Hello all,I am in the process of rolling out OneDrive to our Mac environment.  I assigned the app from the Jamf app catalog and put together a plist with all of our settings.  I discovered that OneDrive has to have full disk access in order to automatically back up the desktop folder.  I used the Jamf PPPC tool to grant onedrive full disk access, however it does not seem to take.  I check in system settings → general → device management and I see the config profile, however when I run sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \ 'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"' in Terminal, onedrive is not listed as one of the apps that has full disk access.  Any ideas?

Hey Everyone, Just a quick question, how did you introduce self service to your users who are not used to serving themselves? Do you send out an email explaining what Self Service is? We are almost done with our pilot testing and are just about ready to fully roll out Casper to our environment, so we just want to get some ideas of how others have introduced Self Service? Thanks

Hey,Our agent for macos requires spficif bluetooth permissions to function properly. For most other MDMs we enable this by sending a mobile config containing BluetoothAlways key in Services, as documented here. JAMF seems to remove this key from mobileconfigs uploaded through UI and also directly through API. Example section that needs to be included in the mobileconfig: <key>Services</key><dict><key>BluetoothAlways</key><array><dict><key>Allowed</key><integer>1</integer><key>CodeRequirement</key><string>anchor apple generic and identifier "com.sentinelone.sentinel-helper" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")</string><key>Identifier</key><string>com.sentinelone.sentinel-helpe

Has anybody figured out how to get Language Chooser to run at first boot?if I make my image from a Install OS X.app it seems to assume that since i ran that App in English that is the language I will want everybody to use, and well my customers tend to be Global. I can make it run, but it runs on top of setup assistant and well its ugly and can be problematic if people start clicking on setup assistant before language chooser appears. Any ideas would be greatly appreciated.

I am testing Connect 2.45 and have had a popup appear on the Login Screen.Its a really "Helpful" Popup. All it says is SecurityAgentHelper wants to make changes, and it asks for an Administrator username and password. None of my users are Administrators, so they will not be able to fill this in.Is this a bug? Is there a way to fix it so that it does not pop up? What process is it that wants this access? Thanks Paul  

I just set up a new iPad for a teacher and after enrolment all apps that should be deployed are marked as Waiting for Licenses despite having hundreds available. Things I've tried to resolve: Restart iPad Refresh Apple VPP token Re-apply profiles Re-apply apps Reset iPad and re-enrol   Nothing works. Still stuck on "Waiting for Licenses". Does anyone have any ideas about what I should do to resolve this?

If I turn off our current Cloud Identity Provider configuration with Google, will that remove the existing attributes from users’ User and Location fields in their profiles? My understanding is that it won’t, which would be a good thing in my case. I’m transitioning to Okta LDAP and want to make sure the current attributes remain, since I have smart groups based on department fields.

My organization uses Jamf Setup and Jamf Reset for our users to sign in with their SSO account with Microsoft Entra ID. The user will sign in with Jamf Setup at the start of their shift and then sign out at the end.   However, Jamf Reset frequently does not fully sign the user out of their SSO account, leading to the next users unable to log in.   I have found that a power cycle and attempt to sign out using Jamf Reset usually fixes this problem.   From what I can tell from comparing our Jamf Reset App configuration and "Managed App Configuration for Jamf Reset" documentation on learn.jamf.com, we have the standard configuration set up.   Has anyone else ran into issues with Jamf Reset "hanging up"?

I remember before the renovation of jamf dashboard there was an option to clear all users on shared ipad. Now with the new dashboard I didn't find it, can someone tell me where was that option? Thank you,

Hi All,I need to disable most of the "More Gestures" (third tab of System Pref>Trackpad ) for MN Online Assessments.I have tried a custom Config Profile/user level which I created by uploading the trackpad plist, but while I was able to save it, it would not deploy.The rest of my profiles appear to be working, and the test computer is receiving all other expected profiles.MCX Settings in this area specifically say 10.6 onlySo I'm trying to package using Composer>Monitor File System ChangesThe files it appears to effect are~/Library/Preferences/ByHost/.GlobalPreferences.xxxxxxxx.plist~/Library/Preferences/com.apple.driver.AppleBluetoothMultitouch.trackpad.plist~/Library/Preferences/.GlobalPreferences.plist I have tried packaging and deploying every combination of these filesDeploy via login policy with: FEU, FUT, Fix ByHost Files The settings are not applying on my target computer (and not after logging out and back in) On my package creator computer with all de

Hi all,Anyone have any skills with deploying NinjaOne to Macs through Jamf?I’m having some troubles deploying Ninja to my environment in Jamf pro. I’m deploying the pkg using a policy. I pulled the pkg direct from my Ninja admin site using their method of acquiring the necessary file. I’m also deploying a config file to allow the necessary streamer application to run in the background and quiet install (see screenshot for config.) Every time I deploy through Jamf, the NC Streamer file does not go to the device, and the device does not enter my Ninja console. When I manually install the same pkg without Jamf, the NC Streamer installs fine and the device is added as a local machine. I’m trying to figure out where I’m going wrong with my install and why this is isn’t working through Jamf. It’s just a simple PKG in a policy and a small config file.Please let me know if anyone has suggestions for me or if I need to provide more info.I have contacted NInja support already. They claim it’s a

here's my problem:-a user tries to change his/her password and it fails because the mac lost trust with AD, I'm able to send configuration profiles, do a "sudo jamf recon" works fine, except the mac is not bound, even though in Directory Utility it shows its bound. -after unbinding and rebinding everything works fine.(fyi: macs are on 10.11.6 and 10.12.x with JSS: 9.96) I'm trying to avoid having to do that manually.How can I do that using a script if a mac is actually bound to AD? thank you for your help.

Does anybody know what could be wrong? I don't see Transfer to a work account for one Apple ID account, only Keep as a personal account. I had read https://support.apple.com/en-gb/102159 and checked every option. Once I saw Transfer to a work account, but I was told to update my Mac to the latest OS. After that, I had tried many times without success. It's giving only one option: Keep as a personal account. It wouldn't be a big issue, but the problem is that this Apple ID is used for an APN certificate.  

Hey everyone!I'm reaching out for guidance on a complex issue I've encountered with integrating Jamf Pro and Microsoft Entra ID for SSO, specifically regarding user attribute mappings and device enrollment processes. Despite a successful setup of Single Sign-On and Cloud Identity Providers for new macOS device enrollments with corporate credentials, I've hit a stumbling block with more detailed configurations.Core Issues:User Attribute Mappings: My goal is to map the User Name attribute to the onPremisesSamAccountName (essentially, the UPN without @domain.com) for a more intuitive username representation. Additionally, I aim to map Phone attributes to mobilePhone and Position to jobTitle, enhancing user profile completeness within our system.Device Enrollment Customization: During the Setup Assistant phase of Automatic Device Enrollment (via ABM), I intend to pre-fill the primary account information with the device owner's details. However, the system defaults to using the UPN/email fo

Hello , Is there any way to block all apps except the chosen ones? I saw on Apple developer that whitelisted app were deprecated whitelistedAppBundleIDs[string],but solution with allowListedAppBundleIDs didn't work for me. In my case I need to push policy to block everything except preinstalled apps and 5 chosen by IT. 

Howdy all, I am facing an issue that I can’t seem to solve with running Microsoft AutoUpdate via script from Jamf to keep our mac office apps updated. I have had this set up for several years and it had been working beautifully as a hands off solution. I am not sure exactly when it started failing, I recently noticed the problem and started digging into it. I am wondering if anyone is facing the same problem, or has advice on what to try.The setup is fairly simple, a policy that runs against a smart group of any macs with office apps that are not the latest version once a day. It runs a script to use the MAU command line msupdate to pull and install any available updates.Script is below, it only worked under user context originally so that is why it is set that way.The error I am seeing on every run now is related to the XPC connection, this happens on all clients no matter what, -reinstalled MAU with latest version, brand new mac build with latest install etc.  I have the original PPP

I am working on a script to automate naming, renaming, and name enforcement for our mobile devices. The script uses an API call to send the rename command to devices that don't meet our naming convention. I use this call all the time. It works perfectly from my account with full admin rights. However, when I run the script with my API management account which has limited rights the command fails with the following message: <html> <head> <title>Status page</title> </head> <body style="font-family: sans-serif;"> <p style="font-size: 1.2em;font-weight: bold;margin: 1em 0px;">Unauthorized</p> <p>The request requires user authentication</p> <p>You can get technical details <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2">here</a>.<br> Please continue your visit at our <a href="/">home page</a>. </p> </body> </html>I have  Send Mobile Device

Hello,We have an LDAP server (Active Directory) configured on our JSS.We will move to Azure AD.For this, we have configured "Cloud Identity Providers" to integrate with our Azure AD.Everything seems ok with tests. We can query for groups, users and get "true" for membershipWe are trying to scope and limit policies (Self Service) to group memberships from AzureAD (via Cloud Identity Provider). I can search for the group and add it to the Limitations section of the policies.But when I try to test the policies on computers, the policies are not available when users connect to Self Service using the Azure AD accounts in the target groups.When we try with Active Directory groups, that works well but not with Azure AD groups.Do you know if this is normal? Can't scopes with Azure AD groups?We have Jamf Cloud 10.33.Thank you for your help

Hey All,Running into an issue, I assume it’s simple, but I’m blanking as to what I am doing wrong. #!/bin/zsh --no-rcsclient_id="REMOVED"client_secret="REMOVED"url="https://REMOVED"##Gets Access TokengetAccessToken() { response=$(curl --silent --location --request POST "${url}/api/oauth/token" \ --header "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "client_id=${client_id}" \ --data-urlencode "grant_type=client_credentials" \ --data-urlencode "client_secret=${client_secret}") access_token=$(echo "$response" | plutil -extract access_token raw -) token_expires_in=$(echo "$response" | plutil -extract expires_in raw -) token_expiration_epoch=$(($current_epoch + $token_expires_in - 1))}checkTokenExpiration() { current_epoch=$(date +%s) if [[ token_expiration_epoch -ge current_epoch ]] then echo "Token valid until the following epoch time: " "$token_expiration_epoch" else echo "No valid token available, getting new token" getAccessToken fi}# I run the function h

Hi Guys! Is there a simple, and effective way to change a hostname of a joined Mac via Jamf? We have a little bit too much "David's MacBook Air" going on :)

So with the concern of data being send to chatgpt, how do we disable Apple Intelligence and chatGPT integration using JamfPro (Cloud) in macOS 15.1?

Can someone help me with a script or payload any option to enable screensharing on specific app like Teams / Slack or Zoom - Automatically from Jamf or Mosyle- we are using Mosyle for managing MAC'sNote: User: With out manually clicking on it.If yes, please help me with the same.

Hey All,Is it possible to change the timeout on a Jamf Cloud console session?We're on Jamf Cloud 10.42 using SSO to login to the console, if that matters.The main issue (among others), is that when performing a GSX lookup, the web session usually times out before the look up finishes.We have ~1400 workstations which takes at least 10-15 minutes to update, but more often than not results in a session timeout.  I've tried creating a SMART group where there is no Warranty info for the device, but the only options are Warranty Expiration is before/after or within a certain # of days.It does seem as though if I open a new JSS tab in the same browser window and work in there while the GSX lookup is ongoing in the other tab, that the GSX lookup session will not timeout.I did check the SSO settings, but it only has a Token expiration time, which is not what I'm looking for. Thanks for any thoughts.Phil

Hello everyone, teachers use the Managed Apple ID but cannot download applications in the AppStore, the only apps that can be downloaded are the same as those from the selservice. Do you know a solution so that teachers managed Apple IDs have more possibilities? I use JamfPro, Thank you

Hello Jamf Nation, I have been attempting to deploy the latest macOS 15.6 update to the pending devices. However, each time I use the Software Updates feature to update the version, I encounter the following error: “UnableToFindUpdatesAndOutOfRetries”. As a result, the devices do not receive the update.Do you have any suggestions or alternative methods I can try?