PPPC option not available when creating a Configuration Profile

[shoch]

Hello all,

I'm VERY new to the PPPC Utility. I've been struggling with getting the .mobileconfig that I just created to actually create in my Jamf.

We're on 10.7.1 (very far behind). I select "New Configuration" and upload but I do not see an option of PPPC to change or verify the items that were uploaded.

Am I missing something that I should have checked or allowed?

[sdagley]

@shoch Jamf Pro 10.7.1 isn't going to have support for PPPC profiles. You could use an external tool like PPPC Utility to create profiles, and sign them prior to uploading them to your JSS, but if you're expecting/need them to appear in the Jamf Pro GUI you really need to upgrade.

Do not attempt to upgrade until your first read Incremental Upgrade Scenarios for Jamf Pro 10.0.0 or Later as you will require multiple intermediate upgrades to successfully upgrade to the current release.

[shoch]

Thank you. I did use the PPPC Utility and uploaded the profile but what do I do with it after that? It just gives me the "General" option but there's nothing I see to actually push out.

[mainelysteve]

@shoch As @sdagley pointed out because the version you're currently running doesn't have PPPC support the payload will be invisible in the GUI. It will still be present in the profile you uploaded and is deployable, but you won't see it in the GUI. Just give it a scope and that should be it.

[shoch]

OK! I totally understand now. I was thinking I would see something there. I get it now.

Thank you both for your assistance.

[mm2270]

@shoch You don't see anything in the GUI because it doesn't have a built in payload to represent a PPPC Profile. So technically the settings are there, but can't be shown in the GUI in Jamf Pro unless you upgrade to a newer version.

From what I can tell, 10.7.1 had some very preliminary support for PPPC, but only insofar that it automatically deployed a Jamf PPPC profile out to managed clients to allow the jamf tools access to items it needed. But I don't think they had yet added in the actual PPPC profile payload to let you create and deploy your own settings. I'm not sure which version it came along in, but probably wasn't too far after that release.
Still, I would upgrade to as close to the current version as you can at this point, especially if you plan on supporting Big Sur in your environment. For sure 10.7.1 isn't compatible with that.

[shoch]

We do plan on upgrading over the summer. I'd be very happy to get that out of the way.

Out of curiosity, I'm seeing, "The profile must originate from a user approved MDM server" in the logs on quite a few computers that I've scoped it to. Several accepted the config without an issue and many send back that message.

I'm wondering if these machines need to have the user "approve" the MDM from within the Profiles. Annoying as all get out if that's the case. Once that's done (if that's the issue) then the config should pop right in.

[mainelysteve]

@shoch That's what it sounds like. PPPC profiles won't install unless they originate from an MDM and if the machines are enrolled, but haven't completed the UAMDM then most configuration profiles will fail to install. If it's enabled that status will show in the inventory

https://www.jamf.com/jamf-nation/articles/499/managing-user-approved-mdm-with-jamf-pro