We currently use Okta SSO with Jamf Pro. Filevault is turned on for all our devices, which requires the initial local login. Then the next login is network credentials with SSO. Meaning, our users have to login twice. This works well, however we recently purchased Okta Device Access with the understanding that we could eliminate all logins for a passwordless user experience. I've been researching the ODA setup using Okta as a SCEP auth. I've read this would require all devices to be re-enrolled?  Has anyone gotten this to work with Jamf Pro to be passwordless? I've love to hear your experiences. Thanks!

Work within a school and looking to upskill the team on Jamf, we receive education pricing for Pro licences but can’t see anything about training. Is education pricing available or are we out of luck on that front?  

Hey there,    we are currently using Jamf School with approximately 4000 devices. After using shared iPads exclusively we implemented a 1 to 1 configuration in a couple of locations.  Everything worked well until the devices needed to be transfered to a new user.  Previously i assigned the profiles beforehand and users just needed to login with their Jamf credentials.  The iPad updated the name via information given by their jamf Account (%firstname,%lastname) and so on.    But i cannot get that login window on a previously used iPad for the life of me.  Even un- and reenrolling the device did not work.    Is there no other way of assinging a user but to use placeholders or manually assigning a user?    Thanks for your input! 

To install Creative Cloud at my company, end users are directed to the Adobe Creative Cloud website (https://www.adobe.com/creativecloud/desktop-app.html). Every two weeks I get a report from our Security team listing device vulnerabilities. There's frequently a fair number of devices that need one or more Creative Cloud apps updated. I started emailing users individually, reminding them to update their Creative Cloud apps. Wondering if there's a better way, because emailing users and following up when they don't respond is too manual and too time-consuming. Curious how other admins approach this.

The application name for Adobe Illustrator remains the same regardless of the version installed, which makes it challenging to identify specific versions based on the file path alone. I need to create an Extension Attribute (EA) that can detect different installation paths for Adobe Illustrator, such as: /Applications/Adobe Illustrator 2024/Adobe Illustrator.app /Applications/Adobe Illustrator 2025/Adobe Illustrator.app This will allow me to create a smart computer group in Jamf Pro and effectively scope updates for each version. I’ve tried the following script, but it doesn’t seem to be working as expected. Any advice on how to get this working would be greatly appreciated!      

I have had 2 MacBooks out of many so far, that the FileVault 2 Enabled Users is ciscoacvpnuser. This means that Encryption never turns on for the real user of the MacBook. 1. I would like to know why this local system account is being added here? I think the user isn't logging back in after the final install of the default applications (which includes Cisco Secure Client) and a required reboot). And somehow the ciscoacvpnuser account is being added. 2. Is there a way to remove this account in Jamf or push the user's account from the user's MacBook to Jamf? These are newly enrolled computers so Support has been contacting the users and wiping the computer and re-enrolling again.  We had a ticket open with Jamf but they did not have a resolution for the Support team. Thanks in advance!

Hi everyone, We manage a fleet of approximately 1,500 M2 MacBook Air devices used by students. All student accounts are standard users with App Store access blocked. Applications can only be installed via Self Service. To prevent unauthorized software use, we've restricted app execution from the Desktop, Documents, and Downloads folders. However, students have found a workaround: they are dragging applications into the Dock and launching them from there. I’d prefer not to implement a policy that constantly removes unknown apps from the Dock, as it can negatively affect user experience. Has anyone encountered a similar situation? Are there any recommendations or best practices to prevent applications from being run via the Dock if they aren’t located in the /Applications folder or haven’t been approved via Self Service? Appreciate any advice or suggestions! Thank you.

Jamf Connect in Entra Enterprise App the role has stopped working for Users (Standard User/Administrator), can someone help me look into this issue?

Hi everyone, I am new to Jamf and I am loving it so far. I am creating a managed local administrator account through the User-initiated enrollment settings and that is fine (already created a config profile for the rotation of the passwords). The problem that I am having is that in the prestage enrollment the users are assigned to be local administrators automatically and right now (from what I learned) the only way to make them standard user is to tick the options to create a local admin account in the prestage settings, but this will create 2 admins once the user is enrolled.    I am sure I am missing something, any suggestions?  

Our organization recently deployed Jamf pro to help us manage our Mac's and while for the most part theres been very few issues I haven't been able to fix myself there is one that has been plaguing us pretty badly. The Mac's enrolled in Jamf either through prestage or open enrollment do not have access to most of the accessibility options are not available for either the Admin or Standard users.                                                      Now being fairly new to Jamf and to Mac's in general im a bit lost as to what could possibly be doing this. Ive done some reading about the authorization Db and some of the plists but I am having a hard time finding anything specific to this section of the system settings. A few things that I have checked is within the restrictions section within Configuration profiles and made sure that the pane was e

Hi everyone, Does anyone know how to automatically set Microsoft Outlook and Microsoft Edge as the default apps on iOS? I've been researching this, and from what I’ve found, it seems the user needs to open the apps at least once and manually set them as default. Is that correct? Any input or workaround would be greatly appreciated! Thanks in advance.

Hi, I heard the news High Sierra's out (Yay!) But when I go to Apple's App Store, search for High Sierra and then download, it only downloads a 19.9Mb file. Where can I download the full version? I searched developer.apple.com as well. I want a stand alone installer (and create a bootable USB from it) so I can easily and quickly test out multiple Macbooks with this new OS. Is there anywhere can download the full installer?

I am trying to change a computer's name by editing it in the computer's Jamf Pro inventory > General page. I have a policy to change all of my managed computers' names to match the names set in Jamf, so theoretically this name change should be pushed out to the machine after I updated it in Jamf. This is an iMac running MacOS14.4.1. But when I change the name on this machine and save it, the page reverts back to the default "iMac" name. I've done this hundreds of times and have never had an issue getting a name change to stick in the Jamf Pro inventory. Has anyone else seen this issue? 

Hello !I just noticed that for the iPads we recently bought that at the remote management step, I have the "Enroll this iPad" as usually but on some iPads, I have one more button named "Remove iPad from Organization". What is it about ?If it allows the iPad to be removed from Jamf and / or Apple Business Manager, I don't want it. I search about it but didn't find any usefull information. I would like to try to tap on it but I don't want to do something irreversible.Could someone give me informations about this and how to make this button disappear like on other iPads I have ?

Hello, I would like to know if you know how to disable Web Filtering on Forticlient VPN, please? Indeed, we use Forticlient VPN in my company. We need to install a configuration profile to set up the Filter Socket; otherwise, without it, the user gets a pop-up asking to install the Network Content Filter. The problem is that we have just implemented Jamf Security Cloud, and we have deployed a Jamf Security Cloud profile on the computers. Most of the devices don't have the Secure DNS of JSC activated, and according to Jamf support, this is because Macs can only handle one filter at a time, and other filters need to be removed or disabled. But as I mentioned earlier, if we remove the Filter Socket from Forticlient, the pop-up appears every time Forticlient is used. Otherwise, if we cannot find a solution, we will have to stop using Jamf Security Cloud, which I find unfortunate. Thank you in advance, and have a very good day.

Hi all, I am trying to work on a solution to setup a splash screen at the login for our fleet. The idea is when users log onto macs, a splash screen pop up with a user agreement message that by "logging into the computer you abite with terms and conditions etc". I created a config profile with a Login Windows Payload and in the banner I copied the user agreement message, but since the message is too long you cant see anything unless you scroll down. I also created a little app using Script Editor and packaged it, then created a config profile to add it to Login Items. but I need a better solution. I am hoping if someone has done it.   Thank you

Hi all,At System Settings -> Display -> Advanced -> Energy  you can this turn off or on  "Prevent automatic sleeping when the display" Any idea of this is possible to control this with Jamf? thanks  

As we deployed new AppleTVs we got the old AppleTVs back, some were not MDM enrolled (teacher donated). Now we are tasked with enrolling those OLD devices in our MDM. Mostly we were successfull in adding the devices to our MDM (via USB-C), but, we have a hard time with some Wi-Fi ONLY AppleTVs that were found in the mix. The apple instructions for enrolling the Wi-Fi only devices with Configurator 2 don't make any sence: Connect Apple TV HD using Wi-Fi   Apples instructions require the AppleTV to be reset/erased and left at the "Hello" screen, then, Configurator needs to PAIR to the device in order to process the enrollment, but, there is no Wi-Fi setup on the device...??? ... Anyone has any bits of advice? is MDM enrollment not possible on Wi-Fi only Apple TVs?

We have a handful of applications that are required to be on our laptops at all times. Currently, we have smart groups set with criteria for the app not being installed and a policy scoped to that group. The downside is it only updates when an automatic inventory update is done every day. Has anyone done something similar that runs more frequently?

Hi Everybody! Just throwing this one out there in hopes that someone has been in this situation before. This morning I had a report from a user that they couldn't connect to our secure Wi-Fi and upon investigating, I found that their Mac was no longer in the JSS/Jamf Pro Server (JPS?). Someone has deleted it!!! Do any of you know of any logs that may show when a Computer is deleted from the JSS/JPS and by whom? Obviously I can't check the Computer record as it is non-existent. I have of course asked the team if anyone deleted computer "X" and surprise surprise the response was "Nope, don't think so". Not looking to catch anyone out, just would like to know who to do some additional training with or in the unlikely event if there is no record of it being deleted, then maybe we have an issue with the JSS/JPS. Thanks in advance!

Hello all, We are working on leveraging the DDM managed-software-uodate API feature for pushing out enforceable updates to our endpoints. One of the issues we are seeing, however, is that some machines get stuck where the machine never updates but when I try to push and check a new plan, I get the error  EXISTING_PLAN_FOR_DEVICE_IN_PROGRESS  My question is, how do we go about canceling a plan that is already in progress?   Thank you, Alex Weiner

Hey all,I am using the script below to install Maya 2024 and activate it using a network license.  This is the script we used for the past 3 years.  I've made the necessary changes to the script (product key, year, server), double checked things a few times and still can't figure this out: #!/bin/sh#Instructions for next time#Copy installer app to /tmp using Composer package#Modify values below as necessary (Usually: year pKey and serial)#Make sure to check pkgPath1-10 match latest installer#Set variablesyear="2024"pkgPath1="/tmp/InstallMaya2024.app/Contents/Helper/Packages/Licensing/AdskLicensing-13.3.1.9694-mac-installer.pkg"pkgPath2="/tmp/InstallMaya2024.app/Contents/Helper/Packages/Licensing/adskflexnetserverIPV6.pkg"pkgPath3="/tmp/InstallMaya2024.app/Contents/Helper/Packages/Maya/Maya_AdLMconf2024.pkg"pkgPath4="/tmp/InstallMaya2024.app/Contents/Helper/Packages/Maya/LookdevX.pkg"pkgPath5="/tmp/InstallMaya2024.app/Contents/Helper/Packages/Maya/MayaUSD.pkg"pkgPath6="/t

We're testing Platform SSO with Entra, we can get the Intune machine to login & create new accounts, but it seems to be removing admin rights on the accounts if they were previously enabled (like our local admin account).  I recall jamf mentioned something about this being a potential issue - but I haven't found much on how to change the behavior.  Does anybody have any recommendations?  

Hello,I have been searching online and through forums but I cannot find any useful information on if anyone has gotten the desktop/folder automatic syncing to work for Mac devices via Jamf? The Plist configurations I am pushing is not working. All the previous posts concerning this topic have gone cold. Has anyone been able to successfully implement this configuration and if so, can you guide me on how to complete this process?    

Can anyone advise what would happen if a policy name was changed? For example, if I needed to rename "10-Install Chrome" to "210-Install Chrome", would it remove the package that was installed by the first policy and reinstall the same package under the 2nd policy? And am I correct in assuming that removing a policy does NOT remove the installed app? We're renaming them so that we can properly sequence the policies (e.g. anything with 0XX are pre-app installations, anything with 1XX are required app installations, anything with 2XX are for specific labs, etc).