Jamf Connect 2.13.0 beta enrollment now available

[mikevandelinder]

Hello Jamf Nation!

We are excited to announce that the Jamf Connect 2.13.0 beta is open for enrollment. Important changes of note:

• As of this beta release, 2.13.0, Jamf Connect requires macOS 10.15.4 or later
  • If a computer with macOS 10.15.3 or earlier is in-scope for updating to Jamf Connect 2.13.0 or later, version 2.12.0 will remain installed and functional instead of updating to the latest version
• UI updates to local login fallback for OpenID Connect-based identity provider integrations
• Updated tenant requirements for Microsoft Azure AD app registrations

If your identity provider is Microsoft Azure, upcoming changes to Microsoft Authentication Library (MSAL) require changes in your Jamf Connect configuration. Existing applications remain functional, but in December 2022 Microsoft will discontinue security updates for Azure Active Directory Authentication Library (ADAL), deprecating the use of common endpoints. To align with these changes in Jamf Connect, you must include organization-specific tenant information for your registered authentication applications in your configuration. For more information about these changes, see https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-migration

This beta enables the use of these updated endpoints as the default authentication scheme for Connect, when configurations include the required details. For configurations without organization tenant specific information, authentication will remain functional. To support these changes, Jamf Connect Configuration now requires the inclusion of an Azure Active Directory Tenant ID – which is available on your Azure Active Directory Overview portal.

Detailed information is available in the release notes for enrolled beta testers.

How to join the beta :

Log in to Jamf Account to enroll in the Beta Program, available under Product Feedback at account.jamf.com. After enrollment approval you will see a link to the Beta Forum. There's a short delay while you are approved for access to the forums. If you have any questions please email beta@jamf.com. The beta program is operated under non-disclosure, so please do not share any information regarding your testing on any public forum, including the non-beta sections of Jamf Nation. Please use the Jamf Nation beta discussion area to provide feedback or ask questions about the beta.

Thank you to all those who participate in the program - we appreciate your time and feedback. 

The Connect team

[Flaurian]

Hey @mikevandelinder 
Do you have any timeline for fixing PI109772 ?

[mdcooledge]

Do you know if this got resolved or which documentation version I could find it noted in?

[Flaurian]

Hey @mdcooledge 
I don't know because it was just a POC for me but I solved it. I recommend for asking jamf support to get this answer if it's fixed.

• extra configuration profile to com.jamf.connect.login for avoiding to get the PI109772 issue - afterward exclude the device via smart group from the profile
  
  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
  <dict>
  <key>EnrollmentRealName</key>
  <string>$REALNAME</string>
  <key>EnrollmentUserName</key>
  <string>$EMAIL</string>
  </dict>
  </plist>

[mdcooledge]

Hey @Flaurian 

I have been able to get this to mostly work, but for some reason the $EMAIL returns the users email address twice in the Account Full Name field of the local profile. Do you know why that might be happening?

[kennetha]

We’re seeing this PI109772 as well, your plist mod mitigates it. Unable to find this as a known issue in 2.25.0. Will this ever get resolved if it’s not acknowledged by Jamf?

[mdcooledge]

Hey @kennetha, it still happens for us in 2.24.0 but not listed as a known issue either. I would assume the same for 2.25.0. When speaking with a Jamf Rep. they said that I should just not use the Customized Enrollment feature all together but we determined that we needed to use it internally. As a work around we were able to write a script that runs that after sign in, to remove the double email and only have it once.