At some point in your career as an Apple Admin, you’ve (most likely) inherited a Jamf instance and said either to yourself or out loud, “Huh, I wonder why they did that. I certainly wouldn’t do it that way” or “That’s not the best practice I was taught”.   Caveat: There’s no such thing as best practice. The better concept is defining the best practice for your environment.   This is where you get to step in and be the hero. It’s your job to take the environment, back it up first. Make sure you backup your instance and sync it to your free Jamf sandbox (If you don’t have one, talk to your rep). Once you’ve backed up and sync’d to the sandbox, I hope you’re noticing the theme here…you can get started with the H.E.R.O. process.   Something not mentioned is the process of writing documentation. DOCUMENT, DOCUMENT, DOCUMENT. Write down everything from the current state, proposed changes, changes you made (with dates), how configs work, workflow processes, and everything else. The 1st thing

Apple Intelligence is finally here now that iOS 18.1 and macOS 15.1 has shipped. However, many people and organizations want to know how they can block it.Apple Intelligence is an Opt-In service from Apple, so unless you Opt-In, there’s no concerns about AI, on or off device.Officially, Apple has provided the following configuration profile keys for the X.1 OSes for the preference domain com.apple.applicationaccess.allowWritingTools allowMailSummary allowGenmoji allowImagePlayground allowImageWandAnd DDM management of Math Notes.There’s also the key allowAssistant to disable Siri, which has become more intelligent with Apple Intelligence.Currently in the X.1 OSes, these are the features which are available and able to be restricted: Siri, Writing Tools and Mail Summary, even though there are controls for the other features not yet implemented.This will allow you to fully block those features. But is that it? …the answer is …No. So even if you implement all the Apple supplied restrictio

Managing macOS devices in a large-scale enterprise environment always need IT expertise. Even with a powerful MDM like Jamf Pro, IT admins often need to dive into the command line to truly get to the root of issues.    In this blog, we will walk through real-world command-line troubleshooting techniques for both macOS system issues and Jamf Pro management. Whether you're dealing with failing profiles, app crashes, or failed policies, this post has your back with real commands that work.  Getting Started: System Info at Your Fingertips    Before troubleshooting, gather critical system details:  Get system version:  sw_vers      List all installed system updates  softwareupdate –history      Hardware overview  system_profiler SPHardwareDataType        Check uptime  uptime      Check disk usage  df -h    Network Troubleshooting    Network issues

Back in 2007, Jamf customers started coming together – in email. It wasn’t the most advanced way to gather, but it worked. The purpose was to share knowledge. And for a few years, words of wisdom flowed as the list grew. Jamf Nation was forming and quickly outgrew its simplistic home. That's when Jamf’s founder, Zach Halmstad, shared a bigger vision. Jamf Nation would move to an online platform. In its new format it would:    Facilitate customer-to-customer communication  Facilitate customer-to-Jamf communication  Facilitate Jamf-to-customer communication    Fast forward nearly 15 years, and these are still foundational elements of Community at Jamf. But you deserve more than our current platform can offer. That’s why we’re excited to shift Jamf Nation from its current home to a new community offering this summer. Get ready for an elevated look, feel and overall experience. Be ready to:    Find what you need more easily  Experience

As organizations scale their Apple device deployments, maintaining visibility, control, and compliance across endpoints becomes increasingly complex. Jamf offers a powerful yet often underutilized feature to address this challenge: Extension Attributes. These customizable data points enable administrators to extend the default inventory capabilities of Jamf Pro, creating a more detailed, flexible, and actionable view of managed devices.   What Are Jamf Extension Attributes?  Extension Attributes (EAs) in Jamf Pro are custom scripts or input fields that gather specific information about devices beyond the standard inventory data (e.g., OS version, hardware model, serial number). Admins can write scripts—typically in Bash, Python, or Zsh—that query system details during inventory collection. The results are stored in the Jamf database and can be used in smart groups, reports or policies.   For example, an EA can report whether FileVault is enabled, if a specific

We have been tasked with blocking DeepSeek on all campus resources. Unfortunately, keeping users from running DeepSeek models locally on their Macs isn’t as simple as making a Restricted Software title in Jamf Pro because the models aren’t actually apps. What we can work with, however, is Ollama – the framework which DeekSeek models currently run under. If a user has installed Ollama, why not leverage that to check for the presence of DeepSeek LLMs? Our first step is identifying it. The command ollama list will list all the LLMs a user has currently installed. If we grep those results for deepseek, we can make a little script-based Extension Attribute to identify Macs with DeepSeek LLMs present. Next, make a Smart Computer Group for detections that looks something like this: Criteria “DeepSeek Check” – is not – (blank) AND Criteria “DeepSeek Check” – is not – Not Detected (You could probably get away with just one criteria where DeepSeek Check – is like – *deepseek* or do something w

Last September, I joined the Jamf Community team to help build out a User Group program.  As I was getting to know the community, one thing was abundantly clear: Apple Admins have a lot to share and a strong desire to connect, especially in person.    It’s been an exciting challenge to work with admins across the globe and build a structure that supports in-person and online meetings. One of the many joys of working in Community is getting to help bring the idea of “Community” from something abstract to something tangible and real. I love supporting people who may have once felt alone —shouting into the void — find connection, clarity and camaraderie through programs like User Groups.  User Groups are a fantastic way to regularly connect with fellow admins, solve problems, talk shop and maybe even make some new friends along the way. While forums and Slack are great for quick questions and short conversations, nothing quite compares to the impact of meeting your pee

There will probably come a point in a Jamf Pro admin’s duties when they find themselves with the need to provide a mechanism for users to add or exclude their Mac to the scope of a Configuration Profile or Policy via Self Service. An example would be so users could add themselves to a group teasing macOS Beta releases. Using the Jamf Pro API to add a Mac to a Static Computer Group might seem like the obvious way to do this, but per recommendations made in the Jamf Pro certification courses calling the API from arbitrary endpoints is not recommended. This article will describe an alternative mechanism to allow user initiated scope changes without using the Jamf Pro API.    The core part of this approach is what’s known as a flag file, and its existence on a Mac can be used to add the Mac to a Smart Computer Group which can be used a Scope Target or Exclusion. To create the flag file we’ll use a script to be called via a Script payload in a Self Service initiated Policy. To det

Whether you’re new to Jamf Nation or have been here a while, it’s easy to see the Jamf community is different. But its secret sauce isn’t the platform, or even the strategy that facilitates its direction. It’s the people who fuel its growth. Those passionate customers – the ones who push Jamf to continuously improve, who come to our events and present on our webinars – inspired a program. In 2018, Jamf launched Jamf Heroes – an opportunity that gave customers a unique way to engage with Jamf, and each other.       Over the last seven years, the program grew. Jamf Heroes connected thousands of customers in meaningful ways that helped generate professional successes, grow genuine friendships and inspire more involvement in the Apple community. It thrived. Now we’re ready to take it to the next level and relaunch the Heroes program with a refreshed vision (and in a new home that’s coming soon)!     The program will offer customers:   &nbsp

  This time, looking for a job was a bit different. In the past when you looked, there always seemed to be a few options out there you could choose from. At the very least, a list you could rank and go after a few based on priority. These days it seems you may still see what appear to be quite a few options out there, but unfortunately the times they are a changing as the saying goes. I don't want to sound dire, but between new factors that have chipped away at what you see and what you actually get. It's quite a bit more difficult out there right now. Because of that, I wanted to jot a few things down to see if I could help about my recent experience. So whether you're in the midst of your job search or about to embark on that journey, here are some observations that I think could help. Things aren’t totally what they appear to be. Between AI being tier zero to any job applicant, and the fact that companies are posting ghost jobs just to compile data, my first takeaway from that

As someone who’s been part of the Apple admin community for a few years now, I’ve had the privilege of helping out the amazing team with MacAD.UK, both as an attendee and behind the scenes. In my day-to-day role as a Technical Lead for Workplace Solutions, I spend my time working with all aspects of our business with everything Apple and development, collaborating with fellow admins, sharing knowledge and supporting customers adopt Apple technology whenever I can.  MacAD.UK is a community-driven, session-led Apple-focused conference, has been a staple in Brighton for eight years. Bringing together world-class speakers, leading exhibitors, and top technical professionals from around the globe. Whether you're an experienced admin or just starting your journey, MacAD.UK is where the community comes together to learn, collaborate, and push the boundaries of what’s possible.  Why Attend MacAD.UK?  First and foremost, the ducks! (Ok, maybe not the ducks. More on

On March 20th, 2025, the NYC Jamf User Group (NYC JUG or “the JUG”) celebrated its 11th anniversary—a milestone that reflects the remarkable growth and resilience of the Apple Admin community. What began as a small gathering of 20 admins in Jamf’s old NYC office has flourished into a thriving network, now meeting at Apple’s 11 Penn Plaza location, with over 80 attendees regularly.A Look Back: From Humble Beginnings to a Thriving CommunityFounded in 2014, the NYC JUG was created to bring Apple admins together to share real-world Jamf experiences outside of official events. With early encouragement from Jamf supporters, including Henry Patel and Jonah Klevesahl (now at Apple), the group held its first meeting on February 18, 2014, after a few weeks of promotion on Jamf Nation.What started with 20 admins quickly grew through word of mouth. By the third meeting, the group had outgrown Jamf’s office, prompting Apple to offer their 100 Fifth

Content backfill required

A Read-only Friday post by William Smith You have no control over when you’ll get an idea.Yes, I do get my best ideas in the shower. Ready to go on a scavenger hunt? Getting through and beyond your own anxieties about presenting at a technical conference or meetup is the hardest part about presenting at a technical conference or meetup. Taking that first step to commit yourself to an uncomfortable (but worthwhile!) challenge begins your journey of a thousand miles. But I promise the rest will only feel like 500. 🫠 Now begins the execution: we need to first find ideas for a topic. What do I know that I can present? You may ask yourself, “What do I know that makes me an authority on anything?” Simply put, it’s your own experiences that your audience wants to hear. Notice the title of this post starts with “Finding”. Right now, it’s time to find your story. Don’t try to make something out of thin air. In the next blog post, I’ll talk about starting and developing your story. Every presen

When I was asked to write my thoughts down for a blog to celebrate International Women’s Day, my first reaction was, What the heck?! Advice, from me? More specifically, advice on professional development. Ha! I don’t even RTFM! Then, I had a flashback to 2019 when Jamf asked me to be on their first Women in Tech panel at JNUC. I’ll admit—I needed some encouragement from other admins, my leadership, and my team. I may or may not have gone into hiding when first asked to be on a panel. In the end, I wound up co-presenting with a fellow woman Mac admin on leadership, and it turned out to be a positive experience. After this quick montage in my head, I cast my doubts aside and realized, Okay, maybe I do have something to share. I can talk about a few key things in my career that I think could be helpful to other women out there. The 2025 UN International Women’s Day (IWD) theme is “For ALL Women and Girls: Rights. Equality. Empowerment.” This theme focuses on empowering the next gener

@AJPinto also know as Anthony James Pinto, is Jamf Nation’s number one community contributor. With some all-star stats like providing 289 accepted solutions, 2,607 posts and 1,145 kudos, it's likely that you’ve seen his name splashed around the community.   Jamf Nation, the world’s largest Apple Admins community, relies on the smarts and dedication of members to help advance and maintain this space as a valuable asset of learning and connection. People like Anthony make communities like Jamf Nation function in their highest level.   Let's take a peak inside Anthony’s brain and learn more about the man behind the avatar, shall we?  Tell us about yourself, Anthony  I am from LA and have lived all over the US. I settled down in central Alabama for reasons beyond me, met my wife and just sorta stayed here. My wonder lust never went away, and I love to travel and experience new places and new things. My preferred travel locations are places far a

        I was asked last week to think of some practices as a Jamf Admin that I’ve adopted into my environments that have really helped me out. One of the first things that came to mind was organization practices. Organization is key to keeping a clean environment and can help you quickly identify what is being configured and where. I’ve made some notes on how I like to keep my environments organized with naming conventions and will share them below.    Naming conventions will help to keep objects organized, reduce confusion, and help optimize our Jamf Pro platform. As additional policies, configuration profiles, packages, groups, etc. get added to the platform, a consistent naming scheme will provide clarity.    The name of any object in Jamf Pro should quickly describe what it does or what it’s for. Each object within Jamf Pro should also be tied to an appropriate category. Keep it simple.    Static/Smart Computer Groups  &

"Security is not a product, but a process." – Bruce Schneier   In today’s endpoints landscape, organizations managing macOS / Windows endpoints face an increasing need to enforce stringent security standards to protect sensitive data. The CIS (Center for Internet Security) Benchmarks serve as a globally recognized framework for safeguarding endpoints against security threats. When combined with the powerful capabilities of Mobile Device Management (MDM) such as Jamf Pro, Intune, Endpoint Central, etc., , IT administrators can seamlessly implement these benchmarks to enhance security without compromising user experience.   CIS Benchmarks are consensus-based, best-practice security configuration guides. They provide detailed recommendations on configuring IT systems to mitigate vulnerabilities. For macOS, the CIS Apple macOS Benchmark offers actionable steps to harden systems against cyberattacks while ensuring compliance with organizational security policies.   Using CIS

If you’re not using any enrollment progress tool in your Mac Environment now, or if you’re shopping for a replacement, consider Jamf Setup Manager.   When exploring options, we wanted something easy to configure. Something we’d be able to set and forget. And if configurations needed tweaking later, it’d be easy to update.   I am lazy. There, I said it.   Enter Jamf Setup Manager (JSM).   Setup Manager is the best gift I gave myself this Holiday Season. The best part is that we pass this onboarding experience to our customers and technicians.   No heavy lifting. No scripting skills are needed. Just add these two ingredients and you’re on your way.   The Setup Manager Package A new Setup Manager configuration profile Add the two items to your Prestage The folks at Jamf added a QuickStart guide to help you get started. I’d recommend giving this a read. This helped me generate ideas for customizing Setup Manager for my organization (more on that below). &nb

  As enterprises grow increasingly and rely on technology, finding efficient ways to provide  employees with access to digital tools is important. While iPads are often the device of choice  for many organization, a one-to-one deployment may not always be feasible. Apple’s Shared  iPad functionality, combined with Jamf Pro, offers a powerful solution for enterprises  looking to provide secure and personalized access on shared devices without compromising  user experience or data security.    What is Shared iPad in Enterprise?    Shared iPad is a feature designed to enable multiple users to share a single iPad while  maintaining a secure, personalized experience for each individual. Each user logs into the  device with their Managed Apple Account or a temporary session, accessing their unique  apps, settings, and data. When users log out, their data is stored securely and becomes  inaccessible to others.&nbs

Effectively managing devices is essential for IT administrators in today's rapidly changing digital environments. While tools like Jamf offer powerful capabilities for managing Apple devices, a truly optimized IT strategy involves more than just top-down policy creation. Incorporating user feedback loops into your Jamf-managed environment can transform device management from a purely administrative task into a dynamic, user-centric process. By conducting surveys, analyzing self-service usage metrics, and adjusting policies based on user behavior, IT teams can ensure their strategies align with the needs of employees or students. This approach enhances device utilization and promotes greater satisfaction and productivity.  Why User Feedback Matters in Device Management  Device management policies often stem from IT goals such as ensuring security, minimizing downtime, and maintaining compliance. However, the end users—employees, educators, or students—interact with t

Note: A newer version of this article is available on the Jamf Blog.   Jamf added support for LAPS in April’s Jamf Pro 10.46.0 release.   What is LAPS? LAPS is short for Local Administrator Password Solution. It was coined by Microsoft in May 2015 as a solution for automatically rotating passwords of shared IT administrator accounts on end users’ computers. Since then, it’s become a standard industry term used across platforms. Desktop administrators have added shared IT admin accounts to their end users’ computers for decades for those times when they need to sit in front of a computer or remotely control it and log in. But this practice introduces a few major security problems: Typically, these accounts share the same username and password across computers. If the credentials are ever exposed to unauthorized persons, the entire fleet is vulnerable to attack. Multiple people know these shared IT admin credentials and they’re easy to reshare to anyone without any mea