Jamf on the new M1 chip macbooks?

[quip_MDavison]

Looks like Apple is all-in on switching to their ARM based M1 chip, you can't even buy the Intel macbook airs online anymore unless they're refurbished. Has anybody gotten their hands on one of these and run into any issues with existing config profiles or policy payloads?

[taz231190]

They are due to ship on 17th Nov, I've asked our supplier to source them now so I can test ASAP.

[Wakko]

Ordered a 13"MBPro to test DEP, etc,etc. Once I have the until I will heavily test and report back.

[bpavlov]

I asked a similar question yesterday here: https://www.jamf.com/jamf-nation/discussions/37255/jamf-pro-and-apple-silicon-support

[Utilizator]

I've just had an M1 MacBook Pro delivered to test and enrolled it into Jamf (invitation).

It's pulled down initial profiles but nothing else... so looks like this isn't working right now.

Jamf Notifications
MDM Profile
Privacy Preferences Policy Control

These have pulled down OK and there is the Jamf binary in /usr/local but the Mac has not appeared in Jamf Console and there's no activity in Activity monitor to suggest anything is happening.

Using Jamf Version 10.25.1-t1602899070

[ThijsX]

@jay-kay You need to install rosetta 2 first in order to let the Binary work

/usr/sbin/softwareupdate --install-rosetta --agree-to-license

[Utilizator]

Thanks for the headsup... do you know if Apple have any plans to install Rosetta 2 by default in future? Seems crazy that you need to download it in order to work (especially in a Zero Touch environment).

[ThijsX]

You need to install rosetta 2 if you run Apps that are not working on ARM architecture yet, i assume Jamf is going to compile their binary as "Universal Binary" so it will run on Intel and Silicon.

[dcgagne]

It would be nice to know if there is an extension attribute that can be leveraged for identifying any Macs with the M1 architecture for scoping beyond just the model numbers.

[ThijsX]

@dcgagne

Something like this should work

#!/bin/bash

arch=$(/usr/bin/arch)

if [ "$arch" == "arm64" ]; then
    echo "<result>Apple Silicon - $arch</result>"
elif [ "$arch" == "i386" ]; then
    echo "<result>Intel - $arch</result>"
else
    echo "<result>Unknown Architecture</result>"
fi

[nebjamf]

Mine says it's still in China, should arrive later this week but I fully expect there to be issues with the M1 Macs and JAMF. We're going to be pushing 16" Intel Macbooks for the time being.

[jwscarsdale]

A group of the new m1 macs are on order for us... How does this change my enrollment process? When would this need to be run during pre-stage? I'm assuming before my DEPnotify runs..

[ThijsX]

@jwscarsdale I suggest to wait for Jamf supporting ARM for Jamf Pro before shipping out those devices, and heavily test of course! For Jamf Connect they released today a release which supports ARM.

[jwscarsdale]

IS there any update pipeline for this? Surprised there's no 0 day support for it.

[ThijsX]

@jwscarsdale Jamf does deliver zero-day support for OS releases, but for hardware they can't AFAIK as they also have to wait on their M1 devices to test, like us. for Jamf Connect they mentioned the following ->

• Apple Silicon Compatibility for Jamf Connect: Jamf Connect is now a universal app that can run on Macs with Apple Silicon* or Intel hardware. o Important: New Macs with Apple Silicon do not install Rosetta, Apple’s binary translation service, until an Intel-based application is first opened. To ensure Macs with Apple Silicon successfully run Jamf Connect, make sure you deploy Jamf Connect 2.1.0 or later to Macs with Apple Silicon in your environment. Hardware support is based on testing with the Mac Developer Transition Kit.

[Heavy_D]

This was just released. Upcoming Release

[clint_arndt]

@txhaflaire something worth mentioning, it looks like the result of /usr/bin/arch when run by the jamf binary through Rosetta is "i386". For this to be functional you'll need to be on the latest version of Jamf.

[H3144-IT]

I would like to see the JAMF Installer to be notarised as well, at present I always have to go into Security & Privacy, if I want to install an Update with the .pkg !

Normally, JAMF is so far ahead with supporting Stuff natively.
So I am a bit flummoxed, why JAMF Imaging still has 32-bit Files for SnowLeopard.
And is not UNIVERSAL...

[KyleEricson]

@H3144-IT Imaging is dead.

[mpenrod]

So far it's really fast... because nothing will install! LOL j/k. Updated my JAMF Pro to 10.26 and that fixed enrollment. Discovered Google has a new Chrome installer for Apple Silicon. We use Sharp copiers and they haven't released a new driver yet but the Catalina driver prompted me to install Rosetta and after that they all went fine. Adobe Creative cloud package I was using failed. Trying a new one now... which failed. Had to install Creative Cloud from Adobe.com. Says "Beta" at the top. As expected, App installs warn you that you are installing the Intel version until they release the new one. Now to smart groups and profiles...

[IT-Chris]

althose this would be idea, the post from txhaflaire
You cant run a pkg at pre-stage since the pkg is running in intel mode (Created with with new composer.)
JAMF need to recreate compose to work with the M1 Arch.
best option so far is to create a script with his code and make it policy 0.0 Install M1 binay so its the first policy triggered after a DEP enrollment.

[Jackie_Mac]

@dcgagne

I know this is an older post and it may have changed since, but there is an "Architecture Type" field where you can choose "arm64" as the criteria to make a Smart Computer Group. This will identifying any Macs with the M1 architecture for you!