Am working on a project to migrate to Blueprints in Jamf Pro as much as I can and something I’m finding exceptionally frustrating is how to plan for future management of Apple Intelligence. We disable it by default for a host of privacy/protection reasons, but everywhere I look I see that the current tools will be deprecated (or were with 26.4) and there’s zero guidance on how to manage this going forward.Currently resorting to some Custom Settings payloads but am under the impression this will soon also not work after 27.0’s release. Couldn’t find anything searching the boards, but would love if I could get clarification from the community on if I’m correct or not in my concern or where to look for future-proofing.

We set our users to be Standard users on their Macs, and which prevents them from being able to delete Wi-Fi SSIDs. Sometimes, we've needed to allow them to do so, so we have a script in Self Service that will delete a known SSID when run.#!/bin/sh ## Get the wireless port ID WirelessPort=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $NF}') ## Run a SSID removal if its present networksetup -removepreferredwirelessnetwork $WirelessPort "NAMEOFTHESSID" 2>/dev/nullBut we've run into a situation where a work-from-home user wants to delete an SSID from their home network, etc. I was wondering if there's a way to a have a script that would allow the user to choose from existing "preferred wireless networks" SSIDs and choose which one to delete? That way, we could just have one "Remove Wi-Fi Networks" item in Self Service, and users could remove whichever one they want.

  Your Mac is Ready for FileVaultFileVault keeps your Mac safe by encrypting your data andprotecting it with the password you use to log in. If youforget your password, you can use your Recovery Key toreset it.  

Teachers have been using Apple Classroom to lock iPads if students are misbehaving on them. However, the students have found that if they restart their iPad, the lock clears and they can access it again. Wondering if anyone knows of any other ways for teachers to be able to lock their student’s iPads that doesn’t just clear if a student restarts it. After some testing, I found that if I put it in Lost Mode, that works, but the problem with that is the teachers would need to tell me to do it. I also considered putting a passcode on the device, but the teacher would need to unlock the device for these students each time they use it, and if a student gets locked out, I could see them trying to guess the password too many times and getting locked out for a long period of time. I am looking for tools other than Apple Classroom that teachers could have access to, or any other ideas for how to lock a student out of an iPad and keep them locked until the teacher clears the lock. 

To install Creative Cloud at my company, end users are directed to the Adobe Creative Cloud website (https://www.adobe.com/creativecloud/desktop-app.html). Every two weeks I get a report from our Security team listing device vulnerabilities. There's frequently a fair number of devices that need one or more Creative Cloud apps updated. I started emailing users individually, reminding them to update their Creative Cloud apps. Wondering if there's a better way, because emailing users and following up when they don't respond is too manual and too time-consuming. Curious how other admins approach this.

Hi, I want to deploy an initial default Dock layout after enrollment is completed, where the end user can later change it to whatever suits them.I’ve heard of multiple methods, such as using Dock items in Jamf Pro settings, scripts, Outset with docklib, and dockutil. I was wondering what the easiest and most hassle-free approach would be as an MDM administrator. Thanks in advance.

We are so excited to have our first in-person meetup for the KC Mac Admin's group for 2026! The event will take place at the WeWork Lightwell Location just off of 11th and Main. We have a very exciting agenda for our meet up. Food and Drinks will be Provided! (Please reach out to me, chris.zimmerman@jamf.com, if you have any food allergies we should be aware of!) The Agenda for our evening is as follows: Introductions / Food and Drinks“Let’s Talk about Apple @ Work” - Todd Thurman, Children’s Mercy

We have an iPad that switched on after 2 months now it has an expired certificate I cannot renew. (See the attached images)This iPad is connected to the wifi but it doesn't communicate with the JAMF server all the commands are in pending status.When I check the "  JSS Built-in Certificate Authority " in the server it's expires in 2033Can anyone help regarding this issue what should I do?      When I open the iPad from the JAMF server This is what I can see on the device When I got to the PKI certificate and checked the certificate expired in 2033 Most importantly self-service is not working       

Hi, I am running a  vendor bash script from self service as part of a remediation effort. As part of the script there is a device shutdown. This happens before the device feeds back policy logs so if it fails I cant see why. Would anyone know if sh scripts and their results get logged automatically somewhere or if there is a simple command to get them to do so? Alternatively presumably I could remove the reboot from the script and have the JAMF policy do that?

How to do we stop these notifications from popping up? Staff are receiving these throughout the day and it’s very annoying and disruptive. MB Air M2 and OS is 15.5.0 or later. Is there a config profile or settings to adjust in Jamf?

We've recently been trying to get users to update passwords more regularly and with that of course, is keychain issues. I was trying to create a script to remove local wifi connections and server connections so when they accessed them, they could just recreate it by typing in their password. I've been struggling with this for a couple of days and had success locally, but not when deployed, and now I've broken it completely again.#!/bin/bashsecurity delete-internet-password -l "cwinprint" ~/Library/Keychains/login.keychainsecurity delete-internet-password -l "pwinfile" ~/Library/Keychains/login.keychainsecurity delete-internet-password -l "cwinfile" ~/Library/Keychains/login.keychainsecurity delete-internet-password -l "fwinfile" ~/Library/Keychains/login.keychainsecurity delete-generic-password -l "IS-EMP" -s com.apple.network.eap.user.item.wlan.ssid.IS-EMPsecurity delete-generic-password -l "CO-EMP" -s com.apple.network.eap.user.item.wlan.ssid.CO-EMPLooking to use this as a script to

By using Jamf Pro to revoke the administrator privileges of users, we are now facing a problem. Applications like Cusros have a very high update frequency. However, we don't want to simply and brutally grant the users the administrator privileges and let them complete the automatic update by clicking once in the Self Service. Do you have any suggestions on how to solve this?

Is it possible to deploy the OneDrive plist config file via jamf or does it have to be packaged in composer so it installs in the correct location?

Hi All, We are running JAMF Pro on the local server / on prem "Windows Server" (not the cloud version). I want to use the Patch management to update the Apps (Chrome, Firefox VLC Office apps etc..), macOS etc.. I'm new to this is there any way I can get some help to set up this? Article videos etc..

I am trying to create a cloud distribution point using Amazon S3. The JSS returns the error: Unable to create distribution for this bucket But when I check my buckets there is a bucket similar to jamf235a039ede4741fe831b0e31287c6c7d created. Anyone have any luck with this?Thanks!

Hi, Im currently working on setting up Self Service+ in time for the deadline of March 2026. We currently have over 400 machines with Self Service instaleld and looking to deploy this to new machine in batches first for testing. Ive currently been testing on my self and manually installed the application and Ive had some issues with the Keychain popping up, which I saw was an issue on past threads. What would be the best way to go around this in a production environment? 

How can I manage the new* AI Controlswithin Firefox with a Configuration Profile?Is there a way to configure it via a JSON?Thanks in advance!

I have successfully setup PlatformSSO for EntraID authentication and after running it for a while I have some oddities.If the token expires Safari will offer passkey as an option for logging into EntraID federated applications.  Our conditional access policies allow passkeys, MFA, Strong Auth (FIDO etc).  Once the login is complete the Mac will passthrough creds for any access in any browser.If the token has expired then in non-Safari (Edge, Chrome and Firefox) the user is only offerred password as the option to login unless they have a passkey in Authenticator or an external FIDO token registered in EntraID (Yubikey etc).If you go to User/Groups and press the Authenticate button in the user account then the token is refreshed without any user interaction.Trying to work out if I’ve missed something in the config profile or if there is another issue.Anyone else seen similar and worked out a way to resolve so passkey/biometrics is offered across all browsers rather than just Safari?

I asked this same question on the Clearpass forum, in case there are more people there that are doing similar things, but I'm hoping for someone with the conceptual understanding to just give me a nudge in the right direction regarding this setup. We have been using 802.1x with Machine certificates issued by AD, with ClearPass and Windows machines for a couple years now. I understand the process that the windows machine joins the domain, get's a certificate, and then our clearpass servers are domain joined and can authenticate the machine with Active Directory using some of our various AD servers. All of that works well, and makes sense to me. Now we're extending it to macbooks and adding Jamf, so that we can also set up certificates on the macbooks (they will not be domain joined) via SCEP/NDES integrated with our windows CA, with the goal of them also doing 802.1x with EAP-TLS. So far, we have the SCEP process working fine, and the macbooks obtain their certificates from our CA via S

Is this supposed to happen?  Our automatic upgrading of the Self Service+ app has changed back to /Applications/Self Service.app (was /Applications/Self Service+.app).  Also is prompting for keychain access since, well, the application name changed.  Anybody else?

Hello all.I am getting this error in my notifications when I login to Jamf Pro.  I cannot seem to determine what is wrong with this, and it appears that our Jamf Connect configuration is working properly. Thanks in advance.-Pat 

Trying to use Jamf’s App Installer feature in Jamf School.Issue:  Apps set to on-demand do not show in the Jamf Teacher App.Hoping my setup is incorrect as this post referencing a similar issue is more than two years old. I’d happily use Self Service+ but the guidance even calls out the fact that on-demand content will continue to be through Jamf Teacher.Using Self Service+ would solve the Keychain messages our users are getting since we sitting at stuck at jamf connect 2.45. Solving to issue at once would be great, but my reading of the documentation tells me apps download wouldn’t be available in Self Service+ Will any other Self Service+ features work if I don't have Jamf Pro? Self Service+ is considered a modular application meaning only items that are configured will display for end users. At this time for Jamf School customers that also use Jamf Protect will have the Security dashboard in addition to the Account management dashboard. Access to on-demand content will continue to b

Hey guys, I'm in the process of testing Jamf Connect, I noticed this as a sign-in option Would it be possible to remove it since no one will use it to sign in to their Mac!!? I couldn't find any related settings in our Azure AD. Thanks in advance 

How can I disable the Help Apple Improve Search Item in the Spotlight Section of the System Settings?I can't find anything in Configuration Profiles and didn't find something related in com.apple.Spotlight.plist in /Library/Preferences/ or ~/Library/Preferences/.

Hello all,I just started with an existing system that isn’t really documented.  This means I have to do a lot of jumping around to determine what something does, where it applies, and even if it is working.  I want to create some good documentation for this, but I’m don’t know what the best method for doing this would be.Thank You in advance,-Pat