we have been deploying new M1 macbook air machines since July.  we changed our deployment workflow this year to use a workflow in MDS to deploy the os (big sur) and packages (instead of pushing packages/policies over the air through JAMF).  we skip the setup assistant and enroll into mdm through user enrollment.we haven't had any issues except that recently our users started getting the device enrollment notification saying that our organization can automatically configure their mac... even though they have the mdm profile installed and we're actively managing machines through JAMF. has something changed in big sur where this is now expected behavior?  i should hope not... any insight would be appreciated. 

Hello everyone,I am wondering what they proper way is to set up the following....I'd like to allow folks to login with their personal Apple IDs to use iMessage and to be able to connect their AirPods to their MacOS computers but then restrict everything else in iCloud (iCloud Photos, iCloud Drive, Find My, etc.). I see where you can apply iCloud restrictions via Configuration Profile but not sure if applying these also conflict with allowing the aforementioned items I'd like to leave open. Thanks in advance.

Hey Everyone, I know how secure tokens work, I know how to give them out. I have a particular question about having them automatically enabled without having to log into the account manually on each machine. I have it enabled so that every account can have a secure token, when they login. The issue I'm having, is my Local Administrator account.I have my management account as JAMFADMIN, and my local administrator is just "administrator". That's the account I use to reimage machines and do maintenance/updates. As we know, M1 machines need to have the account doing updates/OS installs to have a secure token. I have this account being made on Enrollment, so it should get one. The account is on the machine, but if I do a remote command to do an update, the secure token isn't enabled until I physically go to the computer and log into the account. Then it's available. Does anyone know how to make this token appear, without logging in?If anyone needs any other information, pleas

Hi Folks,I need some assistance. I have been trying to onboard M1/M2 through prestage enrolment and it's failing due to rosetta2 not being available as some apps not getting installed properly. Can anyone suggest to me step by step process on how to install rosetta2 on those macs before any other application?  Thanks,Rish

Maximum of how many device we can enroll into Jamf now?

Hi Guys im config the jamf radar and i need to add some websites to exception group we blocked for all users how can able do that 

I've been having some trouble updating the iMac's to the most recent macOS patch 13.6.2 with JAMF. I usually restart the computers just before I send the remote command and I do see the series of commands queueing and completing in the computers history but then the update never goes through. I did this for around 16 of our computers that we have and its the same problem for all of them and they just never get updated. Any solution?

We are using Jamf Device Compliance with InTune.Following this tech paper we have it working fairly well. Technical Paper: Integrating with Microsoft Intune to Enforce Compliance on Mac Computers Managed by Jamf Pro 10.43.0 or LaterWhen the end user goes through computer registration and JamfAAD opens they are prompted to "Always Allow" "Microsoft Workplace Join Key". This is expected and documented here. (Although it would be great to have a smoother workflow)Our issue is the certificate in the login keychain for Device Compliance is not trusted for some reason. (See attached image)The cert seems to be issued by "MS-Organization-Access" I don't have that CA and our Azure folks don't seem to know about it either.Thoughts?Eric   

Hello can someone please send me pictures of how your erase-install script is set up inside of Jamf Pro. I can get the script to execute locally on the test machine, but when I try to add it via self service it will not execute.. I have the Package downloaded and added to a Policy as well as the script attached and the Execute command of: /Library/Management/erase-install/erase-install.sh --update --reinstall --cleanup-after-use --check-power ...I have tried it with just the package, I have tried it with the script and the package, and the script alone and still no success. I have read the Jamf Pro section of the script  GitHub about 30 times and still can't find a solution trying to execute it on a computer with Sonoma 14. via the self service... the icon will show but when click nothing happens If you have it running Properly I would appreciate if I could get pictures because Im stumped. 

I have a preboot script that I install on my Macs to initiate some Jamf policies but it requires Rosetta 2 to be installed prior. I usually pre-install Rosetta with "softwareupdate --install-rosetta --agree-to-license" but with 13.5, you now get this error: "Package Authoring Error: 032-69584: Package reference com.apple.pkg.RosettaUpdateAuto is missing installKBytes attribute" and my preboot script package fails to install.Has anyone else experienced this with macOS 13.5? 

I'm trying to create an extension attribute to report back ipv6 addresses but not having much luck... So far I got this... Anybody had success with doing something similar?

We have an issue where an Extension Attribute value is becoming hex code in a Configuration Profile. To give a bit more background, we use Cisco Umbrella for web filtering. In order to identify the user to Umbrella, we use a Configuration Profile which contains an Extension Attribute which is mapped to userPrincipalName from AzureAD. For most of our end users, this populates correctly in the format "username@company.com". However, in a few cases it becomes "username@company.com". "@" is the unicode hex code for "@". Looking at the Computer itself in Jamf correctly displays "@". Does anyone have any suggestions? Is this related to an old bug of PI-006195?

Hey all, We are in a one-to-one for Macs in our district and have given instructions to parent on how to set up screen time on their children's MacBook Air's.  Our problem comes when a parent doesnt remove the screen time lock during testing.  Sometimes the screen time filtering gets in the way of testing apps and websites.   So we figured out a solution.  Log into an admin account on the students computer, go to System Settings/Users and Groups and click the i button for the students user account and click delete account, then choose "Dont Change the Home Folder". Now you must navigate to the user folder and remove the word "(deleted)" from the users folder.   Once complete log out and have the user log back in.  Screen time should now be disabled. This helps us deal with testing for specific students who need this feature disabled for tests.

I am having trouble using Jamf Pro to run the SUPERMAN script. It works for minor updates of 14.0 but not working on 13.6. Any Suggestions? 

Is there a way to skip the "Choose your walllpaper setting" in macOS Sonoma when a new user logs in? We have set a standard desktop background that we want to use across all our computers.

Hi,I spoke with Apple and they believe this is a Jamf issue. In my IT team, we have received since yesterday at least 5-10 users complaining that their memory is consistently being used up within approximately 20 minutes of restarting. This is something that they have to keep doing throughout the day to use the computer before it warns again to start closing apps due to low Application Memory. Even without anything open, the memory pressure starts to get up into the yellow.There are a few processes we're seeing in Activity Monitor that spike into the GBs of memory used: ManagedClient, mdmclient, and MCXCompositor (this last one fluctuates though between a "normal" amount to then about 7GB for about 10 minutes, then back down).Has anyone else seen this recently? 

Hi everyone, I'm having a somewhat urgent issue with 46 instructor desktop machines at our college. Somehow a configuration profile that was scoped to these machines created another random profile called 'General' that keeps replicating over and over, reaching 3900 unique ID installations of the same profile name on each of the desktops. I've never seen this before, and other than removing the scope I haven't been able to stop it trying to create more and more General profiles. It's causing users not to be able to log in, and reboots are taking 15-20 minutes even on new M2 Mac desktops. It's happening on Monterey and Ventura OS, Intel and Silicon. Anyone seen this before? Hoping I won't have to rebuild each of these machines. 

This is sort of in regards to the issue of being unable to upgrade Shared iPads seemlessly to iPadOS 17 as per https://support.apple.com/en-ca/105058. I'm looking into how iPads by default receive and apply updates. I understand there is a restriction profile that can be applied to defer software updates for up to 90 days according to https://support.apple.com/en-ca/guide/deployment/depd30715cbb/web.  The way I read it is that the 90 days takes effect from when the software update, in this case iPadOS 17, is released and not from when the deferral policy is pushed out. iPadOS 17 was released September 18, 2023 so 90 days from that date would be December 17, 2023.  So I'm wondering what's going to happen in regards to our Shared iPads updating.  After December 17, 2023 will iPads automatically start updating on their own?  What will happen if I apply a deferral restriction configuration profile?  Will it even make a difference? We are sitting down this coming We

 Why or how does the “Clear Parent Restriction” work?We have found that as soon as the function is triggered via Jamf Portal, the student iPad loses the set restrictions of the parent app, but shortly afterwards the set restrictions of the parent app on the iPad apply again.And then you ask yourself, why doesn't the information arrive on the parent app that the "Clear Parent Restriction" command has now been triggered via Jamf?This means that the restrictions of the parent app always intervene.Is this a bug or was it not thought through? Or thought differently?What experiences have you done? Would that be a feature request?CheersPeter

I would like to add URL's to self service to be on the left hand corner of the page when a user opens self service is there any way I can do this on Casper? Thanks!!Nicholas

Hello everyone! I can't seem to find information on the subject and I would like to better understand mobile devices that are Personally Owned versus Institutionally Owned. Thank you all.

Hello,can someone confirm that the "web content filter" is broken in IOS 16.4.1?Only Blacklist seems to work.(My testing device worked fine on iOS 16.x before the update)Edit: Device = iPad 8. Gen 128G/Wifi/cellthanks,-Sebastian

I need to remove a lot of scripts from my Jamf Pro server. I inherited this Jamf Pro server from the person who held my position before. He didn't leave behind any documentation. To speed up the process I need to find out what scripts are actually in use. I want to remove all of the unused scripts. I will save them somewhere in case any of them are needed later. I looked around for some ideas but none that I could find posted here worked. Does anyone have a good way of doing this?

Having a issue with scripts not saving when clicking the save button. Basically the button does nothing (leaving the page and Jamf asks if I really want to leave the page so I know its been edited) I have tried firefox, chrome, safari. Not sure what's going since nothing has changed on our end and everything has been working fine for months,

Hey folks, this is my first post here and we have Jamf Pro since 2 weeks. We have a customized Teamviewerqs.pkg which is deployed to all computers. At the first start the window with Eula prompted. Is there a way to block it or accept it with a config in background? Cheers