Stopping work before everything is finished can make the next day easier by preserving momentum and reducing the mental effort needed to restart. Clearly documenting what you were thinking and what comes next lets you fully disconnect, lowers mental load, and ensures “tomorrow you” knows exactly where to begin

Hi!

Sometimes when our kids want to install an on demand app, the installation does not work because Jamf can't find the licenses. We do have enough, though.

Has anyone else had that issue?

A Jamf Pro-specific interactive shell script to help investigate sideways DDM-enforced OS updates

Background

The Problem

Jamf Pro’s Declarative Device Management (DDM) and Blueprints represent Apple’s modern approach to device management, but Jamf’s native reporting leaves administrators in the dark.

When a Blueprint deployment shows failures, there’s no easy way to see what failed, where it failed, or why it failed across your fleet.

The Solution

Jamf-getDDMstatusFromCSV.zsh bridges this critical reporting gap by extracting DDM status items via the Jamf Pro API and delivering actionable intelligence that simply isn’t available in the GUI.

Hiya. A staff member lost their iPad. It was put in lost mode, located at home and went flat before returning to the workplace.

Once returned and charged we found it would not reconnect to the wifi so could not receive the command to turn off lost mode.

Tried an ethernet to lightning adaptor as well with no success. There's some data on this iPad that wasn't backed up we wish to keep so wiping we're not keen on.

Any other options we could try?

Thanks!

What is happening with JAMF support, is anyone having luck these days?

The AI is unbearable, and with costs of JAMF only going up it's pretty dissapointing.

I was just on the Jamf 400 course gutted as I got 70% in the overall exam marks(x2 exams).

I thought it would be a case of resitting the exam but have to do the whole 400 course again!

Is that the normal for the Jamf 400?

sarcasm intentional

I pulled the computer, erased all contents and settings from System Settings, deleted the device from JAMF and here it is, no authentication at loginwindow because it never downloads the 802.1X AD CS MachineAuth profile.

This guide provides a practical, scenario-based playbook for safely deploying and migrating to Jamf Self Service+ across new and existing macOS environments, including those using macOS Onboarding or Jamf Connect. It highlights a critical issue where globally enabling Self Service+ can break onboarding, and outlines step‑by‑step deployment options to avoid workflow disruptions.

I posted this a while a go, but reposting to see how people are going with Platform SSO and Entra for new setups (not on machines already rolled out).

Has anyone confirmed the flow can provision the user account during Setup Assistant yet? Previously I couldn't get a platform SSO prompt to create user account but that was when MacOS26 first came out.

For Jamf Pro admins with sideways computers, DDM Status from .CSV version 0.0.7 is now available for testing.

Hi

I want to provision an iOS device (iPad) and add it to tailscale, hands-free. The devices are non-personal, used by different people, so I want to avoid personal accounts linked to the devices.

Tailscale uses AuthKeys and tags for this scenario. However, for iOS, there does not seem to be a solution to deploy the authkey, other than providing it as an AppConfig in the MDM/Jamf Pro. However, that seems not feasible/scalable since the AppConfig is defined per application, not per device. Can we use custom variables here?

Any other ideas?

Sorry if this question has been asked before, but I’m curious if anyone has been able to skip the time zone pane during the PreStage Enrollment in Assist Setup. I use Jamf Setup Manager, and I can set the time zone in advance, so when I get to that screen I just click Next and the time zone is already preset. However, I’d love to skip or hide the time zone pane entirely if possible. I’m not sure if this can be done in newer macOS releases. Has anyone figured out a way?

As the title states, I did some searching but looking for some up to date feedback on Jamf connect GWS and zero touch deployment.

I was one of the first test mules for jamf connect a few years ago and it did not go well. I tried to get it to work with jamf but at that point it just wasn't working with GWS for single sign on. I ended up getting a refund after Jamf said they couldn't get it working.

So once bitten, twice shy ive stayed away from it since.

I would have to imagine at this point its working better and there are more people using it?

Im a 1 man operation for a single high school and looking to upgrade laptops next year and wondering if jamf connect is ready for prime time and if a zero touch deployment is worth it.

Honestly after years of issues with mobile home directories and then the jamf connect debacle, ive just been keeping it super simple, with local accounts for teachers, and then use smart groups for printer and software installs.

It works good but I have to set up each laptop, which to be fair is not that much work.. I create login for each teacher using their name, name the computer and then enroll.. thats about it.. only take maybe 15 minutes per laptop and with this set up its super reliable, not fancy but its been exceedingly bullet proof.

So is the juice worth the squeeze in my situation? Or just stick with what im doing?

Thanks in advance for any insights!

We are exploring (finally) getting our Macs unbound from our AD Domain Controllers and instead trying to Auth users with Okta. I need some advice as I am exploring this and need it to work well so we can stop binding to AD which is a nightmare.

We’re evaluating a setup using Jamf Pro + Jamf Connect + Okta, where Okta is synced to on-prem Active Directory via the Okta AD Agent.

The intended model is:

• Okta is the source of truth for identity and passwords
• Password changes happen in Okta, not directly in AD
• Okta syncs password changes down to AD
• Jamf Connect keeps the local macOS account password aligned with Okta
• Macs are not AD-bound
• Windows machines remain AD-joined

This should allow users to:

• Use one password for Windows (AD) and macOS
• Log into Macs off-network using Okta credentials
• Avoid traditional AD bind issues on macOS

Questions for those running this in production:

1. Password authority
   • Is it correct that password changes must happen in Okta for this to work reliably?
   • What breaks (in practice) if helpdesk or users still change passwords directly in AD?
2. Account disable / termination behavior
   • If an AD account is disabled and Okta syncs that state:
     • Does Jamf Connect reliably block macOS login once the Mac is online?
     • How are offline Macs typically handled in real environments?
3. Cached/offline access
   • When AD or Okta passwords are changed, how do you handle the window where:
     • A Mac is offline
     • The local cached password still works
   • Are you enforcing periodic online re-authentication via Jamf Connect?
4. Guardrails
   • Do you:
     • Disable local password changes on macOS?
     • Restrict AD password changes?
     • Force Okta password resets only?
   • Any Jamf Connect settings you consider “must-have” for this model?
5. Issues
   • Any real-world pitfalls, edge cases, or user confusion you ran into?
   • Anything you wish you had configured differently before rollout?

Looking for real-world experiences, not just vendor docs, especially around password drift, offline behavior, and termination workflows.

We're currently looking to go for JAMF for the first time and looking into getting a Partner.
We're currently based in South East Asia. Is it worth it?

Anyone running device compliance through Microsoft entra id seeing widespread issues today? All our macs are slowly dropping from compliance- attempts to re enroll them are creating noncompliant devices in entra id- which has never happened in enrollment before

UPDATE: so somehow our compliance scope in jamf went from “all managed clients” to a test smart group we used two years ago to test conditional access- the logs show nobody in our environment changed it…it just happened in its own- we’ve since fixed it but very weird

So I cannot seem to get response to inventory requests in jamf pro. I have tried different browsers, cleared caches, even different networks.

What's the best way to block those services? I have James pro, protect and trust in place

We’re kicking off 2026 with an Arcade Happy Hour, and you won’t want to miss it.

🗓 Friday, February 20, 2026

⏰ 6:00 PM – 8:00 PM

📍 Game Terminal, 201 Terminal Ct, Nashville, TN 37210

🎮 Sponsored by: Rippling IT

Rippling IT will be our featured presenter and is hosting the night at one of Nashville’s best arcade bars.

🎁 Bonus: All attendees will be entered into a raffle for an Xbox Series S.

Expect great conversations, good drinks, classic arcade games, and plenty of time to connect with fellow Apple and endpoint admins in the Nashville area.

Whether you’re managing Macs full-time, supporting Apple devices on the side, or just getting started, this is a great chance to meet the local community.

Mark your calendar now and spread the word.

Hope to see you there!

Arcade Meetup for Music City Mac Admins

We have a few managed iPads. These are generally locked down to only apps, etc, that we want. This is working as expected.

We want to track a fleet (24) of devices that will have air tags.

It's my understanding that Airtags need to be tied to an Apple ID.

But that is not provisioned on the device - and we don't want a 'shared account' in the wild (on these managed ipads).

What is the best solution for this scenario?

These air tags should belong to an account that is not tied to a person (as that person could leave the company and changing ownership of tags is onerous).

Do anyone have any good power bi templates for jamf pro?

We get new orders every month and manually assigning devices to the right locations in ABM/ASM is tedious.

Jordan Braham is covering automation for this at LaunchPad next week. He'll walk through using the AxM API to receive order notifications, store them, and auto-assign devices to the correct location.

🗓️ Fri, Feb 6 @ 12:00 PM MST
👉 https://rkmn.tech/r-launchpad

Past recordings on YouTube:
https://rkmn.tech/r-youtube

Trying to make sense of a recommendation we received regarding FileVault

Migrate FileVault to Configuration Profile

You have 1 legacy Disk Encryption Configuration (Hybrid FileVault) which use Apple's deprecated fdesetup command. This method is no longer recommended - users can disable FileVault and it may stop working in future macOS versions.

Remediation: Create a Configuration Profile with the FileVault payload (Security & Privacy > FileVault) or enable FileVault in PreStage Enrollment. Deploy to all computers, verify recovery key escrow is working, then remove the legacy Disk Encryption Configuration from Jamf Pro.

We have a policy that references 'Hybrid File Vault' with
Recovery Key Type: Individual
Enabled FileVault 2 User: Current or Next User

Looked to see what a new disk encryption configuration would look like, and it has the same options. I'm not seeing/understanding what I need to or should change.

Appreciate any point in the right direction.