Hey all, If you missed the PSU conference this year, not to worry. You can check out the videos of sessions here and slides can be found here.

Hi All, I have issue with login into Self Service with SSO, I am able to login to access the login process, but once I approve my MFA it doesn't approve my access, does anyone have any information this process?

Hello Jamf Nation The JNL London 2025 sessions are now available here on Youtube. Catch all the sessions in case you weren’t able to attend. Happy watching!

Hey All, We are working on determining the best way to manage our assets. We are a Mac/iOS only environment. So all of our equipment goes into Jamf Pro. We don’t do touchless deployment (management decision although its practically touchless). I’d imagine we’d need to get MUT involved to update purchase status. How do you handle new equipment or equipment that goes back into inventory? Also, we are looking to get physical asset tag stickers for the devices. Any suggestions on using Jamf as a complete solution? Or addition tools that people use for Asset Management to track items? Thanks!

Went to the support portal to enter a ticket and has a link at the top to go to the new support portal which turns out to just be an AI chat bot. While its good for Jamf to have an AI chatbot try and “screen” support questions, I am wondering how well this will work out. The AI bot did not really have an answer to my question so I asked it to create a ticket and it said the team would email me back. I hope there is a way to track these support requests like you could with the old ticketing system. It can be important to have a ticket number.

Hello there, maybe someone has an idea for solving this issue. We have started to enroll MacBooks to employees without admin rights. We was using first the visual studio code installer from jamf mac apps. The problem with this, is that i cant add some configuratio (for example creating a symlink for this app) within the jamf mac app installer config. So at the moment i am using a normal policy with a pkg for vscode. Everything until here is working fine. When an update is released for vscode, the user (without admin right) can't install it. The first window which pops up is for the helper tool (updater) for visual studio code So i was searching for a solution and found this page here, which explains this problem: https://github.com/microsoft/vscode/issues/115805 I am able to do all this changes for the group and ownership for the logged in user but the problem still persist. My script #!/bin/bash set -x # Get the current user's home directory loggedInUser=$(stat -f "%Su" /dev/console)

I'm integrating with JAMF MDM to get mobile devices. I have a standard JAMF pro user created and assigned Auditor privileges(grant all read). I'm able to get device info with the following info under the security object. "security": { "dataProtected": , "blockLevelEncryptionCapable": true, "fileLevelEncryptionCapable": true, "passcodePresent": true, "passcodeCompliant": true, "passcodeCompliantWithProfile": true, "hardwareEncryption": , "activationLockEnabled": true, "jailBreakDetected": false }, I have to capture the compliance info as well when I try to access compliance info using the following API call BaseURL/api/v2/conditional-access/device-compliance-information/mobile/{deviceid} it is showing null results. Please advise how can get the compliance status of the device. Do I need to get more privileges or can we capture from a security object? Thanks. mythdhr

I have a script that worked before OS15.5. After updating to OS15.6, the script became abnormal. Even if it connected to the allowed SSID and obtained the IP address, it would turn off and on WIFI infinitely. The following is the script. Thank you for your help~~ #!/bin/bashallowed_ssids=("SSID_1" "SSID_2")wifi_port=$(networksetup -listallhardwareports | awk '/Wi-Fi|AirPort/{getline; print $NF}')[[ -z "$wifi_port" ]] && exit 1 lockfile="/Library/Application Support/JAMF/.wifi_cleaner.lock"mkdir -p "/Library/Application Support/JAMF"if [[ -f "$lockfile" ]]; then pid=$(cat "$lockfile") if ps -p "$pid" > /dev/null; then exit 0 else rm -f "$lockfile" fifi{ echo $$ > "$lockfile" trap 'rm -f "$lockfile"; exit' EXIT INT TERM check_and_clean_ssid() { local connected_ssid=$(/usr/sbin/ipconfig getsummary "$wifi_port" | awk -F ' SSID : ' '/ SSID : / {print $2}') local ssid_list=$(networksetup -listpreferredwirelessnetworks "$wifi_port" | tail -n +2 | sed 's/^[[:space:]]*//') is_allowed() { local

End User Experience Reference: https://learn.microsoft.com/en-us/mem/intune/configuration/use-enterprise-sso-plug-in-macos-with-intune?tabs=prereq-jamf-pro%2Ccreate-profile-jamf-pro#end-user-experience Secure Enclave After the configuration profile for PSSOe and the companion application for PSSOe are installed on the device, macOS will prompt the user to register. The message can be customized with the configuration profile value of “Display Account Name”. In this example, the Display Account Name was set to “Jamfse.io Entra ID”. The user is then prompted for their local macOS UNIX account password. This is used to determine the user is present and actively using the device. The next step requires the user enter a strong credential like a security key or Passkey enabled on another device. Other methods also include push with number challenge. Upon completion, the user is shown instructions to set up the device as a Passkey provider for Microsoft Entra ID. A user must dismiss the dialo

Hi there. We’re looking at moving to PSSO, where we currently have Jamf Device Compliance on prod Macs, but have run into a wall. MDM=Jamf, IdP=Entra ID, PSSO profile uses Secure Enclave Key as the auth method because we have Jamf Connect managing accounts and password sync and understand that they can be complementary. On new builds when we deploy the PSSO profile before registering with Intune/Company Portal/Entra ID via our normal Jamf-driven Device Compliance workflow, it registers cleanly, works as expected, and CA permits access to protected data and apps, so it’s successfully replacing Device Compliance.On prod devices already registered with Device Compliance, with Entra ID device records, WPJ keys in keychain and the rest, when we deploy PSSO after, it initiates the registration, accepts the user credentials, creates a duplicate stub record in Entra ID, but at the last step where it would require MFA and then pop up the dialog prompting to allow CP Passkeys in System Settings,

Hi everyone, Apparently there is a loophole to leak data according to our cybersecurity team on the MacOS Outlook client using the “Share to Teams” feature I am trying to disable the function for “Share to Teams” via a configuration profile on JAMF with the following configurations Application & Custom Settings > Upload Preference Domain: com.microsoft.Outlook PLIST: <plist version="1.0"><dict> <key>com.microsoft.Outlook</key> <dict> <key>DisableShareToTeams</key> <true/> </dict></dict></plist> I am wondering if anyone have any insights about this Thanks in advance!!

Need help with installing GarageBand Loops for users without admin rights.

How do I set up so that students are not able to use the Messages app on their Mac.

Hi all, we are using cloud instance of Jamf Pro, with user-initiated enrolment for iPads, iPhones, etc always been unticked (all boxes, inc account-driven and profile-driven), while computers were enabled. Everything was fine till iPads with Apple M-chips were released - now users CAN enrol them manually… Is it because Jamf Pro mistakenly taking them as MacBooks? Is there a way to fix this? Thanks!

We just got the Jamf AD CS Connector set up for our environment. It's awesome considering we were using an ancient, user-initiated script through Self Service for a long time to accomplish the same thing. However, I am wondering what the best practice is for pushing the wireless config during or after enrollment is. As part of our zero touch efforts, we have the user enroll using our guest wifi network when on site. I'd like to get the wifi profile installed as close to enrollment time as possible so when it does its post-enrollment tasks (installing security software, settings, etc) it will pull from on-site distribution points rather than our Internet facing distribution point. Has anyone had success with this? I seem to find myself getting railroaded installing this profile as it either interrupts the enrollment or post enrollment when it automatically switches from our guest network to the corporate network. Thanks in advance for any thoughts.

I am running into this issue where after pushing an app, updating inventory or enrolling a device, the apps are going straight to the failed command list and display the “No license was found for app”. I have tried wiping and re-enrolling, updating OS, restarting, sending a blank push, or update inventory command but the issue persists. I check the apps and we do have enough licenses available. Any solutions or ideas on what can be causing this? Thanks

I just wanted to say they really helped me get across the finish line with a script I needed to move computers from one pre-stage to another. Also special shoutout also to ​@mattjerome for getting the base script started with me. Anyone else have cool stories of how Jamf Support came through for them when you were hitting a brick wall with things?

Hi, Is it possible to block widgets with the Home Screen Layout but also allow apps to appear (at least on the second page) while not having those apps lumped into a folder? Here is an example I have setup -- Main group (All Student iPads): Has normal student iPad apps. These apps and profiles appear on the first page as intended according to the home page layout Second group (LMC): Has specific apps set to auto-install. Sometimes these apps appear after the first set of apps. But if wiped and returned to service, the apps will move to the second page of the home page and get lumped into a folder called “Managed”. Is there a way we can have this setup so the apps on the second page DON’T get grouped together while also hiding widgets/blocking students from removing apps? It would theoretically be nice to just have all the apps together but having the layout locked on page 1, and other apps on page 2 (if more then two groups) be together, that is fine too. Thanks

Hi,We’re using Jamf Radar and I created a group where internet access should be completely blocked except for a few allowed sites (internal tools and Jira, mostly). At the moment, full blocking works as expected. I then added some test domains under Custom Rules with "Allow" selected, but they’re still being blocked. What’s strange is that a domain like reddit.com, which is allowed via a custom rule inherited from the root level, works fine. But any domain added directly at the group level doesn’t work, even if the rule looks identical. Is there a known issue with group-level custom rules not applying correctly?Is there a better way to block all internet traffic for a group and only whitelist a few domains? Thanks,Michał

Heads up to my fellow Jamf community. We've been seeing iPadOS 15.8.4 iPads when reprovisioned can't be enrolled to Jamf School. This may affect Jamf Pro too. The exact error is "Failed to retrieve configuration". I reached out to Jamf support and they said they have been getting reports of this from others and that this has been observed across different MDM providers. Jamf reached out to Apple regarding this issue and this is exactly what they told me: Apple did get back to us just a bit ago, and they have identified the issue (they did not elaborate on what the issue was). The release is not ready yet though and at this time they couldn't give me an ETA on when that would release. For now I created an internal Jamf Product Issue so we can track customers and I have attached this case to that ticket (PI136109). Hopefully an update that fixes this issue will come out soon. Jamf did say that they could reproduce my issue but had mixed results as one test iPad had the issue but another

Trying to install Chrome for Mac using the app installer. When it installs, chrome will no allow me to update manually. If I manually install chrome, then there isn’t an issue. I do not have a configuration profiles loaded for chrome.

I am attempting to import a new VPP token that I have downloaded from Apple business manager. Every time I try to do this, I get an error saying "The file received was not valid". I have tired using a different web browser. I have rebooted Jamf Pro, and I rebooted the entire Ubuntu server VM. The Jamf Pro server log does show an error at the time I attempted to import the token. I have an open case with Jamf for this, but if anyone knows how to solve this, that would be wonderful 😊

Hi everyone, I’m trying to set a default font in Microsoft Outlook (macOS) using Jamf Pro, and I’m running into some trouble. By default, Outlook uses Aptos, but I’d like to change it to Book Antique, which is already available on the device. What I’ve tried: I attempted to use the 3rd-party tool OutlookFontPoke by Paul Bowden @ Microsoft. Here’s what I did: • Deployed the OutlookFontPoke script and TemplateRegDB.reg via a package (both located in /private/tmp/OutlookFontPoke-master). • Created a policy in Jamf that: • Extracts the current logged-in user • Fixes permissions • Run the command as that user: sudo -u "$loggedInUser" /private/tmp/OutlookFontPoke-master/OutlookFontPoke 'Book Antique' '11.0pt' 'black' Issue: Despite several variations of the above, I keep getting this error in the script logs: WARNING: Registry DOES NOT exist at path /Library/Group Containers/UBF8T346G9.Office/MicrosoftRegistrationDB.reg. Attempting to create... mkdir: USER/Library/Group Containers: No such f

We are deploying ClearPass OnGuard to our macOS fleet using Jamf Pro. The ClearPass application installs successfully via the Jamf policy, but it fails to establish a connection with the ClearPass backend. Manual installations, however, are fully functional. The root cause has been identified as a missing or misplaced .agent.config file, which is a hidden file essential for the initial configuration and backend communication. This file is present within the ClearPass DMG but is not included in the standard PKG installer. The challenge is to devise a deployment method using Jamf that ensures both the ClearPass installer PKG and the .agent.config file are present on the client machine at the time of installation, allowing the application to connect to our backend successfully.

Hi all, I’ve been unable to find the answer to this one so I’m hoping the experts here will know the answer. I accidentally scoped a policy to all computers with the recurring check-in box ticked rather than just the enrollment complete option. I realised my mistake and rectified it, but now there are multiple pending commands in the policy log. How can I cancel these? Thanks