Sorry for the long title.We were doing some testing with Nudge and found out that once you hit the deadline and Nudge enters aggressive mode that it still pops up even after you click to update the device.  My manager said when he waited and got to that date he was unable to use his device while it updated since Nudge kept popping back up. Is there a way around this?  I just added a long refresh cycle in the user experience tab to test but wanted to check here in case that is wrong.

I am having an issue with Jamf having "Start screen saver after" unchecked within a configuration profile, yet after 20 minutes each one of the iMacs run their screensaver. Does anyone have a workaround to changing the screensaver time from 20 minutes to never without me having to apply it individually per workstation?

We are in the process of recreating policies and configuration profiles in preparation for a new lease cycle later this year and I have been testing on a couple of M1 machines using my login and have had good results. I just set up one of those MacBooks for another user and even though the screensaver is disabled it will still eventually come on and when it does it will close out of any browser that he has open. Has anyone seen anything like this before? We haven't found that any other app behaves this way, just browsers...

Can someone post how I add two dictionary items together?  From here, Troubleshooting_Microsoft_Azure_Login_Using_JamfAAD .  I don't know if I need an array added for both.  Also, can I add 2 of the same Preference Domain in a Configuration Profile?  An example of the below would be appreciated.  Thanks in advance!! <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>tokenRetryCount</key> <integer>3</integer> <key>tokenRetryWaitTime</key> <integer>42</integer> </dict> </plist>and <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>useWKWebView</key> <true/> </dict> </p

hi all,is there a way to enforce the setting "Private Address" turned off?We actually have a Cisco ISE in our internal network that uses mac address to detect if it is an iPhone (we push mac addresses in a specific group) and then moves the iPhones to another network. Since Private Address is on, it transmits to the network controller a different MAC address and breaks our rule.

I circulate MacBooks in a library context, so multiple users use the same machine throughout the day. I'm required to have my MacBooks disk encrypted, and I need my users to be able to login to these MacBooks wirelessly with their Active Directory accounts. But I think FileVault prevents users from authenticating to the network before they login to the MacBook, is that right? Is it possible for users to login to wifi before they login to the FileVault-enabled MacBook?

Does anyone have, or can anyone advise on how to create, a manifest file for installing the Python 3.12.1?Pretty new to macOS administration, and very new to Jamf Pro, but would like to be able to deploy the Python 3.12.1 package through Self Service but not been able to get it to work. I'm presuming it is because I've not declared a manifest file, and using Composer reports a whole load of Deleted Files and Modified Files which I think are unique to my machine configuration and even the Files For Package seems to include a whole load of irrelevant files.Any help will be gratefully received.

Hi All,I will be taking Jamf 300 training and certification in a couple of weeks and it would be really helpful if anyone could give some tips for that.

Our school division is pushing for Filevault 2 on all Macs.  I'm tasked to figure out how to deploy this if it is feasible.  Our school division uses Active Directory.  I have so far tested enabling Filevault with a Configuration Profile configured as follows:I have also turned off automatic login while FileVault is on as per https://support.apple.com/en-vn/HT207431.sudo defaults write /Library/Preferences/com.apple.loginwindow DisableFDEAutoLogin -bool YESI have tested this with Catalina, Big Sur and Ventura Beta, I haven't got around to Monterey yet.  What I have found in Catalina and Big Sur is that only the Filevault users are listed and there is no username and password prompt for new users.  Ventura Beta does have a username and password prompt but even with automatic login turned off the computer does not connect to Wifi until someone logs in.This would be fine if it was a one-to-one computer deployment but I need to deploy this to lab computers and lapt

Hello everyone and thanks in advance. I'm just looking for a little guidance in what avenue to pursue for upgrading my fleet and keeping everyone on the same page moving forward. Jamf Pro seems to have a few different methods for doing this. Documentation found here shows using Smart Groups and Mass Actions to upgrade devices. That's a simple enough method and I would love for it to be that easy. My experience with the Mass Action "Update OS version and built-in apps" is that it is a black box that I have no idea of whether or not it is working. With a >12gb download, it's a little aggravating to just fire off the command and hope that as long it ends up in the History > Management Commands > Completed list, that it worked properly and the computer will... update itself at some point? Option 2 seems to be that a lot of people are using scripts like the ever-popular erase-install to handle upgrades. Is this because the Mass Actions don't work? People would rather

Hello everyone,We've been using Jamf for half a year now, and we got most of it working with scripts and other hacks, but one thing we still struggle with is updates.We have 2 issues with software updates, 1. how to force install them without user interaction.2. how to prevent Major updates like Ventura before they are approved.And I'll explain.1. I've tested a few scripts and methods that I found/created, but apple has made our lives harder requiring user authentication for major updates, and does not install updates that require restart at all, just downloads them.Has anyone managed to force update install and restart from Jamf via script? or is this locked now and must involve user interaction? 2. I've seen countless posts saying: "block InstallAssistant, and defer updates for 90 days" I don't know how no one mentioned this, or thought of it, but that will not apply only to the update you're thinking of, it applies to every update.For example, let's say I want to block Ventura

Howdy folks!  I am looking to add a few native apple apps back to my devices (I was a little too restrictive in my initial set-up) but now that I am adjusting my config profiles to include these apps (specifically Clock and Translate) they aren't showing up. . . is that because I haven't purchased them and scoped them to my devices? I would have thought that just by adding them into App Usage section of the payload (and home screen layout) it would add them in. I tried adding them manually into the Mobile apps section, but when I scope them to the device its prompting for the user to sign in with an AppleID. I looked for them in my Apple Business Manager Account, but I can't find the native apps listed in there at all. Am I missing a key step here? Do these apps live elsewhere in the restrictions and I'm missing it?   

Hello,I clicked "Unregister" in JamfSchool on an iPad as a test. Now the device in JamfSchool displays: "The device is no longer managed! The management profile was removed from the device on Tue Jan 9 19:15:30 2024. The device can only be managed again after it has been re-registered."The question for me now is how I can register the iPad again without using Configurator 2. Or does this only work with Configurator 2? But that would mean that I would have to connect the device to a Mac via USB.Ralph 

We use JAMF and Microsoft to integrate device compliance for many of our devices. However, in the last two weeks, we have observed that some devices randomly lose the 'Microsoft Intune' field in Azure and become non-compliant. When we check the company portal, the compliance managed by JAMF is also missing.Due to the lack of compliance, these devices start to show conditional access errors. We can fix this quickly by running the azure registration policy again, but we don't know the root cause of this problem. For example, one device had to be re-registered three times in two weeks. Others only once, and some never.We did find this MS known issue with Intune and macOS:Known issues with Microsoft Intune - Intune | Microsoft LearnCould this be the cause of our problem, or is there something else I might have overlooked?

Hi all,i am installing a security Appstore app (Tailscale) by default profile. I want this app to be started at login. Therefore mac has settings -> logon objects. How can i add an app to this via policie?Have a nice weekFrank

Hello, is there any way to make multiple computers unmanaged in JAMF without unticking the box for each of them individually or deleting them completely?Previously, there was a way to edit management account via mass action and set it to blank, but now that's not an option anymore.All those computers are un-enrolled already, however still listed as managed in JAMF database, and we are talking about hundreds of those - going through each of them would a pain..Thank you.

Dear Jamf Pro Support Team,I hope this message finds you well. My name is Somnath and I am a user of Jamf Pro currently working on the integration of our system with the Jamf SaaS App.I am currently facing an issue when attempting to update a user's password through the Swagger interface. The error message received is: "You cannot change information in an LDAP account or change the password."Upon further investigation, it appears that the Swagger API does not currently support the updating of user passwords through an admin user. As part of our administrative requirements, we need to perform password updates via the API using administrative privileges.Could you kindly assist in providing the necessary API endpoint or guidance on how we can achieve password updates for users with administrative credentials?Your support in resolving this matter is highly appreciated. If there are specific details required from my end or if further clarification is needed, please let me know.Thank you for

Hey everyone... I wanted to make Google Chrome a part of my automated deployment process and also be available within Self-Service. Why? Users can just download from Google on their own. True dat. But hey, one-stop shopping in Self-Service, right? As we all know, Google deploys Chrome via a DMG file. The Google Chrome.app file must be dragged to the /Applications folder. You could effectively re-package everything using Composer, but then things get REAL STALE, REAL FAST - Google updates Chrome frequently. So stale software is bad software. So how can we deploy Google Chrome with the freshest of the fresh so we don't get that not-so-fresh feeling? Well, lemme share my story, morning glory. . THE SCRIPTI wrote a simple script that does the heavy lifting... I tossed this script into System Settings > Computer Management > Scripts within the JSS... NOTE: Yes, I am aware that I don't have any error checking taking place. This is v1.1 - quick and dirty. Feel free to add som

I use a script to update Zoom to what ever version the app owners at my company say we are allowed to install. The script runs a curl command to download the installer for the version we want, then it installs the package. It first checks if Zoom is running. If it's not, it runs the install. If it is, it does not install the newer version of Zoom. The policy runs at check-in scoped to all comptuers with an exclusion for computers already running the version of Zoom we want to install. I have been trying to figure out how to detect if Zoom is running a meeting or not. Somoene may simply have Zoom launched, but not have a meeting running. I know a lot of my users just keep Zoom running. This results in the update taking longer to get done on all of my Macs. Does anyone know what process to look for if Zoom is in a meeting?

Situation: In Apple Business Manager we have two MDM server settings. We want to migrate our Mac laptops from the America MDM profile to the India MDM profile. What is the best approach for this?According to me first change the MDM setting from America to India in Apple Business Manager then reset the device and enroll the device again. Or do we have any other way of doing it?

Hey all. Rather than having to install and update Jamf Connect manually through policies after the black screen scare on Sonoma, i've been trying to have it deploy and update automatically through Mac Apps. However i find it is stuck on 'in progress' and never gets past that stage. Has anyone experienced this? It seems scoped to the correct group, i have attached my configuration settings in case anything seems odd there. Many thanks.

Hi all, Fairly new to Jamf, having an issue getting a Self-Service installer for Citrix Workspace to function.I have downloaded the .dmg file from Citrix, packaged it up, and added it to an install policy. I've enabled FUT and FEU as it's a .dmg and not .pkg. But on installing from our Self Service, the application isn't actually installed despite self service saying install complete (not appearing in Applications list). Any guidance on where to go? Thanks!

Hello everyone,I hope you are doing well. I have Okta integrated with Jamf through Jamf Connect, I am wondering is it somehow possible to pass user's Full Name or at least Username in Okta to Jamf / Mac.What I am trying to do is to change computer name to be the same as the name of the Okta user.So far my closest success to this was to create script that takes username or alias(alias has precedence) of the currently logged in user and sets it as computer name. Code is below: #!/bin/bash admin1="admin1" admin2="admin2" # get username of the currently logged in user username=$(/usr/bin/logname) # get currently logged in user's alias if alias is not available, username will be used instead alias=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name && ! /loginwindow/ { print $3 }' ) # If logged in user is not one of local admins that are for IT personel if [ $username != $admin1 ] && [ $username != $admin2 ]; then if [ $username == $alias ]; then

Hello, Using hybrid joined Azure, we appear to have an issue with our Conditional Access configuration between Jamf and Entra. We have configured Jamf Device Compliance with a Compliance Test Group and an Application Group, the connection verification status: Success between Jamf and Intune is confirmed and partner compliance management configured.A group of test Mac’s in Jamf have Company Portal and Intune integration policies installed and they are registered in Entra We have configured Conditional Access policies in Intune and targeted all cloud apps but when we run the CA policy we are locked out of Cloud Apps because according to Entra Sign-in logs the Mac is non-compliantAm I missing something?

Not sure what I am doing wrong here. I have created a Supervision Identity in JAMF Pro. But when I try to add it to my keychain, the password I provide is invalid. I've deleted and recreated the identity many times. Any idea what is going on?