Greetings all,We are in the very earliest stages of setting up Okta.  I'm currently working on configuring our JSS Dev environment to use Okta for SSO.I'm working directly with our internal Identity Management team who manages our Okta instance.  They setup the integration on the Okta side, but I have no idea how they went about it.In the JSS dev, I've enabled SSO using Okta, added the necessary metadata URL provided by the IAM team, etc.When attempting a login, I am presented with the expected Okta user name screen, followed by the password screen, suggesting that the login process is working (and I've received notifications of a successful login), but then directed to an error message:Safari can't find the server.Safari can't open the page "https://https//<mysandbox>.jamfcloud.com/saml/SSO" because the Safari can't find the server "https".Note the extra "https// in the Url.The Okta team says everything is OK on their end, and I've reviewed the JSS SSO settings with th

Hi,if i want to be sure that after deployment with Jamf a file (i.e /usr/local/bin/dockutil) persists on the mac, what is best practice to accomplish that with jamf?I think a combination of Extension Attributes, Smart Groups and Policies will work, but I'm wondering if anyone has figured out what works best yet. Maybe so that it is universally applicable and easily reusable.Maybe someone has written an article about it?Many thanks in advance 

whats the best appoach to deploy new Jamf Protect plan in to machines?currently we have a Default plan that is deployed to all Macs using configuration profiles in Jamf Pro. I want to either deploy a new plan that has tamper prevention enabled or edit an existing one to enable it.what is the best way to fix this?it’s enough to edit the current profile and deploy it in Jamf Pro and I don’t have to create a new one?

Hi I'm wanting to create a smart computer group in JAMF Pro, for any Macs we enrol after a specific date. This is so I can scope a policy I have created to only deploy to Macs enrolled on or after the date set in smart group. I cant see an option to do this, any advice or help would be great.Thanks

Can someone tell me what Jamf Pro can do that Intune cannot for iOS devices?I am struggling to fin and documentation to support this online. thanks in advance for the support!

I'm trying to hide FileVault option from being offered in setup assistant during pre-stage, and when I go to customize what steps I want to show, it's greyed out and I cannot skip it. Currently testing on a Mojave machine, but we also are deploying Ventura machines. Looking at Jamf and Apple documentation it seems I should be able to block this, but I can't figure out why its not allowing me to. 

I have searched for a discussion about this and not find this problem, so I am raising a new twist on and old issue. I am trying to advertise some printers in Self Service and cannot get the drivers. I have uploaded the ppd files and I have policies to push out the printers etc. The issue I have is getting the drivers up into JAMF. This is where it gets complicated. HP has decided to not make their drivers available. Instead you can only download an install assistant called Easy_Start.app which will go out and download the drivers for you, install the printer you need, then remove downloaded drivers, thus leaving you without a copy of them to use in JAMF. I need to find a way of packaging the drivers that got installed on my machine so that I can upload them to JAMF instead. I did try reaching out to HP customer support twice for help in getting just a copy of the divers but that seems to be impossible. I have been assured that nobody in the printer industry does that. You cannot do

In the UI my users are _absolutely_ assigned computers, yet they do not appear in my API response. This shouldn't be a permissions thing. I'm very confused. Anyone seen this before?

I'm looking to see if anyone has a configuration profile created that gives ALL Adobe Apps access to Desktop, Documents, Downloads, and External Media. We're managing classroom computers with the Adobe Suite and each time a new user logs and launches an Adobe application it asks for access to those folders.Thank you!

I am trying to get this script to work for this extension attribute. It's just not pulling anything in Jamf Pro. But when I run the same commands in terminal on the local machine, as root, it works. Any suggestions?   

Howdy!I am trying to install an app called SwitchResX on some Macs to allow more control over resolutions for the end users. All my other apps have been installing fine within Self Service, but I can not get this one to install at all after setting it up in Composer and then deploying it. The only difference is this app does not install in the Apps folder but in the System Settings/Preferences on the Mac. Are there any additional resources or things I should look out for when trying to install this type of application? 

Is there a way to either create or assign an admin account as the "management account" after enrollment? We were told by Jamf to turn off that feature in the user-initiated enrollment settings due to the recent issues that setting presents when enrolling (PI113195 - Account Creation is skipped if a management account is enabled under UIE on Mac OS Sonoma).Obviously this isn't ideal but since we've had to turn it off, wondering if we can create an admin policy on newly enrolled machines and somehow make that the management account? Hoping that can be done. Creating the account is easy but unsure if able to tie it as the management account ¯\\_(ツ)_/¯ 

Hi,Unfortunately, we have a problem installing an app on a few devices.An error message AMSErrorDomain 203 appears.Unfortunately, we can't do anything with this message. It is also strange that it only affects some devices:"AMSErrorDomain erreur 203. / The operation could not be completed.(AMSErrorDomain error 203) I No server with the specified host name was detected.detected. The operation could not be completed. (kCFErrorDcmainCFNetwork erreur -1003.)"What does that mean? Where can we find the problem?Regards and thank you very much in advance. 

Due to security restrictions within my environment, I have spend an considerable amount of time to install JAMF without having an internet connection to my server (it took me a long time as I was not well-versed in linux as well but it was one of the project's requirement). I would like to share it here so that others will not have to go through the same experience that I did and benefit from this post. Operating System: RHEL 7.7ISO Used: rhel-server-7.7-x86_64-dvdJava Version: openjdk 11.0.6mySQL Version: mysql community server 5.7.28JAMF Version: 10.17 RPM Needed For mySQL Installation:mysql-community-libs-5.7.28-1.el7.x86_64.rpmmysql-community-common-5.7.28-1.el7.x86_64.rpmmysql-community-client-5.7.28-1.el7.x86_64.rpmmysql-community-server-5.7.28-1.el7.x86_64.rpm mySQL InstallationStep 1. look for existing mariadb by executing:rpm -qa | grep mariadb-libs Step 2. Remove mariadb by executing:rpm -ev --nodeps mariadb-libs-xxxxxx Step 3. Install mysql-community-common by executing

There is a user who has an unencrypted internal drive. His jamf profile should be requiring him to enable FileVault. However, we he restarts or logs out of his device, he is not prompted for FileVault to be enabled. He is already enrolled in jamf but the "Install Configuration Profile Disk Encryption" is stuck as pending. I've tried sending a blank push. Is there a way to push this policy so they are encrypted without having to unenroll and re-enroll their MacBook? They are on an Intel Mac.

Hi everyone, Have you ever tried to update a PreStage Enrollment through the v2 API?I'm trying to create a python script that will update the customPackageIds of said PreStage Enrollment when certain packages have a new version available. This always gives me error 500, internal server error, I think. It would be something like this: import requests payload = { "customPackageIds": "110" } headers = { 'Accept': 'application/json', 'Authorization': 'Bearer XYZ', 'Content-Type': 'application/json', } response = requests.put('https://XYZ/api/v2/computer-prestages/3', json=payload, headers=headers) This is my first time doing something like that with python and JSON and I would gladly use python-jss for this but as far as I know it can't handle PreStage Enrollments. What's your take on this?

Hey guys. New to JamfPro line-up but I've gotten the hang of it pretty well. During the integration between Jamf Trust (Security Cloud / Wandera / RADAR / Please setup a naming convention), and Jamf Pro as the UEM, you have the option to either authenticate with Basic Authentication (Username, Password), or with OAuth, utilizing an API client in Jamf Pro with the appropriate permissions. The permissions are listed here, under the Requirements section. This Requirements section is the same for all versions of the Jamf Trust (Security Cloud, Security, Safe Internet, Wandera, RADAR, Please setup a naming convention) documentation, even the deprecated ones.https://learn.jamf.com/en-US/bundle/jamf-security-cloud-setup-guide/page/UEM_JamfPro_Establishing_UEM_Connectivity.html#task-6779 A Jamf Pro API Role and Client with the required permissions. For more information about API Roles and Clients with Jamf Pro, see API Roles and Clients in the Jamf Pro Documentati

Hi,Is it possible for an organization to disable the factory reset option on an iPhone? Alternatively, is there a policy or script that can accomplish this?

I'm deploying the latest version for Cisco Secure Client (5.1.2.42), which I have the configuration profiles for to provide the needed permissions for deployment, but this version of the Cisco Secure Client prompts users to add or enable the "Cisco Secure Client - AnyConnect VPN Service" as a login item. Any suggestions as to how to enable this without any user intervention for all users?  

We recently stopped using Cisco AnyConnect on the majority of our machines.Uninstalled the app, and unscoped the config profiles and thought that was that.Well, a couple months later, we update our new Zero Trust platform and start having network issues.I assume it's the Zero Trust software because we just updated it, but even after uninstalling it, some users machines were still acting up.I remote in, and check the network settings, and see the Cisco DNS Proxy and Content Filter are still installed, even though the user's device is no longer scoped with the config profiles that provided those setups.How do I remove these things? I thought removing the config profiles would have taken them off automatically?

The adventures of deploying Cisco's Secure Client continue... After going through Cisco's documentation, the HCS technology group guide, and building a PKG, changing the choices XML, and creating the config profile , I have hit another snag. When deploying through a policy, the install fails: Script result: installer: Package name is Cisco Secure Clientinstaller: choices changes file '/private/tmp/csc_choices.xml' applied installer: Installing at base path / installer: The install failed. (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. An error occurred while running scripts from the package “Cisco Secure Client.pkg”.)However, if I push the policy through sudo jamf policy , the installer will go through and this will appear:  If I click "cancel" the installation completes and everything seems to be in working order. I see the Umbrella Module appear and it is indeed active. Admittedly, I am n

Hello,Is it possible to cleanup Safari history with a bash or powershell command for iPads?

We are trying to run a script that will change a Mac's name to the asset tag of the device. It is supposed to run on devices at an ongoing check in on each device but it won't make it past the first test run. I know the script is fine running locally as expected but running the policy on JAMF (via a scope and self-service) gives me this error:Shell type is set as "Shell/Bash" and here is the code (omitted username, password and url for security reasons but tested each individually and they work as expected).  #!/bin/zsh # server and credential information jamfProURL=url username="username" password="password" # request auth token authToken=$( /usr/bin/curl \\ --request POST \\ --silent \\ --url "$jamfProURL/api/v1/auth/token" \\ --user "$username:$password" ) echo "$authToken" # parse auth token token=$( /usr/bin/plutil \\ -extract token raw - <<< "$authToken" ) tokenExpiration=$( /usr/bin/plutil \\ -extract expires raw - <<< "$authToken" ) localToken

Hi all,I'm trying to locate the Virtualbox License file on managed devices. I followed the guide outlined here https://community.jamf.com/t5/jamf-pro/best-methods-to-search-for-the-existence-of-a-file/m-p/286067 but a Smart Search doesn't yield any results (I personally created a dummy file to check that)I created an EA with the script outlined  #!/bin/bash LicenseFilePath="/Applications/VirtualBox.app/Contents/MacOS/ExtensionPacks/Oracle_VM_VirtualBox_ Extension_Pack/ExtPack-license.html" if [[ -e "${LicenseFilePath}" ]]; then EA_RESULT="Installed" else EA_RESULT="Not installed" fi echo "<result>${EA_RESULT}</result>"  I created a Smart Group with EA-Name as Criteria and Value InstalledAny suggestions? Thanks! 

Hello,I would like to get all of our Macs up to date and create a plan to maintain this.    I would like to use the ScheduleOSUpdate command with the InstallLater command as described in Use MDM to deploy software updates to Apple devices - Apple Support My questions are:Can these apple commands be used in a configuration profile that gets deployed via Jamf Pro? I am having trouble finding an example or specific guidelines.Or are these commands intended only for a Mass Action Command as indicated Introduction - Technical Paper: Deploying macOS Upgrades and Updates with Jamf Pro 10.34.0 or Later | Jamf ?How can I see the status of a Mass Action Command after I send it to multiple computers?I would love to hear your experiences if you have tried the ScheduleOSUpdate or if you have other suggestions. One more question on a similar topic.  I created a Configuration Profile (in Jamf) for software updates.  Does the Software Update Server need to be filled in if