I am testing no-touch app installs and configuration with DEP Mac devices in JAMF.I have a DEP Mac that I registered with JAMF and initially the device info did note that YES it was enrolled via DEP. After testing many settings I wiped the MAC and deleted the entry in JAMF so it can be configured as a new machine. However, thereafter, in the JAMF computer info, the info states that NO it was not enrolled via DEP. The thing is I have a smart group to add devices enrolled via DEP so now this workstation cant be added and the policies i have created that are tied to the smart group do not apply to this machine.What is the trick to get JAMF to recognize that this mac was enrolled via DEP?I also have one error come up: Command requires DEP enrollment: UserList <MDMClientError:74>Thanks!

Does anyone know if and when Okta will be added as a Cloud Identity Provider in Jamf Pro? 

Been searching around in integration, company portal, and azure documentation but the specific item I am trying to figure out is when it prompts for Admin elevation, is it possible to configure to use an Admin group from Azure AD to use Azure AD Admin Credentials? That way we aren't using a local account or logging into an Admin account each time. Similarly as we would do with UAC on a Windows device. Similarly if you were AD bound with an on prem, you could designate an Admin group so could use your credentials. 

Hey Everyone,I'm looking to make an app available for employee's to use when their disk is getting full and to help them easily identify what is taking up space. I see a lot of people on the internet suggesting OmniSweeper or DiskX. I'm used to using TreeSize on PC, and that works really well. There is a macOS version, paid version but for something this lightweight I really don't want to shell out cash for something like this. I'm wondering what all of you use 😁. Edit: I suppose the cleaning portion is not 100% necessary, more so the ability to have visibility what is taking up all the space. 

Is there a way to automatically enable location services for the Jamf Connect app?

Hi, someone is selling Mac book pro in fb marketplace and the price is very reasonable and in my price range. Seller added a note saying that the device is jamf locked. I really don’t know what jamf means and Is it okay to buy the jamf locked Mac and is there away to unlock the Mac?

I was able to do the pre-requisite for Falcon, The install appears to be fine however the script to license doesn't appear to be working and i know why i use a script from the older version and i guess the structure has changed does anyone have the license script for falcon Here is the log detailsScript result: Executing Policy Install CrowdStike Falcon SensorDownloading FalconSensorMacOS.MaverickGyr.pkg...Downloading https://use1-jcds.services.jamfcloud.com//download/0e4976be1fe242abb3ce80e8556253bd/FalconSensorMacOS.MaverickGyr.pkg?token=cdf519ed75c141bea4937d44500440715ar4dxxmrcbdr8m9y5e95veg10tvlnij...Verifying package integrity...Installing FalconSensorMacOS.MaverickGyr.pkg...Successfully installed FalconSensorMacOS.MaverickGyr.pkg.Running script License Falcon...Script exit code: 0Script result: /Library/Application Support/JAMF/tmp/License Falcon: line 2: /Library/CS/falconctl: No such file or directory

Is it possible to use the API to install a configuration profile on to a device? We have a network profile that has to be manually installed by our techs as they're setting up the machines. If I can run a policy that has a script that runs an API call to install it that would cut down on some workload. The profile is scoped to domain membership of the device, and it can't be an automatic install since right now the AD cert inside the profile only lasts 1 year and we need to let techs remove it in Self Service and reinstall it to get a new one every year (don't get me started on this, this is being worked on already). I looked at /v1/mdm/commands but got "[ ]" returned when I ran it. And /v2/mdm/commands gives me a 400 error.

Just ran into this for the first time when trying to boot an M1 Pro into Recovery mode-- laptop was just reset using "Erase all content and settings" and has macOS 13.2.1 installed. I was intending to update the macOS to the latest by reinstalling the operating system from the Recovery console-- but alas, I ran into this "Recovery lock" blocker for the first time. So, with a little research, I find that the password should be cached in Jamf Pro, and I look it up-- a freaking 39-character password??? And when you type it in slowly on the computer in question, it doesn't show up as you type. Is this all the default behavior Apple has created? What a fricken pain in the butt.I don't see the need for this overbearing security roadblock. All my users are local admins and living remote, and in eight years of managing Macs with Jamf, I have not regretted that once. Everyone's remote now, and they need to be able to do some troubleshooting, Jamf Pro helps us keep the drives encrypted, no auto-

Hello,We would like to enable FileVault when preparing our Macs, during the enrollment prestage.We would like to know the best way to do this knowing that:- We have a support team that pre-configures the computers.- During the enrollment of the computers, a management account is automatically created with a random password and a local administrator account.- During enrollment, Jamf Connect is installed.- Once the computer is enrolled, our support team logs in to the local admin account to install applications and do some different settings according to the targets.- Once finished, the end user will come to pick up his computer or the computer will be sent to the user.Today, we are beginning to deploy Filevault through a configuration profile with encryption at logout.Thank you for your help.

Hi everyone, I was looking at the various Jamf training & certs, and the X00 certs are geared for Jamf Pro, and the X70 certs are mainly security/Jamf Protect. Are there any training/certs for Jamf School or Connect?

Head of security has asked me to investigate whether its possible to restrict the use of usb keys and firewire drives on company macs. Anyone got any ideas or had any exposure in this area? Of course can't fully disable them because of keyboards & mice (saw a script for this). I'm assuming some sort of 3rd party product in the end might be the best solution.

Hello, I'm unnable to use the automatic login after filevault (FDEautologin). Every time I reboot, the user as to authenticate twice, once for filevault and once for jamf connect. I know it use to work in previous version of connect we had installed. Though today I cant seem to understand why it's not working. Does the "Require Network Authhentication" needs to be disable for this to work ? As this part of the documentation suggests.But then it's seems rather stupid to have jamf connect and Okta in order to secure the user's connection, and you end up disabling the network connection.... What am I missing here ?

I'm trying to disable "Prevent Cross-Site Tracking" in Safari for a group of iOS student iPads and cannot find the setting in configuration profiles.  Apologies if it's under my nose.

Hi,I would like to know if anybody knows how to hide the "Settings" app on Apple TV using Jamf Now or if it is possible to do so with this licence.Thanks alot! 

Hello,In using Configurator 2.5 to enroll devices in our DEP I encountered the below error on some of our iPads: An unexpected error has occurred with “iPad”. Provisional Enrollment failed.The cloud configuration server is unavailable or busy. [MCCloudConfigErrorDomain – 0x80EF (33007)] I called AppleCare Enterprise. They checked the devices that I was trying to add and indicated they are or were enrolled in our Parent School District DEP. This prevented the iPads from being added to any other DEP. Even if the devices were removed from their DEP they cannot be added to a new DEP. Sharing in case anyone else receives this error. CORRECTION - The person I initially spoke to at Apple Care Enter price was wrong.I was able to have our parent district go into Apple School Manager, input the serial number and choose "Release Devices." I am now able to add this to our DEP! It basically translates as : "This device is not eligible to add to your Company's DEP"

This may not be the place, but I saw the Jamf 200 post and I figured “what the hell?” I found out today they I too earned the Jamf 200 certificate and am super excited as my first experience with Jamf started less than 6 month ago. My question is…can anyone provide suggestions on what I should be proficient in before taking the 300 level course. Is there any go to Bash scripting classes or something else that will facilitate a passing 300 grade? Thank you in advance.

Hi,Curious for recommendations for our fleet of ~50 Mac devices.We're currently using Jamf Now which is great for enforcing basic security policies, but we are staring to outgrow it. Specifically in terms of what we are looking for:Support for Apple VPP. We are using that now via. Jamf, I noticed Fleetsmith surprisingly does not support this - this is probably a dealbreaker unless there are workarounds?Better security features, including ability to automate/enforce OS and software updates, logging/alerting on security events (authentication etc.). We are already doing malware detection so that is not necessary.Ability to deploy custom packages, scripts & resources (fonts come to mind here) as necessary.Reporting/Alerting/Automation - we don't have an IT team, I'd love a simplified view of which machines are in compliance and which need follow-ups, in addition to anything else which makes administration easier. Any integration with email/slack for messaging users would be a positive

I am using jamf pro to push a policy that will install new printers to users laptop. My question is for execution frequency does it matter which one i choose. What is the difference between once per computer and once everyday or once a week? 

We have been using Jamf Connect for a couple years. It is connected to Okta for SSO login.We recently got Apple Business Manager and are starting down the path for Intune BYOD for iOS devices. We want to turn on federated authentication to our Azure AD for managed Apple ID's.Just want to double check this would have no effect on Jamf Connect. I am 99% sure it would not since Jamf Connect points to Okta only.

I've been asked to sit in on Tech interviews for an open associate engineer position (first time sitting on that side of the table).  They will be focused on our mac environment.  Looking for suggestions on questions to ask.

When creating a Jamf Pro login account in the console, there is a need for a feature that allows us to set a time period for credential expiration

Hello,We had McAfee/Trellix Firewall installed on all of our MacOS computers.We have to quickly uninstall it but during Firewall uninstall process, a prompt for admin username and pass is showing to uninstall the extension system.But none of our users is administrator and it is just not possible to go on more than 1600 computers for that.Do you know how it is possible to uninstall completely and silently?Thank you for your help

Could you please provide information on which OS builds are considered safe to use for BIG SUR, Monterey, and Ventura?

Hello,I'm pretty sure one of you will know this. I stumbled upon a script left by the previous administrator in our Jamf instance. It's a script to name machines. The naming convention uses Building + Laptop or Workstation + Last 7 digits of serial. For example, a laptop in the San Francisco building should be named like this: SFOMLP-xxxxxxx. A workstation would be named SFOMWS-xxxxxxx. Everything works well except the part where it determines whether it's a laptop or a workstation. That part of the script looks like this:# Determine if portable or desktopcomptype=$(/usr/sbin/system_profiler SPBluetoothDataType | awk '/Complete/ { print $NF }')if [[ $comptype == 'Portable' ]];then base="MLP"elsebase="MWS"The problem is that it names everything with the base MWS, which suggests to me that the comptype variable needs to be edited because it's not grabbing the correct info from the system. Perhaps that line to grab info from System Profiler is no longer correct (?).  Any in