While rolling out Jamf safe internet we see this message in the dashboard for active devices.    

Hello guys,I would like to set a password to pass the prestage enrollement page. I can't find anything on this topic. Do you have any ideas? Thanks.

This happened across our org with no changes in azure or JAMF pro. Unsure of what is causing the issue. We've never had to set up a configuration profile for OneDrive prior to this.Has anyone seen this before?

At present I am facing difficulties in deploying packages using Jamf Pro and I'm unsure of where I might be making mistakes. If anyone has experience with this and could provide some insight, I would greatly appreciate it. 

Hi AllDoes anyone know how I could create a group to filter out and display iPads that do not have an app installed? For example, because one or the other iPad was offline during distribution or does not communicate with the Jamf.Thanks Peter

Can someone explain why the Device Inventory user interface in Jamf School has changed from the previous (legacy) version? I see from this post on Jamf Nation: This change doesn’t just offer a new look but improved speed when loading devices. For schools with large deployments, this means you can manage your Apple devices in an even faster and improved manner with quicker  loading and bulk commands. We manage almost 5200 iPads, and while I’ve noticed more success with bulk operations, the need to constantly deselect before selecting a new set of 500 iPads is time-consuming. I would prefer a slower interface if it meant avoiding accidental bulk operations. For instance, I accidentally erased 20 Apple TVs before fully understanding the new system. There have also been instances where I refreshed unintended devices because I forgot to deselect them. I appreciate that the new interface shows the storage of each iPad, not just the remaining storage (though this feature works inconsiste

HelloI am having an issue getting Nudge to prompt for an update.I have installed the configuration profile & the latest nudge suite via policy to a test mac.The only 2 values i have set are requiredMinimumOSVersion & requiredInstallationDateI've confirmed that nudge can see the profile by running /Applications/Utilities/Nudge.app/Contents/MacOS/Nudge -print-profile-config<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>osVersionRequirements</key><array><dict><key>requiredMinimumOSVersion</key><string>15</string></dict><dict><key>requiredInstallationDate</key><string>2024-09-25T00:00:00Z</string></dict></array></dict></plist>But, if i check library/preferences and look at the nudge plist via xcodeIt does not have the same values

The latest Microsoft OneDrive versions use a different Key for their Bundle Version in their Info.plist file and JAMFS Patch Management definition is generating an error.  The existing Attribute Extension jamf-patch-microsoft-onedrive searches for KEY="CFBundleVersion" in the Info.Plist of the /Applications/OneDrive.app/Contents folder. However, there is no such key. Looking in the Info.plist of my own installation I can find the key "Bundle Version" with version 23086.0423.0001 There is no way for me to Edit the AE to improve the results or redirect it to my own that's collecting the relevant information. Any ideas on how I could fix this?

HiI've set up sso connections to connect each time the mac is restarted.In my case, users always connect by sso. But I want users to be able to switch macs easily between each other.Except that once user A lends his Mac to user B, even if I've forced all connections to go through sso. it will ask me for user A password because filevault needs to unlock the disk before proposing a connection by sso.Do you have any idea how I can work filefault and sso together so that user B can connect without requiring user A password?Thanks 

Has anyone ever had luck using a smart group to change a device state based on time of day?For example, create a smart group that has app restrictions and move devices in and out of that group based on a recurring schedule. 

Hello folks,I have a new M1 MacBook Pro, which I rolled out with DEP. English was selected in the language selection at the beginning of the Mac installation. I changed the language to German and then continued the installation. FileVault is enabled via jamf Connect Login Configuration Profile. Now I have the problem that the language was not changed to German on the login screen and the keyboard layout is still set to ABC. (But the language in macOS is German.) If I switch it to German, it's back to ABC after the next restart. In the past we were able to solve the problem by performing a macOS update. After the update, the language on the login screen was German again and the keyboard layout remained in German.sudo languagesetup -> 13 did not bring anything.Does anyone know the problem and has an idea? Cheers 

Hello Jamf, So around a month ago, a user reported that they were unable to log in after restarting. I had them show me the issue, and after logging into the jamf connect log-in window, the screen just goes black for about 30 seconds, then prompts them back to log-in window again. Turning off the wifi allowed the user to log in, but if he restarted, the issue was still there. This trickled down to a few more users, and I opened a Jamf support ticket. I tried all their troubleshooting and uploaded logs, config files, and system reports, and they saw nothing unusual. They also had me to set  "Enable Filevault" to false in our "Jamf Connect Login" config profile since it was already enabled via its own standalone config profile. I thought that was solved, but then one of our VP's reached out to me, stating that they were unable to log in and were having the same issue.  I checked our okta logs as I had a hunch that the issue was mfa related. I checked mfa usage reports

A few months ago, I was able to use the Jamf API to obtain a computer's room assignment. I need to now get the computer's site. I don't care if I can only obtain the site ID or its actual name. I need this so I can avoid creating a separate installer package for the different regions in my company. I want the install script to first obtain the computer's site assignment and then choose the appropriate customization for each region. I thought this would be similar to getting the room assignment but apparently it's not. Does anyone know the correct way to do this?

In Patch Management Spotify is indicating that version 1.2.43.420 is the latest version even though 2 newer versions have been released since that one.  Can this be fixed to display the correct latest version. 

I am looking for a way to fully disable Airdrop for CIS standard security reasons on our Macs, the typical defaults write com.apple.NetworkBrowser DisableAirDrop -bool YES removes the option from finder but this option still lives in the go menu and the CIS check continues to fail.  Any Ideas or special config profiles people have created?

I am trying to locate a device that was previously assigned to a user so that I can deauthorize an app that was used on it. The guidance from the app provider (Kuta), says I need to log in on the old device to deauthorize it. Any help would be appreciated!

I am installing Maya 2024 and I am running into this popup.  I am able to get the license to verify via the network server when putting in my credentials.  I haven't tried on a non-admin machine.I created a configuration profile with Managed Login Items, and added the Team Identifier/Bundle ID to it and deployed it to my machines and still getting the popup.  I've not seen this popup before.  Anyone have any info/experience on this?Here is the script I am using, with the AutoCad and Mudbox install lines removed:  #!/bin/bash ### Install AutoDesk Combo 2023 (AutoCAD, Maya & MudBox) ### silently @ login window with network licenses (aka multi-user lab/classroom deploy) ### 2022.07.27 by JonW ### Simply update variables/products below the function section as desired ### Read the additional details at the end of the script for more clarity on licensing. ### Ensure: ### 1) installer app(s) re-packed from .dmg by Composer & deployed to /private/tmp (

Our school division uses Active Directory and managed Apple IDs.  I currently allow personal Apple IDs to be set up on a computer.  Some users have been granted administrative access on the computer they use because of the remote work they do.  I have observed that when personal Apple IDs are used with an account when a software update is available it will prompt for authentication but the username section is greyed out with just their username, but even when using their current password it says try again.  This also happens with some other things like require lock screen password. The lock screen issue just came to my attention today but the Software Update I've been getting around that by either remoting into the computer, logging into our local account and authenticating there or pushing out a Software Update policy in Jamf Pro to that computer. Does anyone know why this happens with personal Apple ID and how I can get around this?  This seems to happen at l

I'm seeing this issue with certain installers on Sonoma 14.6.1. When deploying via recurring check-in trigger, the policy just fails. When triggering via Self Service, I see the pop-up (attached) and after accepting and authenticating, the install works as expected. I've dug through some older threads to see if there was a problem with the Jamf and Terminal PPPC that we use but I can't find the issue! I've attached screenshots of the Config Profiles I've tried, also tried the one linked below but no joy! Please could someone help me find what I am missing!https://github.com/jamf/JamfPrivacyPreferencePolicyControlProfiles 

I have a Smart Group monitoring computers where the bootstrap token isn't escrowed. In the past week, I noticed a couple freshly wiped + re-enrolled computers (all on Sonoma 14.2 and 14.2.1), where the first user logging into the computer isn't getting the Secure Token or Volume Ownership. Also, the bootstrap token doesn't get escrowed. Background: in our 1:1 deployments, we have a PreStage-created, hidden local admin account. In this 1:1 PreStage, we have enrollment customization turned on, pointing to our SSO IdP. User gets a device, logs in through SSO, which populates their info into the local user creation screen. They enter their password again, and get logged into the device. Enrollment finishes, and for some reason Jamf is showing the PreStage admin account as the only Secure Token holder and Volume Owner. And as mentioned, bootstrap Token doesn't get escrowed. I can fix manually using sudo profiles install -type bootstraptoken, but trying to figure out why this is happeni

Hello All, I was wondering if anyone here has been able to successfully implement OneDrive Known folder move?We are trying to move user's Desktop and Documents folders to OneDrive, without any user interaction, we have tried to apply these settings using the Applications and Custom settings payload, we can see the CP in System preferences Profiles but nothing changes in Onedrive. Other settings like hide dock icon and open at login are successfully applied with the same CP.<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>KFMBlockOptOut</key> <true/> <key>KFMOptInWithWizard</key> <string>xxxxxxxxx</string> <key>KFMSilentOptIn</key> <string>xxxxxxxxx</string> <key>HideDockIcon</key> <true/> <key>OpenAtLogin&l

Anyone else getting 503 errors from Jamf Pro

My Automated Enrollment on the Jamf Now side is working fine however I'd like to add the Jamf Security cloud (RADAR/Jamf Protect product) as an integration in the UEM section. However there's no option for Jamf Now but there are options for Pro,School etc which seems strange. Then when creating the activation profile manually theres an option for Jamf Now but when selected nothing happens. I've enrolled the devices manually and they're showing as unmanaged as I've used the QR code from the admin pages as the QR codes sent to end users dont actually work. Any help is appreciated.  

We use Okta/FIDO2 to allow users to login to Self Service and see certain Apps only they are assigned.We're seeing an issue where the private browser window has automatically filled in the username with a different one (some users have 2 Okta accounts, one for elevated privileges elsewhere in our business).Anyone else seeing this? Is it Jamf, or Okta? It's been hard to narrow down so far.

Is it still the case that there is no way of allowing Location Services for a specific app, for non admin users? I don’t see a PPPC option for it, and it’s been stated that this is impossible in the past. Zoom soft-phone client wants location services enabled for 911 call routing. Users don’t have admin rights.I've seen someone say the below works for Big Sur, but even then I believe that just enables the general Apple location services, and not specifically for an app in particular.#!/bin/sh sudo /usr/bin/defaults write /var/db/locationd/Library/Preferences/ByHost/com.apple.locationd LocationServicesEnabled -int 1 sudo /usr/bin/defaults write /Library/Preferences/com.apple.timezone.auto Active -bool trueI need Location Services checked for Zoom specifically.