Hey All,We are working on determining the best way to manage our assets. We are a Mac/iOS only environment. So all of our equipment goes into Jamf Pro. We don’t do touchless deployment (management decision although its practically touchless). I’d imagine we’d need to get MUT involved to update purchase status.How do you handle new equipment or equipment that goes back into inventory? Also, we are looking to get physical asset tag stickers for the devices. Any suggestions on using Jamf as a complete solution? Or addition tools that people use for Asset Management to track items?Thanks!

I am attempting to import a new VPP token that I have downloaded from Apple business manager. Every time I try to do this, I get an error saying "The file received was not valid". I have tired using a different web browser. I have rebooted Jamf Pro, and I rebooted the entire Ubuntu server VM. The Jamf Pro server log does show an error at the time I attempted to import the token. I have an open case with Jamf for this, but if anyone knows how to solve this, that would be wonderful 😊

Hi all,I’ve been unable to find the answer to this one so I’m hoping the experts here will know the answer.I accidentally scoped a policy to all computers with the recurring check-in box ticked rather than just the enrollment complete option. I realised my mistake and rectified it, but now there are multiple pending commands in the policy log. How can I cancel these? Thanks

Basically we have disabled the screenshot feature for a certain group in my organization via JAMF Configuration Profiles, but recently we have found a loophole for users to take screenshots via enabling the “Show features for web developers” and then on Safari, going to Develop tab and “Show Web Inspector” > Elements tab and right click the html to show the option to “capture screenshot” and it will allow you to save the screenshot. We are trying to remediate this loophole by disabling the option to enable the web developers option. Anyone have any ideas? I have tried using Configuration Profile and using the Application & Custom Settings option, but could not get it to work using the plist I found online.https://www.geeksforgeeks.org/techtips/how-to-take-screenshot-apple-safari/

Hi All, I was wondering if it’s possible to push a plist/script to allow Outlook to download external images from a sender. I have seen a thread on here regarding the same topic, but I believe this is to download ALL external images from ALL senders, which is something that we do not want to do. We just want to download from a specific address. Any help pointing me in the right direction would be amazing.Thanks, Chris

Hello, I made a pretty noob mistake when preparing an install package for OS 10.10.1. I tried it on a test machine and it works great, but I didn't think my deployment strategy through 100%. I had the right idea. I have the image cache to every compatible computer first (works great) so that once it's cached I wanted it to be available in self service as an installable item. That's exactly how I want it to work, but the problem is I cloned another install policy and didn't look very carefully, and had it execute at the recurring check in, so many of our computers just initiated the install automatically. I have since fixed that problem with the "install policy", and learned the lesson about cloning other policies... But my question is that there are a few computers that we can't update to 10.10 yet due to some software issues. They are on the screen where the popup has come up warning them that the computer will shut down 5 minutes after clicki

I wanted to make a popup window that users had to click on to acknowledge they were getting an update that would close their open application.I created a notifyScript , a notifyPolicy, and a updatePolicy.notifyPolicy is set to enabled, recurring check-in, automatically rerun, on next.notifyPolicy is set to enabled. notifyPolicy passes the name of updatePolicy into notifyScript as an argumentnotifyScript uses updatePolicy name as a custom event trigger to call update PolicyWhen notifyPolicy runs, i get the following:"No policies were found for the "updatePolicy" trigger.Where am i going wrong?

We’re Trying to force OneDrive to sync Desktop and Documents on our Macs using Jamf. machines aren’t domain-joined. They’re already signed into Outlook/Teams with their work accounts.Here’s what I’m trying to do: Auto sign users into OneDrive Turn on Known Folder Move (KFM) for Desktop/Documents Avoid macOS prompts asking for folder access What I’ve done so far: PPPC profile – I used the correct code signature from the OneDrive app (verified with codesign). Gave access to Desktop, Documents, and Downloads. But the profile fails to apply in Jamf with a status of “Failed”. Script – I’ve got a script that reads the signed-in email from Office apps and uses the odopen:// URL to trigger OneDrive login. It runs, but OneDrive either doesn’t sign in or doesn’t start syncing unless the user manually clicks through prompts. Where I'm stuck: PPPC profile won’t install, even though the code signature looks right. Even if OneDrive opens, syncing doesn’t start unless the user allows folder a

Hello, I need to create a script to simply turn on the Teamviewer in Security & Privacy > Screen recording. Right now it's a manual process and we're trying to deploy Teamviewer host via Jamf. However the configuration policy that comes with Teamviewer host does not allow us to allow screen sharing. It gives the user the option to allow screen sharing and since we don't want the user to interact with anything, I'm looking for a script that can turn on Teamviewer in Screen recording in Security & privacy:  

Hello all,I created a PPPC config profile to grant OneDrive full disk access.  Jamf Pro says the config profile is successfully installed on my test Mac, but when I check Privacy & Security → Full Disk Access it shows that OneDrive does not have full disk access.  Is it normal for this change not to reflect in settings or am I missing something/doing something wrong?  For clarification I have made the config profile directly in Jamf Pro and using the Jamf PPPC utility and uploading the config profile into Jamf Pro afterwards. Thanks!

We’re deploying the CIS L1 baseline to Macs which are using the new Platform SSO with Entra.  What’s the best practice in terms of password policy within the CIS baseline? Should we exclude these policies or does using PSSO override them anyway? I don’t want to end up on a situation where the baseline password policies are more restrictive than the company password policy from Entra and have that causing issues with password syncing. 

Hi All. I’ve tried searching but haven’t found any hits based on the search queries I’ve given, so i’ll try posting instead.  I’ve been tasked with writing a script that can be run from a Jamf Self Service action to add users to a specific Azure AD group.  My script should work, but seems to be failing. I’m getting a repeated error HTTP Error 411. The request must be chunked or have a content length. even when passing a flag to chunk it.  I’m not great at API, and Azure API is new to me.  Anyone out there have experience with that?  I can share my script, but wanted to make sure I’m not trying to do the impossible first.#!/bin/sh # Add a user to an Azure AD group.sh # # # Created by Ed on 2/28/23. # ## Read the KerberosSSO plist to get shortname of signed in user plistLoc="/Users/Shared/.KerberosSSO/" plistName="com.apple.KerberosSSO.attributes.plist" valueName="user_name" foundItem=$(defaults read ${plistLoc}${plistName} ${valueName} | /usr/bin/aw

Hello,We have two instances of JAMF, School and Pro. The organization I am working for has attempted to move from School to Pro by reassigning all devices from the School MDM to the Pro MDM in ASM and slowly wiping them.The issue that I am coming to face is that the licenses were left assigned to these phantom iPads still in School, and from what I can tell I won’t be able to revoke any of them because they aren’t going to check in. Has anyone else had experience with this or know what would be the best course of action?I have refrained from revoking the VPP token, I am not sure that would do much. Ideally I would be able to move all license to the new JAMF Pro location in ASM.Thanks 

Hello everyone!I'm hoping someone out there has a way to automate the installation of the helper tool that you get prompted to install when you launch Pro Tools 2021.7 for the first time? Pro Tools in this case is being installed using the PKG installer you download directly from Avid. Thanks in advance!

Hi,I would like to create a deployment for Maya 2025 based on the topic for 2024:https://community.jamf.com/t5/jamf-pro/packaging-autodesk-maya-2024-with-redundant-license-servers/m-p/298743I've found a .app installer in the Contents of the installer:/tmp/maya2025/AdskIdentityManager/AdskIdentityManager-Installer.app This app opens an installation wizard. How can I execute this (after the PKG installs) in silent mode?Thank you.

Setting up some new M4 airs.  Made a mistake after enrollment with the account that was created so decided to wipe and start over.  Ran the Wipe command and instead of what I’ve seen with previous devices this one when to activation and then Recovery so that the macOS has to reinstall.  Is this expected with M4’s?? The M2’s went to activation and then right to setup.

Hello,I have noticed recently that searching for JAMF Nation articles on any mainstream search engine gives the results for those articles, but if you click them it brings you to the JAMF Nation home page instead of the article trapping the information behind the built in search.Is anyone else having this issue, or know what this is? Thanks

When adding apps to Self Service (or even Self Service+) via Mac Apps, the applications descriptions are in German. I’ve ensured that English is set to the preferred language and enabled location service. This is being run on a test VM but I can’t for the life of me figure out why this would be the case?  

We recently migrated to Jamf Cloud and using Azure AD as our Cloud Identity Provider and Single Sign-On solution.  It works well enough, but we have a weird situation.  We're sticking pretty close to Microsoft's documentation on it, which can be found here.By default, the iDP maps userPrincipalName as the username.  That's a full email address in our environment, so we want to use onPremisesSamAccountName instead.  That works fine in the iDP in both testing and looking up users/accounts.We also need user authentication during the initial device enrollment via DEP.  We've gotten that added in by adding an Enrollment Customization that is just the SSO.Here's where it gets dumb.  If we now enroll a machine while the User Name mapping is set to onPremisesSamAccountName, the SSO during enrollment registers the device to just the userPrincipalName with no other user data.  The Pre-Fill Primary Account Information only puts in the userPrincipalName as the Us

Hello,on macOS 14, With PPPC Utility, i want to create a profil who allow the usage of camera and microphone on an .app. But when i open PCCC Utility or make it across web admin from Jam, there is not “Allow” option available in the select field.I read that the application must be without hardened runtime, but if i remove the hardened runtime, the app can’t be export via “Archive” → “Direct distribution”.Any idea ?

Heya awesome Mac admins! I am still relatively new to this whole Jamf thing and looking into setting up Jamf Setup Manager to install our apps before the user reaches the desktop. I am trying to follow guides and getting hung up quite a bit on step 1 of most them, “package Setup Manager”. This is kind of a loaded step. I have tried several ways of doing this. I have packaged the zip, which didn’t work. I have extracted the .zip to the desktop and then packaged, didn’t work. I have tried putting the extracted zip in different folders, then packaging from there with Composer, didn’t work. How the heck do I package this thing for deployment? The configuration from Jamf Pro is relatively straightforward, I just need some help making sure the actual files are in the proper places. 

Hello there, Is there any way to automatically enable Location Services for non-admin users? I know it is currently not possible to set up a PPPC, so I tried some scripts to enable this feature. For example:   #!/bin/bash #set -x ########################################################################################## ## ## Script to enable automatically Location Services on Mac ## ########################################################################################## ## Define variables location_enabled=$(sudo -u "_locationd" defaults -currentHost read "/var/db/locationd/Library/Preferences/ByHost/com.apple.locationd" LocationServicesEnabled) ## Check if location services is enabled. If so, we will terminate this script immediately. Otherwise, we will enable it. echo " $(date) | Checking if this macOS-device has Location Services enabled or not..." if [[ "$location_enabled" = "1" ]]; then echo " $(date) | Location Services are already enabled" exit 0 else ech

Hi all,  We have quite a weird recurring issue with 3 mac devices. FileVault is set to enable via a configuration profile from UIE//ADE and this has been working good since we introduced Jamf. We are however having issues where the secure tokens assigned to these users are being removed? I was wondering if this is something that anyone else has seen? The accounts a mobile accounts from AD. All of the mobile accounts on the devices are struggling. The workaround currently is to sign in with the local account that was created for support (has securetoken key) and then log out. Falling short of disabling FileVault for these devices, is there anything else any one can think of? Thanks in advance!

Hello,I know this is probably not the best place to ask that question but as it’s about the beta forums (which are under NDA), I’m asking it in one of the beta forums. With the new Jamf Nation forum, there’s no way to find a link to all the beta forums for which we are a member like we could with the previous version.Do you plan to change this? It makes it hard to find our way back to one of the beta forums because of that. For example, I had some pending topics on the Self Service+ forum before the migration and it’s impossible for me to find them again to check if there has been answers posted.

My Google-Fu is failing me ... How can I enable the preference below from Terminal?