Dear Forum Members, I have been getting Sign-in errors for Mac users and I have no clue where to start for the troubleshooting. The configuration on the JAMF side looks solid. We use NoMAD and the error is not occurring at the OS sign-in. Below are the errors I have been getting from AAD Sign-in section on Intune, and they are for the same user. Those errors all point to the JAMF Native MacOS Connector. The user experience is that they are constantly getting prompted to sign in to Microsoft when using O365 Apps on the Mac. The Microsoft Sign-in windows will just stuck on the page saying "Help us keep your device secure" with no errors. The App ID on this page also points to the same MacOS Connector, but Device State shows as: Unregistered. The same Mac device in Intune actually shows up as enrolled and compliant. Does that mean we need to re-register the device with Intune? Thank you all very much! StatusInterruptedSign-in error code50097Device Authentication Required - DeviceId -D

Hi there, I've been sitting with this issue for a couple weeks now with no end in site with support, so I figured I'd ask others. We've just started up our Jamf Pro tenant. When we attempt to enable the Cloud Services Connection and input the Jamf ID email address and password, it throws an error saying "Incorrect Jamf ID email address or password". There's only one user in the tenant, the same admin account that set everything up, and that's the jamf ID address and password I'm using. Support has had me try different test accounts and even reset the tenant, but it hasn't changed anything, and I can't seem to find any record of others having this issue. Has no one else run into this problem? This is holding back our implementation projections in a big way given the slow speed of support's communication.

I have a script that is running a lot of commands starting with su "$currentuser" -cWhen the policy is run locally or via Self Service the script runs as expected.  When I let it run via check-in, all the lines that start with the above command do not run.  Any ideas?

We're having a problem where managed Apps keep reinstalling themselves on our iOS devices.  My understanding is that starting with iOS 14, managed apps could be deleted by end users, but my testing has revealed that iOS 14.0 and iOS 15.0 will reinstall the apps of their own accord.  Looking at Google Sheets as my test example, I have the following set:- Install Automatically/Prompt Users To Install- Automatically Force App Updates- Make App Managed When Possible (greyed out)- Make App Managed if Currently Unmanaged- Allow users to remove app (iOS 14 or later) and in in a Configuration Profile that is assigned to the device, we have - Removing Apps:  Allowed I suppose I can go to the Scope tab for the App and add an exclusion for the device in question to keep it from reinstalling itself, but that doesn't scale.  Where should I look next?  

Hi All,is it possible to withdraw a Quick Actions in the Jamf School?Best Regards and Thanks for a fast answerPeter

What exactly is http://kickstart.apple.com/ ? Googling "Apple kickstart" just gives me ARD results, or the man page.

Hello, So I am trying to get the wallpaper login policy to set the wallpaper, it works on one of my test machines Mac Book Air that running a M1 chip but the iMac that I have thats running a intel i5 chip is not handling the osascript. It errors with this: 33:48: execution error: Finder got an error: AppleEvent handler failed. (-10000)   #!/bin/bash #Create Directory for Custom Image mkdir '/Library/Wallpaper' # Change directories cd '/Library/Wallpaper/' # Download the wallpapercurl -k -Os https://linktowallpaper.com -s cd '../..' currentUser=$(/bin/ls -l /dev/console | /usr/bin/awk '{print $3}') sudo -u "$currentUser" -H osascript -e 'tell application "Finder" to set desktop picture to "/Library/Wallpaper/Background.jpg"'  

We have "imaging" policies set to the root of jamf so all sites have access to them.We are using DEPNotify to manually call these policies. These policies are scoped to a group, but in some areas they do not need a few of the "image" apps to be installed. If I scope the policy for these apps to exclude these groups will it stop the policy from installing even its its manually called using sudo jamf policy -id that DEPNotify uses?

Hello,I am currently attempting to write a script to patch a Mac computer.This is my script:#!/bin/bash todayDate=$(date "+%d.%m.%Y") patchingLogFile=patching_"$todayDate" exec > /tmp/"$patchingLogFile".txt 2>&1 echo "Part 1:0 log file has been created" computerMacOSVersionFirstValue=$( sw_vers -productVersion | /usr/bin/cut -d. -f1 ) macOSVersionUpdate="11.7.2" if [ "$computerMacOSVersionFirstValue" == "11" ] ; then softwareupdate -R --fetch-full-installer --full-installer-version 'macOS $macOSVersionUpdate' 2>&1 else echo "Don't do the update" fi The problem I am getting, is that when I look in the log file, I get this return:Scanning for macOS $macOSVersionUpdate installerInstall failed with error: Update not found But if I run the code:softwareupdate -R --fetch-full-installer --full-installer-version 'macOS 11.7.2' 2>&1Then the computer will update with the intended version.I don't know what I am doing wrong! Can a scripting guru help me plea

I am curious to know how everyone deploys Apple TVs in their environments. I am finally seeing a downside of scoping a user to the Apple TV located in their workspace due to the fact the Apple TV seems to be trying to install applications that are not meant for tvOS, which is piling the failed commands of "App does not support Apple TV devices" a mile high. The user would be scoped an application meant only for iPadOS/iOS and under the Mobile Device App it is set to "Make Available in Self-Service", but still I see these errors. What is the best practice for scoping an Apple TV to a user that also has a iPadOS/iOS device? Do I need to exclude all devices LIKE "Apple TV" from each of my 500 applications? I hope I'm missing something here.

I'm new to Jamf Pro, and I asked our on-boarding solutions expert on some best practices for creating User Groups in Jamf to limit access for our Tier 1 IT Staff, but they were not to helpful. Are there any good tips on what permissions to setup for a least privileged model within Jamf Pro for our IT Staff?Ideally a setup that goes from Tier 1 (least privileged) to Tier 3 (most privileged) in terms of what these users can get to and modify on the Jamf Pro settings side and what harm they can do to devices.  We don't want our Tier 1's to be able to wipe a device for instance.

Since the self service update (updated on my M2 test machine today) my non VPP items in self service are generating false negatives "item failed" errors. Even a simple inventory update will generate a false negative. They execute fine but users will absolutely report these false negatives believing them to be actual negatives.  This doesn't appear to be true for all macs (seems to be fine on my intel) What are my next steps?Thank you 

We have an iPad that is not getting the options that iPhones have to register with Azure ADWhen we add an iphone it immediately gets the option to register with Microsoft within the jamf app on the device. However, we are trying to add an ipad device and it does not get the option to register with Microsoft in the jamf app. I was able to register it with Microsoft through the settings in the Microsoft Authenticator app, however, this is not the normal process and the ipad does show in Azure ad, but its compliance shows as n/a. Because the compliance shows as n/a, we are unable to connect the device to email and other Microsoft apps. Is there something that we are missing? The only thing that we can see causing the problem is that the ipad did not get the option to register with Microsoft from within the jamf app for some reason.

Is there a way via the JSS GUI to find whether you have a username in the system but no assigned Mac?I've only ever been told this can be accomplished with a MySQL search

Is there any functionality to allow a standard Admin password for a supervised iOS device? We have users that forget their self-set passwords on the Supervised devices. However, the Clear Passcode commands are not working because the device is locked and the WiFi/Cellular status is unknown. We need a better solution for this... Devices shouldn't be able to be bricked, even off WiFi. 

I'm planning on taking the JAMF 300 course but before I do I wanted to work on familiarizing myself with scripting. Any good recommendations for a scripting course I can take? Thanks

Team,If, netskope is deployed through Jamf Pro then as an administrator... is it possible to disable it for a while in the new macOS ventura because in Ventura we are not able to find the option to disable this and earlier it was there in macOS Monterey 

Hi all, I’ve recently set up and introduced Jamf Setup and Jamf Reset for use on our shared devices. I currently have Jamf reset set to a soft reset which should log the user out and end SSO session thus logging users out of any pages they signed into. However this doesn’t seem to work, the user is logged out of the JAMF Setup session but remains logged into any apps they signed in on specifically Google applications. I’ve attempted to have these apps uninstall and the reinstall when the user logs out and have also selected the option to prevent chrome saving data but as soon as the app is reinstalled the account is there again. Any ideas what I can do other than hard reset after each user? TIA

Hello! I am very inexperienced with scripting, so tell me if i'm in the wrong place. I want to have a simple script execute the following (at a user level): defaults write com.apple.loginwindow TALLogoutSavesState -bool false I have a few scripts (for mounting network shares) that I run using Outset when the user logs in. I'd like to do the same with this one. Any guide on how to call this command as the user?

Is there a way that we can delete printer that user added? we have a open directory that teacher can pick what printer they want to add. now we have new system that only uses one virtual printer, and we already push that one using LPD. what we want to happen is to remove all printer that they add and only printer one printer will stay the one that we push.

Have apple school manager setup, and trying to deploy iMovie to a test MacOS.  Using Self Service and when the user clicks install it spins then comes back with an error saying "Cannot Reach Jamf Pro Server".  We are cloud hosted, I have tried the machine off the district internet incase a Firewall issue was causing it.  No luck,I am able to deploy a custom package of Chrome from the Jamf Cloud distribution point.  I also have tried xcode also another free app and it still gives me the error of "Cannot Reach Jamf Pro Server"Mac Store Apps do not install 

Can we integrate RSA with Mac for login screen authentication when Jamf Connect is also already deployed?

Hey Folks,Curious if anyone has found a way to automate emails to users based on a Smart Group membership?   Examples of things we’d like to notify users of:Your internal storage is at XX% of capacity, here’s what you can do about itYour laptop hasn’t checked in to Jamf in XX days, please turn it onYour computer hasn’t rebooted in XX days, please reboot Right now, admins are getting emails from Jamf based on criteria we prioritize (eg: ‘storage almost full’), or manually checking Smart Groups once a month, and emailing the users directly.I know you can email group members via VIEW -> ACTION -> SEND EMAIL, but that’s a manual process, and we’d rather automate it. ## I found versions of this feature request on JN, and confirmed with Jamf that it's not currently part of the product in 2023.2016 post: https://community.jamf.com/t5/jamf-pro/alert-system-user-on-smart-group-change/m-p/1416392013 post: https://community.jamf.com/t5/jamf-pro/automated-emails/m-p/10530

Has anyone been able to make a Code42 CrashPlan installer in Composer?  I'm trying to do that for version 10.2.0 of Code42 and it fails.  I notice that there are some Code42-related files that change after the installation is done, so I'm thinking that Composer might not be making an accurate "after" snapshot.  I can give more details if someone wants.  I'm  just wondering if there is anyone who has gotten this to work, and, if so, what they did to get it to work.  Thanks.  --Jeff 

Hello, We have an older version of Sophos in our install package which will not install for any device running M1 or M2 chipsets.  This has been patched by Sophos but I need to get our current Sophos installer updated.  After some research I determined this will be a two step process.  One step is targeting the 27 enrolled devices are are missing Sophos through a configuration profile and a Static Computer Group.  And the second portion is updating the install .pkg.  When I follow the directions from Sophos it says click the 'Filename' file that is a .pkg file and upload, and then do the same with a Manifest File.  After downloading the macOS Sophos installer it is 3 file folders and the only .pkg file in any of these folders or sub-folders is a file called InfoPkg.Pkg.  Am I supposed to just rename this to something like "SophosInstall.pkg" and upload as Filename?!  And should the manifest file be a .plist extension?