Heads up to my fellow Jamf community. We've been seeing iPadOS 15.8.4 iPads when reprovisioned can't be enrolled to Jamf School.  This may affect Jamf Pro too.  The exact error is "Failed to retrieve configuration".  I reached out to Jamf support and they said they have been getting reports of this from others and that this has been observed across different MDM providers.  Jamf reached out to Apple regarding this issue and this is exactly what they told me: Apple did get back to us just a bit ago, and they have identified the issue (they did not elaborate on what the issue was). The release is not ready yet though and at this time they couldn't give me an ETA on when that would release. For now I created an internal Jamf Product Issue so we can track customers and I have attached this case to that ticket (PI136109). Hopefully an update that fixes this issue will come out soon.  Jamf did say that they could reproduce my issue but had mixed results as one te

We are currently deploying some AI governance policies and have found that the policies I’ve written for Claude desktop do not translate to the claude.ai browser site. Working with my team to get Jamf Extender deployed. First image is a successful block in the Claude Desktop app, second is in the browser.  I expected some parity between the desktop app and the browser site, but I don’t see an option to configure the site specifically in the AI policies portal. Is there something I’m missing? Would Jamf Extender help with this? 

Using Jamf Pro. We have an extension attribute for App-Packs for grade levels (K-2, 3-5, 6-8). Is there an easy way to change this in bulk? I typically use MUT, but v6 doesn’t have Ext. Att as an option and Classic wont be compatible with MacOS for much longer. I even tried using the MUT on Jamf Extender but that didn’t work. Any help is appreciated. 

Hello,We are wanting to deploy software updates to our iPhones and iPads outside of business hours. However many of these devices use cellular when not onsite. A big concern is going over our data limit and being charged for overages. Is there a way to restrict OS updates to only occur if a device is connected over wi-fi?

TitleHi Apple/Jamf admins,I purchased a MacBook Neo advertised and sold as brand new from a third-party seller.During initial setup, I discovered that the Mac is enrolled in Jamf/MDM and is showing organisation-management information. I was not informed before purchase that the device was managed by an organisation.I have contacted the seller and they have offered to exchange the device, but I’d like to understand what has happened before returning it.From an IT/admin perspective:What are the legitimate ways to determine whether the Mac is registered in Apple Business Manager/Automated Device Enrollment? How can I distinguish between a locally installed MDM profile and Automated Device Enrollment? If the device is in Apple Business Manager, does removing the MDM profile locally actually resolve the underlying enrollment? Can an Apple/Jamf administrator release the device from their organisation remotely? Could a genuinely unused/new Mac have been purchased by a reseller and subsequentl

With the depreciation of the “app usage” payload, where do we go in blueprints to hide/remove default apps (phone, calc, books, etc)? Been digging through and can’t seem to find a like for like.

Hey Jamf Nation, I'm currently trying to uninstall Cortex XDR from company devices, but I'm encountering an error that says "Uninstaller not found." The uninstaller is located in the folder '/Library/Application Support/PaloAltoNetworks/Traps/bin/'. Do you have any recommendations or suggestions? Here is my script for the uninstallation: #!/bin/bash # Set your master key here MASTER_KEY="master-key-here"   # Path to the uninstaller app UNINSTALLER_APP="/Library/Application\\ Support/PaloAltoNetworks/Traps/bin"   # Check if the uninstaller exists if [ ! -d "$UNINSTALLER_APP" ]; then   echo "Uninstaller not found at $UNINSTALLER_APP"   exit 1 fi   # Launch the uninstaller and enter the tamper protection key osascript <<EOF tell application "$UNINSTALLER_APP" activate end tell   delay 2   tell application "System Events" tell process "Cortex XDR Uninstaller" repeat until exists window 1 delay 1 end repeat   set frontmost to true  

I am trying to create a EA to report the status of the the following key in the Clients.plist.  This is what I have so far but it is not reporting properly.  Any help is appreciated.  TY #!/bin/bashABSlocationServices=$(sudo defaults read /var/db/locationd/clients.plist 2C4E4FD5-F029-XXXX-XXXX-XXXXXXXXXXXX:icom.absolute.ctesservice.ase:Authorized)if [[ "$ABSlocationServices" == "True" ]]; then    echo "<result>Enabled</result>"else    echo "<result>Disabled</result>"fi

On Aug 18th, I changed over to the SSO integration in Jamf Pro Cloud. I have always had my SMTP server settings configured for email notifications on Smart Device Group Membership changes. I no longer receive those emails even though the box is still checked to do so. In the SMTP settings in Jamf Pro, I can send a test message and I DO receive that but just not any of the membership change emails that I want to. Is this a known issue or is there something I am missing? Any and all help will be appreciated. 

I’ve noticed that I can’t send any more commands from Jamf Pro to devices after the iPadOS 27 update. It is requiring me a manual restart of the device in order for pending commands to go through. Is anyone else seeing this or is it just a new fluke?

I’m not sure if this has been reported yet, but Recon gets stuck on Locating hardware information (macOS 27.0), Gatekeeper status: App Store and identified developersThe machine I am using was upgraded to Golden Gate, not a fresh install. The software updates button is unchecked in Inventory Collection. This does not get stuck on any other OS version in my environment, seems to be a Golden Gate issue.Again, just wanted to get a post out there so a discussion can be started about it.

Hi, I’ve configured this Blueprint on the 14th September with a deferral of 90 days for macOS Golden Gate. I’ve only scoped macOS 15 & 26. I’ve only excluded my machine. Everything seemed fine but now today I check my dashboard and I see 2 user’s machine’s have been upgraded to 27. Why, how? I’m pretty annoyed now by this 

Hey,since the last iOS update for iPads, I've noticed that the devices are still showing up under Devices > Update even after a successful update.In the activity log, I see that "AvailableOSUpdates" is not a valid request type.I haven't found a way to solve this problem yet. I'm using Jamf School. Regards

I need to update Docker to the current version across the fleet.  Rather than downloading, repackaging, and then deploying via policy, I saw the Jamf App catalog has a docker entry for it. My question is if I set it up as...target group: all managed devicesInitial Deployment: Self ServiceUpdate Method: Automatically UpdateWill thatnot push to devices that don’t have it installed update automagically to devices that do or will it update devices that only installed, initially, from self service?  

I am new to the community. I have a configuration policy for AD binding. The policy has been in place for well over a year. There has been no changes to the Active Directory settings, however its giving failing messages. What's causing this?  

Hello fellow Jamf Admins,I would be extremely grateful if anyone has come across this App before (Hospital setting) called, “CBORD Mobile Inventory”. I am trying to add the App Config settings like I’ve done for plenty of our other Apps, but this particular App won’t give me a break. Below is a screen shot of what fields need to be filled out and the App Config I came up with and verified via AI. I am at a loss right now. The last thing we want is for our end-users to have to enter the data manually as that would be a nightmare. Any assistance would be very much appreciated. App Config I’ve tried (certain fields have been changed for obvious reasons). <dict>    <key>serverURL</key>   (<===== I have also tried “APIURL”)    <string>https://netmenu4.cbord.com/NetMenuAPI</string>    <key>appClientId</key>    <string>xxxxxddddfffcxxxxxxxx</string>    <key>region</key>    <string>us-east-1</string>    <key&gt

Hello,I’m looking at deploying Logic Pro to shared/classroom Macs using Jamf Pro and I’m trying to work out the best way to manage the Logic Pro Sound Library for multiple users.My understanding is that newer versions of Logic Pro use a single Logic Pro Library.bundle, which can be relocated to a shared location such as /Users/Shared/ and accessed by multiple macOS users.What I’m trying to establish is:Is the Sound Library installed on a per-user basis by default? If the full Sound Library is downloaded by one user, can other local users access those sounds without downloading them again? What is the recommended way to deploy/configure a shared Logic Pro Sound Library using Jamf Pro? Can the Sound Library download/installation be automated through a Jamf policy or script? Has anyone successfully deployed this configuration to shared Macs in an education environment? If the Logic Pro Library.bundle is moved to /Users/Shared/ can I default Logic Pro to look at this directory for new user

I'm creating an extension attribute, which I want to use as a criterion for a smart computer group. I want the group to contain only those for whom the extension attribute has a particular value.That is, if my criterion is "[name of extension attribute] [is not] [value I'm interested in]", then members of the group will include those that have a different value from the one I'm interested in, which is right, BUT ALSO all computers that don't yet have the extension attribute populated.For example, suppose my extension attribute is called ApplicationBlahInstalled, and based on the actions of a script, it will populate the extension attribute as either "Not Installed" or some data indicating where and how it's installed. I will therefore have 3 different possible states:1. ApplicationBlahInstalled is populated, and has the value "Not Installed"2. ApplicationBlahInstalled is populated, and has some other value3. ApplicationBlahInstalled is not yet populatedI need to detect machines that ar

Hi! I need to create a profile that only allows students to access Google Classroom.  This will require also having some web access to finish the login process; has anyone else done this? 

I'm seeing this popup on some of our users devices since the upgrade to Monterey, but I'm not entirely sure what it's trying to do, and it seems like I need to know in order to prevent it from popping up by automating what it's trying to do. I think this is from trying to install FortiClient, but I'm not positive. How can I tell what it's doing so I can make this easier on our users?

Hey,First-time poster. We have an issue where we want to force install certain chromium-based extensions to certain devices. This is fine, add the custom plist with the ExtensionInstallForcelist with the GUID and update the manifest URL. This is then deployed to the required subset of users.The issue we have is scaling this with multiple extensions. This is fine if there is no overlap on the devices where this is being deployed but as soon as Extension A & Extension B are deployed to one device with multiple profiles then only one wins.Any ideas on how to deploy multiple extensions across multiple profiles when there might be overlap in the scope of devices? I’ve tried using just the plist within the preferences folder but it seems like it only respects/looks for policy within Managed Preferences instead.Many thanks for your help.

I'm seeing a number of Macs reporting that FileVault 2 is not enabled, despite the encryption state being displayed as Encrypted. I've also seen this sometimes change to show Enabled before reverting back to Not Enabled again. Is this a known issue? The machines appear to be completely fine and encryption seems to be on.

Hi there,I’m experiencing an issue that has suddenly appeared on several Macs in my fleet, which is managed using an on-premises Jamf Pro server.On an increasing number of Macs, the “Connect to Server…” option in the Finder’s “Go” menu has disappeared.I am not applying any specific configuration profile that blocks certain features. I only customize the Dock by adding quick access to applications from the Microsoft Office suite, our VPN, and the Macintosh HD icon on the desktop.A user can still browse the folders on their server through their Finder browsing history, but they can no longer access the “Connect to Server…” option.Could you please help me understand what might be causing this issue?Thank you.

Hello all,First-time poster on Jamf Nation, so please criticize formatting, grammar, etc.We use Bomgar Remote Support on our Macs, but when deploying to a test machine running Sequoia, I get the message "Allow Remote Support Customer Client to find devices on local networks?" It looks like a PPPC popup with options to "Don't Allow" or "Allow", but I can't find a corresponding PPPC setting. We already have Accessibility, SystemPolicyAllFiles, and ScreenCapture set up according to this deployment guide, and I don't see another PPPC option that looks related to this error message. I'm not even sure why this is a permission that needs to be allowed. It feels like the Windows message to "allow this device to be discoverable on local networks," but it's going the opposite way. Why would I need permission to go out on the network and connect to the Bomgar server from my endpoint? Has anyone else seen this popup before or something similar?

My company has been using Jamf Pro to manage iPads for several years.  I’m trying to get our Jamf Pro account configured with SSO using JumpCloud SAML and I have a few questions.First of all, I’m new to jamf and not too familiar with the nomenclature.  I have an account in our Jamf Pro subscription but not in Jamf Account (apparently).  I created a Jamf Account but it doesn’t seem to be connected to our Jamf Pro subscription in any way.  I’m assuming that the Jamf Account is some umbrella account that manages all the other Jamf subscriptions (education, pro, etc.)  Is a Jamf Account necessary if we only have a Jamf Pro subscription?If I’m reading the docs correctly, SAML is the deprecated way of managing user logins for Jamf Pro and we’re supposed to use OIDC from our Jamf Account account.  Is that correct?  We are not looking to do anything fancy through SSO, I just want to manage my employee’s Jamf Pro accounts.  We’re not building apps or anything else that need OIDC.Can I just use