS 18 (kCFErrorDomainCFNetwork erreur -1001.)  I use JAMF PRO V.11.10.2 Do you have an idea ?  THANKS

Hi, Is there a plist or config I can manually push to devices that allows me to defer an update for more than 90 days? When Apple releases a new major OS, we typically wait until they are in the 14.3.or 14.4 version since I started working in a company with Apple enviornment as we have see many bugs popup for various apps. Some of the apps we use on company level take couple months as well

I'm trying to create a smart group of our labs (static groups) but its not working, it can only take one at a time. I've tried re-creating the static groups, still no luck, it will only show one (7 devices or 43 device but never 50).  i did add the site location and the "(" ")'' & "and".  Is anyone else experiencing this? our current instance is 11.10.2