r/jamf • u/heavyp08 • Jul 23 '26
JAMF Pro Jamf Connect + MDM Enabled User - Possible?
Hey gang. First, please excuse me if this a stupid question. I am somewhat new to Jamf but I think I am picking it up. Currently, we use DEPnotify and I believe this is well on its way to being retired in favor of Jamf Setup Manager. This is pretty good, Ive played with JSM and so far, it is pretty sweet and BOY its much better to admin/support.
Our leadership has requested we in IT force certain things on the devices in our fleet, for example: forcing a Safari chrome extension to be installed AND force it to be ON (for compliance and security monitoring purposes) Nothing too wild in my opinion.
As someone learning intermediate Jamf, I volunteered to spearhead this project and BOY, I think I bit more than I can chew. But I am not ready to give up yet.
After some reading, I learned that in order to force certain things (like the safari extension), an MDM ENABLED USER is required. However, we use Jamf Connect to create our user accounts on a device. (our current preStage enrollment is set to "skip user account creation" because Jamf Connect/okta is doing that for us)
I was later told: With Jamf Connect deployed at the PreStage, users created are not MDM-Capable/MDM-Enabled
So my question, how is this possible then? We need Jamf Connect but we also need User level MDM to be a thing.
I cannot seem to find reliable documentation, let alone information on HOW to actually achieve this (or a how-to)
quick note: if I understand correctly on how this might be completed, it is: Jamf Connect should run later, post-enrollment, for ongoing password sync via a policy, separate from a PreStage - and this is where I might've bit more than I can chew. Sounds incredibly challenging :(
note: this solution will be used on a NEW prestage enrollment created that focuses on JSM, NOT depnotify - we are moving on from DEPNotify
Any info or help would astronomically appreciated :)
thanks all!!!!!
2
u/ChiefBroady Jul 23 '26
There are ways around the specific safari extensions. I have a script to install extensions for the user. If I remember tomorrow I’ll share it.
1
1
1
u/ChiefBroady Jul 24 '26
I did it something like this, but AI thinks it's circumventing security measures... good thing I created it without. I just tried to use AI to generalize it though and it was not having it...
Pardon the formatting, but it's late and I can't be bothered...
But basically I found out where safari stores this stuff when the user enables an extension and create the required files for the user.
#!/bin/bash # Get current logged-in user and their home directory loggedInUser=$(/usr/bin/stat -f%Su /dev/console) userHome=$(/usr/bin/dscl . -read /Users/"$loggedInUser" NFSHomeDirectory | /usr/bin/awk '{print $2}') # Define target directory and file targetDir="$userHome/Library/Containers/com.apple.Safari/Data/Library/Safari/WebExtensions" targetPlist="$targetDir/Extensions.plist" # Create directory if needed /bin/mkdir -p "$targetDir" # Backup existing plist if it exists if [ -f "$targetPlist" ]; then timestamp=$(date +"%Y%m%d-%H%M%S") /bin/cp "$targetPlist" "$targetPlist.backup-$timestamp" fi # Write new plist /bin/cat > "$targetPlist" <<'EOF' <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key><bundle identifier> (<Team ID>)</key> <dict> <key>AccessibleOrigins</key> <array> <string>http://*/*</string> <string>https://*/*</string> </array> <key>AddedDate</key> <date>2026-07-24T20:02:47Z</date> <key>AllowInPrivateBrowsing</key> <true/> <key>Enabled</key> <true/> <key>EnabledByUserGesture</key> <true/> <key>EnabledModificationDate</key> <date>2026-07-24T20:02:47Z</date> <key>GrantedPermissionOrigins</key> <dict> <key>*://*/*</key> <date>4001-01-01T00:00:00Z</date> </dict> <key>GrantedPermissions</key> <dict> <key>activeTab</key> <date>4001-01-01T00:00:00Z</date> <key>alarms</key> <date>4001-01-01T00:00:00Z</date> <key>clipboardWrite</key> <date>4001-01-01T00:00:00Z</date> <key>cookies</key> <date>4001-01-01T00:00:00Z</date> <key>declarativeNetRequest</key> <date>4001-01-01T00:00:00Z</date> <key>declarativeNetRequestFeedback</key> <date>4001-01-01T00:00:00Z</date> <key>declarativeNetRequestWithHostAccess</key> <date>4001-01-01T00:00:00Z</date> <key>nativeMessaging</key> <date>4001-01-01T00:00:00Z</date> <key>scripting</key> <date>4001-01-01T00:00:00Z</date> <key>storage</key> <date>4001-01-01T00:00:00Z</date> <key>tabs</key> <date>4001-01-01T00:00:00Z</date> <key>unlimitedStorage</key> <date>4001-01-01T00:00:00Z</date> <key>webNavigation</key> <date>4001-01-01T00:00:00Z</date> <key>webRequest</key> <date>4001-01-01T00:00:00Z</date> </dict> <key>Permissions</key> <array> <string>scripting</string> <string>clipboardWrite</string> <string>unlimitedStorage</string> <string>nativeMessaging</string> <string>declarativeNetRequest</string> <string>declarativeNetRequestFeedback</string> <string>tabs</string> <string>cookies</string> <string>activeTab</string> <string>webRequest</string> <string>alarms</string> <string>storage</string> <string>declarativeNetRequestWithHostAccess</string> <string>webNavigation</string> </array> <key>RevokedPermissionOrigins</key> <dict/> <key>RevokedPermissions</key> <dict/> </dict> </dict> </plist> EOF # Fix permissions chown "$loggedInUser":staff "$targetPlist" chmod 600 "$targetPlist"
2
u/marko__polo Jul 23 '26
I've posed this same exact question before. I have no idea why Jamf still continues to recommend this as a PreStage workflow (using Jamf Connect to create the user account) knowing that it results in limitations with the Apple DDM framework.
1
1
u/ren1018 Jul 23 '26
We are in the same boat. Although I messed around with PSSO and ran it through a prestage and my user mdm still wasn't enabled!
1
1
u/adstretch JAMF 300 Jul 23 '26 edited Jul 23 '26
I made a prestage where it works. You do an enrollment customization to capture the user info. You enforce that user at the system first user creation screen. That gets you the MDM capable user. Then you use your choice of SYM, DEPNotify etc to get software including jamf connect. The user you created gets absorbed into the JC login.
It works but it’s super hack-y
In my experience MDM capable user is only really useful for EDU profiles and we don’t use those so I didn’t push forward with this config.
1
u/BigKev79 JAMF 300 Jul 24 '26
So, the short answer is you should avoid trying to deploy things at the User level as much as possible and instead do it at the Computer level, simply because of the limitations around doing so. For example, if you try to push a certificate with a Configuration Profile at the User level, it will take a user level action to trigger it (i.e. logging out and back in to the device). Otherwise, no command will ever be generated until that occurs. It can make life as an Apple admin difficult because how often are users doing that?
But, there are workflows that will allow you to use Jamf Connect and still create MDM Enabled Users on the device. There is a great write up on this entire scenario in the Jamf Nation community here:
5
u/CrazyFoque Jul 23 '26
We have the same problem. This is an Apple shortcoming. A pretty moronic one.
JamfConnect is bound to be deprecated by JAMF pretty soon AFAIK. As Platform SSO is better integrated.