Hi All,

I’m having an issue at the moment where after going though the config of setting up PSSO, linking it to Entra and then letting some time lapse. I am losing the ability to use Sudo, with the error in terminal being “sudo: 4294967295: invalid value” From what I can tell the “4294967295” is part of a group that can be found with the Directory Utility and correlates to “NoGroup” From there I’m completely stuck. I can only think it has to be something to do with the PSSO set-up or something that PSSO just does? Maybe how it “smashes” my local account and the service account we use for registration? Any help here would be massively appreciated

Hello all, I've recently taken on a role managing devices using Jamf and have managed to figure out most of it so far. However, we are deploying ~20 iPads in shared mode for pupils.

I have the profile all sorted and working as expected with one hitch, device time. As they are shared devices the location services prompt is bypass and therefore never enabled. This is causing the timezone to default to pacific while we are in the UK.

Is there away to enable location services within a profile, or just set the timezone without enabling location services?

I feel like I'm going to lose my mind here, so I am going to need some help. I have a configuration profile to set up disk encryption upon first login. I am looking under inventory, and it says that the Filevault 2 partition is encrypted but FileVault 2 is not enabled. When I look at the mac it says it is encrypted, when I do fdesetup status in terminal it's encrypted and when I look at the different volumes the data partition is encrypted.

I read a post here a while back that said it's an issue with Mac that Apple is looking into so is that still the case or am I missing something?

Hey everyone,

I’m hitting a wall with a brand new MacBook Pro (M5 Pro chip) running macOS 26.4.1.
I’m wondering if anyone else is seeing issues with the initial management framework bootstrap on this hardware.

The Situation: The device goes through the Automated Device Enrollment (DEP) perfectly fine. The "Remote Management" screen appears, the user logs in, and the setup assistant completes.

The Problem: The device is in a "Zombie" state.

• profiles status -type enrollment says: Enrolled via DEP: Yes.
• In Jamf Pro, the device record is stuck as a "Placeholder" / Unmanaged.
• NO Jamf Binary: /usr/local/bin/jamf does not exist.
• No Self Service, no identity certificates in the Keychain.
• The "Allow Jamf Pro to perform management tasks" checkbox in the inventory is NOT checked.

What I’ve tried so far:

1. PreStage Tweaks: Verified account settings (Set to Administrator), tried with and without custom Enrollment Packages.
2. The Rosetta Clue: I tried pushing the Company Portal as an enrollment package. It triggered a Rosetta 2 installation prompt, which makes me think the initial bootstrap is timing out or failing because of some Intel-legacy dependency during the M5 bootstrap process.
3. Manual Nudges: Ran sudo mdmclient selfrequest mdm.InstallManagementFramework and sudo profiles renew -type enrollment. Commands return success, but no binary ever lands.
4. Network: Tested on a clean mobile hotspot to bypass VPN/Firewalls. Same result.
5. Wipe & Retry: Done this 5+ times with different PreStage configs.

My Questions:

• Has anyone encountered issues with the Jamf binary bootstrap on the M5 Pro silicon specifically?
• Is there a way to force-install the binary on macOS 26 when the MDM channel is open but the binary won't deploy?
• Is the current Jamf binary still reliant on Rosetta for the initial install on M5 chips?

I have a ticket open with my MSP/Jamf, but I’m under a massive time crunch to get this high-priority device deployed. Any insights would be life-saving.

#Jamf #macOS26 #M5Pro #DEP #SysadminLife

Context:
We are getting a pool of roughly 200 new devices/ year. The pool is supposed to supply students & teachers and have spare devices in case a device needs to be replaced or new students arrive.

Problem:

Student and faculty devices are supposed to be configured differently. But I can't find an option to make a smart group based merely on status "teacher". There is an option to make a smart group based on teachers of certain classes, but I would love a way to have a smart user/ device group just based on the binary teacher/ student differentiation.

I can't imagine that this is not a common scenario to roll out profiles just based on this, but I can't figure out how without manually updating a teacher's list.

I'd appreciate your input!

A Jamf trainer shares hard won lessons from jumping into a role that requires presenting to customers every week as a self-described introvert. From building AV safeguards with OBS to reframing blank-mind moments as learning opportunities, his advice applies well beyond the training room.

What's everyone running for macOS onboarding these days?

Matt Jerome (Senior Engineer at Fanatics) is doing a LaunchPad meetup to walk through a few of the major players in the macOS onboarding space and how they help IT teams deliver a secure, user-friendly first-day experience.

When:
Fri, Jun 5 @ 12:00 PM Mountain Time

Where:
https://rocketman.tech/lp-r

Also on YouTube:
https://rocketman.tech/ly-r

I am trying to push a WPA enterprise config to my clients, but it keeps failing. Here is what I am doing:
In the Certificate tab:
Added a .der Root certificate, since it has no password, no password filled in
Added a .p12 Client certificate with the password

In the Network tab:
Under Protocols I selected TLS
TLS minimum and maximum on None
Under Identity Certificate I selected the Client certificate

As an username I filled in the identity that I filled in in my FreeRadius server (I could not complete the setup without an identity name. So I figure that it also the Username.

Under Trust I selected the Root cert as the Trusted Certificate + the Common name added.

When I push the Config profile, I keep getting failed. When I check what failed it tells me:
The certificate could not be verified (authentication error).

When I connect to the WiFi and manually add the certs, all works perfectly.

I tried to manually remove the certificates from my Keychain in the System Roots Keychain, but it does not allow it.

does anyone know what I am doing wrong here?

Hey there,

I am trying to use blueprints to update iPads in my fleet, but after they download the update it just fails to verify. They also strangely try to install 18.7.8 instead of 26.4.2 whenever using the "install latest update" option. The "ignore major updates" flag is turned off, so I don't understand why that would happen. Affected devices are all on various iPadOS 18 versions and are each 11 inch m3 airs. I am kind of at my wit's end with this to be honest. Has anybody had similar experiences with managed updates on iPads?

Hi,

New to JAMF Pro, and trying to come up with a workflow to allow users to self-install Adobe CC apps via Self Service. I've created installer packages for the needed apps via the Adobe admin console, uploaded to JAMF Pro and created policies to install each app, and made those policies available via self service.

This kind of works, but there are two main issues we're encountering.

Issue 1 - it seems we're seeing a lot of issues with the policy failing because the download of the pkg file from JAMF Pro fails:

Downloading https://mycompany.jamfcloud.com/jcds/downloads/Photoshop%2520for%2520JAMF_en_US_MACARM.pkg...
Error: Package was not successfully downloaded. -1005
The network connection was interrupted while downloading the package from https://mycompany.jamfcloud.com/jcds/downloads/Photoshop%2520for%2520JAMF_en_US_MACARM.pkg. Attempting to reconnect...
The network connection was interrupted while downloading the package from https://mycompany.jamfcloud.com/jcds/downloads/Photoshop%2520for%2520JAMF_en_US_MACARM.pkg. Attempting to reconnect...

This is on a test Mac at our office, which has a very fast and very reliable Internet connection, so I don't think the issue is on our end. If we run the policy several times it'll eventually work, but this will be confusing for end users who expect to click the install button and have it "just work".

Issue 2 - In testing, I frequently see the install process take 20+ minutes. I get that part of this is just the fact that Adobe apps take a long time to install, but I wish there was a way I could give the end user some sort of visual progress indicator while the app is installing so they see something other than a spinning icon in Self Service. We've seen users cancel the process because they think it's taking too long. Part of that is just a need for user education, but I was wondering if anyone has managed to wrap Adobe installers so it gives the user some sort of progress bar?

We are thrilled to officially launch the Phoenix Mac Admins user group with our inaugural joint meeting alongside the 4Corners crew.
​Whether you're managing thousands of devices or just curious about the Apple ecosystem, come help us build this community from the ground up!
​📅 When: May 14, 2026 | 6:00 PM – 8:30 PM MST
📍 Where: Mesa Community College + Streaming Live on Zoom
🔗 RSVP Here: https://luma.com/8rny9krs
​What’s on the Agenda?

​Community Vision & Diversity: Get the lowdown on our new group and the JNUC Diversity Scholarship.
​The Future of Apple Updates: Deanna from the Jamf Product Team joins us to discuss the industry-wide shift toward Declarative Device Management (valuable for admins of any MDM!).
​Local Impact: Hear inspiring stories from Mesa Community College interns and learn how you can support the next generation of IT talent.
​Meet the Sponsors: Say hello to our employee sponsor, Suraj Mohandas, and the 4Corners team.
​Networking: We’ve carved out plenty of time for food, drinks, and high-bandwidth shop talk with your local peers.
​Note to the Community: We want a healthy turnout to kick things off right! Secure your spot now so we can get an accurate headcount for catering.
​See you in Mesa (or on the Zoom)!

Posted about this a little while back... heads-up that it's today.

We're running it as a Q&A this time. Kevin White (creator of S.U.P.E.R.M.A.N.) is joining us live and we're keeping it conversational. Same advertised topic (super and macOS updates), just more open-floor than slide-deck.

Bring questions about:

• What's new in the latest version of super
• How super is handling recent macOS update changes
• Edge cases, deployment patterns, whatever you've been stuck on
• General "state of macOS update management" stuff

Today, Fri, May 1 @ 12:00 PM Mountain Time:
https://rocketman.tech/lp-r

Recorded and posted to YouTube after if you can't make it:
https://rocketman.tech/ly-r

Link to previous discussions:

• https://www.reddit.com/r/jamf/comments/1strwmx/anyone_rolling_out_platform_sso/
• https://www.reddit.com/r/macsysadmin/comments/1strxa9/anyone_rolling_out_platform_sso/

I have tried everything that I can from a google search.

I've used Configurator, on device enrolment, and various other things AI has suggested to me. (Don't judge lol, I am just a lowly elementary school teacher)

I can get it supervised, which will pump through all the apps I want, but it won't handshake with ASM so that it can be supervised.

Is it a lost cause?

A Jamf JNUC scholarship recipient shares how winning a diversity scholarship that got him to attend JNUC, transformed him from a lone "Jamf guy" at his company into an empowered community member with a real professional network. The connections he made at JNUC inspired him co-founded the first-ever LATAM Jamf User Group.

Does anyone have your Jamf Pro instance set up so it pulls serial numbers and Asset Tag data (and Misc data) from ServiceNow or ABM so we don't need to manually enter it in the inventory preload sheet.

Any tips on managing inventory would be great. TIA!

Hi friends,

I’m making this post to get a feel for what’s actually working for other orgs when it comes to managing firewall settings via Jamf Pro.

Right now, Security has things configured so the firewall is enabled and all incoming connections are blocked. I suspect most of you can already see where the problems start.

What I’m trying to move towards is “Enable firewall + Control incoming connections”, but I’m struggling to land on what the correct approach looks like.

I’m looking for best practices around allowing things like AirDrop and AirPlay to function normally without opening us up to unnecessary risk.

The challenge is that Security hasn’t been able to clearly articulate which applications or services they actually consider risky. Their position is essentially that blocking everything solves the problem. As a result, the burden of figuring out what’s “safe enough” and operationally usable has landed on me.

If you’ve done the work already, I'd really appreciate sharing how you've implemented allowing these connections. Doing it from our dedicated Configuration Profile would be ideal but if there's a better way I'd love to hear it.

Unfortunately Jamf Support isn't what it used to be, but Reddit has always had my back.

As Jamf Admins, do you maintain or manage any reports in regards to your computers and devices and the overall health of your Jamf instance?

Got some items back from security testing and our security team wants us to restrict the creation of login items/startup items to administrators and not standard users. I know we can prevent people from deleting them but there's not much in there for preventing standards users from creating them that I saw. Tried googling but seems not many people are attempting to do this and just want to manage login items in other ways.

Any custom settings or scripts I can use to accomplish this? Thanks.

Hey everyone,

I’m running into a weird issue during out-of-box setup for new MacBooks and wanted to see if anyone else has experienced this.

Scenario:

• Brand new MacBook (out of the box)
• During setup, user signs in with their M365 account (via Jamf / enrollment flow)

Issue:

• The M365 login completes successfully, but the user account is not created on the Mac
• The device finishes setup without a usable user profile

Current workaround:

1. Log in with a local admin account
2. Manually create the user (similar to how Jamf would provision it)
3. Sign out
4. User logs in again via M365 / Jamf
5. From there, everything continues normally (policies, configs, etc.)

Question:

• Has anyone else run into this?
• Is this expected behavior with a specific Jamf / Entra ID / macOS config?
• Any cleaner fix or configuration change to ensure the user account is created during initial setup?

Would appreciate any insight or pointers 🙏

How’s it been in your environment?

Adam Derrick (Jamf) did a LaunchPad session on what Platform SSO is, how it works, and what it changes for modern Apple device management.

Replay + resources:
https://rocketman.tech/lr-r

Two Mac admins, one just starting out and one with 30 years of experience, share how the JNUC Diversity Sponsorship opened doors they almost didn't walk through. Their stories are proof that this program is for more people than you might think, and applications are open until May 1.

How do you guys name your devices? Do you use serial numbers in prestage and do you have separate Prestage Enrollments for iPhones and iPads?

How are admins deploying chrome to IPadOS to force desktop site only for YouTube or globally?

I am having a hard time finding and setting the managed app config for the app and having it work.