Full disclosure - we're only just getting started with JAMF Pro, so apologies if I've missed something obvious.We want to manage a small fleet of iPads, configured to be in Shared Mode using guest account only (so no data is retained between sessions - important consideration for us).I want to add a webclip / URL to the key web application that these will be used for, and from what I read here (https://docs.jamf.com/10.24.1/jamf-pro/release-notes/Bug_Fixes_and_Enhancements.html) this should now be possible. However, I still get an error in the management console for the device stating "The payload type “com.apple.webClip.managed” is not permitted to be installed for the system in multi-user mode.". Wondering if I'm missing something obvious?Secondly, I have the device smart group supposed to be setting a wallpaper / lock screen on the device, but this doesn't appear to take. The group says the wallpaper command was 'Acknowledged', but it stays on the default. I DO have a setting a

Does anyone have any guides within the past 3 years for getting the dev environment setup for jamf pro? Everything i find online is from 2016-18 and rather outdated. I want to test the LAPS but dont want to enable it in prod incase pulling the password doesnt work. 

Hi All,I need to deploy MS Defender using Jamf pro to all managed macOS. I am following the instruction mentioned by Microsoft on Set up the Microsoft Defender for Endpoint on macOS policies in Jamf Pro | Microsoft Learn. But I am not able to navigate to Settings > Endpoints > Onboarding. I don't see onboarding option. I do have Global Admin access in Azure. Do I need to get any other access to access the above mentioned path please?  Thanks. 

I'm trying to deploy some apps to a batch of macOS devices using Jamf Pro, but every time I initiate the deployment, I receive an error message with code 432. Has anyone else encountered this error before, specifically error code 432? Please give some guidance to solve my problem.

I've got a device that shows not having checked in since 8/21 but the end user has been using it daily. She went to use her phone this morning and it said iPhone Unavailable, check back in 15 minutes. No love after 15. Remote commands are not getting to the device and she cannot use her pin to unlock it bc of said message. Hard shutdown and restart did not help. Any thoughts?DeclarativeManagementPending

Hi Nation, I hope you are all well.I am trying to set up Intune Integration for Compliance, however every article I seem to find is around Conditional Access which is legacy, I can not find anything that details guidance for Device Compliance and the Intune config. Does anyone have a good link ? ThanksBob - Reno

Bear with me on this, but I am considering allowing 6 digit number passcode for macOS login.  My threat assessment is similar to that of an iPhone, that has a 4 digit passcode protecting the device, which essentially has access to all the same company information the Mac is going to have.  In both cases, the attack vector requires physical access to the device and then a considerable amount of number guessing, but not before locking the device out after 10 wrong guesses. Our devices will also have Password Sync installed, so users who wish to configure that certainly can, and then use their company password for login. Our Macs are all ABM -> MDM enrolled, purchased through official channels, we don't have Active Directory.  We do use Okta for but as i mentioned and I have configured Password Sync with Okta and as mentioned users can configure Password Sync if they wish. Am i missing anything here, that should require Mac login passwords to be long and c

Has anyone successfully used the SecureW2 SCEP setup with Jamf on macOS AND iOS?I am having an issue with our iOS devices not connecting to the network. They get the profile payload that includes the cert, Wi-Fi profile, and SCEP settings (the same settings as on the macOS devices) and the iOS device starts to connect but never fully connects and just cycles through the connection process over and over. The macOS devices connect fine a few minutes after they get the cert.It gets the cert from SecureW2, so that part is working, but it just never actually connects to the network. I followed their, somewhat out-of-date, instructions found here:Deploy Client Certificates via SCEP to Jamf Managed Devices (securew2.com) Anyone else had issues with the setup for iOS devices?

Hello guys, I have a bunch of test macs which I use for testing so I'm constantly re-imaging them and enrolling them to Jamf. I want to know if there is a way that I can automate the removal of the Jamf record without having to in Jamf gui web interface and looking for the record for the mac and then deleting it.   

Hello Jamf community, We have multiple PreStage Enrollment (1 for each lab + 1 for employee laptops). Other than each one being used as a criteria to place devices into Smart Computer Groups, there is no reason for these to exist as they all have the same settings anyway. So I am attempting to simplify this by deleting all existing PSE and creating a new one (and checking the box for Automatically assign new devices). We'll then use PO number as criteria for Smart Computer Groups or just manually assign each device to a Static Computer Group. My question is: what effect will it have on existing enrolled devices? If any of the existing devices need to be re-provisioned (e.g. a Macbook being assigned from a leaving staff to new staff), do we have to do anything special? Thanks for any advice on the matter.

Hello, I am setting up configurations profiles that now I want to start adding in some scoping to using based on user logged in. I see when I go to exclusions it shows the options for LDAP Users, LDAP Groups. However if I go to select specific scope targets (not exclusion) for tabs I don't see LDAP Users or LDAP groups. Is this by design or is there something I can do get that to work? Thank You

I’m wondering if there’s a way to enable lost mode on a group of iPads in JAMF School.  Using the admin interface you have to click on each iPad one at a time and then enable lost mode.  We have a number of iPads left over from last school year that need to be retired this year and I want to disable them with a message to return them to our Helpdesk staff.  I figure the best way to do this would be to enable Lost Mode.  Is there a bulk way to do this?  Maybe with an API?  I couldn't find anything about this with a casual search.Or is there any workflows that would make this more efficient?

Hi all,We are trying to upload .csv files into Apple School Manager, and we keep getting this error:[OK] unzipped file: classes.csv.[OK] unzipped file: courses.csv.[OK] unzipped file: locations.csv.[OK] unzipped file: rosters.csv.[OK] unzipped file: staff.csv.[OK] unzipped file: students.csv.[ERROR] rosters.csv: CSV file is missing some headers, or the headers are not correctly formatted.Does anyone have an example of what a correct rosters.CSV file should look like so I can compare with mine?  My headers are in all caps ... would this make a difference?Thanks for your help.

https://support.google.com/chrome/a/answer/9301891I've tried the "CloudManagementEnrollmentToken" file placed in the directory through JAMF as described above with no luck. Reinstalled chrome, signed existing users out and back in, but nothing seems to trigger enrollment or show as enrolled within google admin's "managed browsers" The token itself is a simple text string and nothing more. Example value:"37185d02-e055-11e7-80c1-9a214cf093ae" Below is the limited instruction on setting up this feature of chrome/g-suite **Option 1: Use a policyPush the token to your browser as a policy named CloudManagementEnrollmentToken. Setting policies on Mac devices requires the Apple Profile Manager. Option 2: Use a text filePush the token in a text file called CloudManagementEnrollmentToken, under /Library/Google/Chrome/. This file must only contain the token and be encoded as a .txt file, but should not have the .txt filename extension.** Just curious if anyone has had success remotely pushi

Hi Team,I am trying to create a Jamf Pro Classic API Connection in OKTA Workflows. I created a service account in JAMF Pro granted Administrator, Standard user and Full privileges. When I try to test the connection. I am getting HTTP 401 Authorized Error. I am not finding settings to grant access to  "Make sure that your Jamf Pro Classic API account has access to the /JSSResource/activation code endpoint"Appreciate any help or pointer!Thanks,Kalai

Very much a newbie here and not good at writing my own code (I'm very much a copy paste guy when it comes to creating plists etc) - I find that there is no easy way in the JAMF Pro UI to reboot machines in a static group - can anyone give me an easy guide for a policy or config profile that just performs a simple reboot on a machine that I can apply to a static group?

Hi all, This may be a stupid question but I am relatively new to managing computers with Jamf (only 5 managed so far). I have been testing enrolling my test MacBook Pro and unenrolling a few times to make sure everything comes down as we want it. Instead of unenrolling the device I decided to test out the "Remote Wipe" command in Jamf, which worked perfectly. However since reimaging (and reimaging a few times through the normal process, as well as unenrolling and re-enrolling) the Mac and when doing self enrollment or email enrollment I'm being asked to install the QuickAdd package instead of enrolling by installing the CA certificate and Mobile device profile. This only seems to happen on this one computer, if I go to any other Mac it enrolls with the cert and profile. What is causing this one Mac to enroll with the QuickAdd package and is there anyway to configure which way a device enrolls? We did have a an image set up under Settings -> Computer Management ->

HiWe use Jamf Pro. I have lots of items displayed in the dashboard of my account. That seems to make the dashboard very slow. It usually takes more than five seconds to load and display everything. I would like to clear the dashboard and only add a few items to speed it up and make it easier to find relevant information.Is there a way to clear the dashboard without having to go through all the items one by one and uncheck the "Show in Jamf Pro Dashboard" checkbox?Thanks in advance!Manuel Brotz

Below is our current configuration as we are trying to use our External CA to provide Computer and Mobile Device Enrollment. However when the certificate shows on the device, it shows as $COMPUTERNAME. I changed this to $DEVICENAME and get the same result. Additionally, when we remove the subject completely from the External CA configuration, it causes the enrollment to fail with the error "Your profile has expired".As shown we also have SCEP setup for our config profiles and the Subject config is working fine there. Any thoughts are greatly appreciated. This is on Ventura OS 

According to the post below, (can be found at https://it-training.apple.com/tutorials/deployment/dm110 ) Setup Assistant should not let a user advance past the connection to a network screen. It should require a network connection to move on. This is not the case with our laptops. They are purchased through apple and enrolled in ABM. I verified serial numbers are in ABM. Any thought's on how to fix this? We have users not enrolling the latptop and they are never prompted to enroll the laptop later as the post says they should be.  "Prior to macOS 13, users could use Setup Assistant without an internet connection, and accidentally — or intentionally — bypass enrollment in MDM. With macOS 13, users need an internet connection to complete Setup Assistant on organization-owned Mac computers with Apple silicon or an Apple T2 Security Chip. After a Mac with macOS 13 is set up and connected to a network for the first time, it’s acknowledged as owned by an organization (in

My organization is new to Jamf. We are looking to see if Jamf has published documentation for when they will be ready to release updates for iOS 17/ iPadOS 17.Most importantly, are there any changes we need to be aware of so it doesn't break anything in our organization.Secondly, we need to know when Jamf will roll out the changes so we can be prepared. We are already asking our user base to postpone updating so we encounter as few issues as possible on day one.Thanks!

Hello, I create simple launch deamon file to start sh script and all works fine , but I have problems to block this script from disabling in login items. Try few config profiles but every time it didn't work for my script , but works for other apps like Microsoft apps.I see that all signed application have attribute "Embedded Item Identifiers:". My application wasn't sign , it is a problem?  If application isn't signed I can block it ?

Hello everyone, Just a little background: I work in an AD environment that utilizes Xerox MFDs among several others types of printers. I've had success capturing the device with Casper Admin and deploying the printer either through Self Service or some other trigger. The question I have is that our Xerox MFDs by default print in color and historically we've had to go into localhost to set this default option to black and white. Has anyone had experience adding a script to the process so as to set the default option? Thanks!

One of our users have not use her MacBook in little over three months, and the computer has there for been marked as inactive in Jamf.The user has forgotten the password she gave the local administrator account that she created when she first set the machine up, and not the computer is stuck at the login screen, with no network access.I have tried booting into recovery and connecting it to our network, but it is still marked as inactive in Jamf.Is there any way I can get the computer to talk to Jamf again?And is there any way we can recover the users account and data?

Loom is only showing up to version 0.168.1 in the Patch Management definitions, however Loom on the machine that I use to create packages has updated to 0.169.3.  Since 0.169.3 isn't an option in Patch Management I'm unable to associate a new package to update the rest of the machines.  Can someone update the definitions that are available for Loom? Thanks In Advance