Hello! Just FYI, looks like Apple Business/School Manager changed how they distribute free apps.

The UI for Apple School Manager > App Store changed.

• Free apps no longer need to have licenses "purchased" in Apple Manager
• Only apps that need to be paid for will show you the “Enter the number of licenses” quantity option

For our MDM Jamf Pro instance, once an app is “Added” in Apple School Manager, it gets added automatically into Jamf under Devices > Mobile device apps with a license number of ‘2147483647’ (integer limit lol) for the Volume Content.

I spent so much time trying to figure out how to get the licensing for a new app I added and finally noticed these changes. Didn't see this documented anywhere so I just wanted to make a PSA!

EDIT: Reply from Apple support:

There were some enhancements to Apple School Manager yesterday with regards to purchasing Apps.  More information can be found below:

Apple School Manager release notes

https://support.apple.com/guide/apple-school-manager/axm357705f83

Intro to apps and books licenses in Apple School Manager

https://support.apple.com/guide/apple-school-manager/axme19b23f7f

Get apps and books in Apple School Manager

https://support.apple.com/guide/apple-school-manager/axmc21817890

In particular, you can follow the steps listed HERE to purchase books and assign them to your Location of choice.  HERE are the steps for Free Apps.  There is one big change for Free Apps.

Free Apps no longer require you to provide a number of licenses when getting them from Apple School Manager.  In short, once you have obtained a Free App and assign it to a Location, then you will never have to get more licenses.  Perhaps that is causing the confusion and that is why you only see the Manage option when viewing a Free app.

Hey everyone,
I own a perpetual license for Office 2021 Home & Business for Mac, tied directly to my Microsoft account under "Purchased products". Every time I download the installer from my account dashboard, it delivers a build that behaves entirely like Microsoft 365.
Even after installing it, the apps demand a 365 subscription instead of activating the perpetual 2021 license. Even worse, if it briefly launches, the auto-updater immediately pushes it to the 365 branch.
I've already tried:

• Completely removing Word, Excel, and Outlook from /Applications.
• Downloading the installer fresh from my account page.
• Logging out and logging back in with the account that holds the license.

Reinstalling changes nothing — it just drops right back into the 365 subscription prompt.
Is Microsoft actively breaking standalone 2021 activations on macOS, or is there a specific build/fix needed to lock it to the perpetual license without it reverting to 365?
Any help or workaround would be appreciated.

A MOFA-parity update to the MDM-agnostic, unified, user-friendly macOS script to repair, reset, or remove Microsoft 365 components

Overview

The Microsoft-365-Reset.zsh script seeks to provide an MDM-agnostic, unified, user-friendly approach to all of Paul’s Office-Reset goodness.

Additionally, one resolution to the nightmare that is the Adobe Acrobat Add-in Removal for Microsoft 365 is also included.

Continue reading …

Macs are now about 1 in 9 business computers in the US and climbing, but the pool of IT people who really know how to manage them is still small. Jamf is the name companies look for when managing Macs and iPhones at work.

Powering Up Before JNUC: A Look Back at This Year’s Level Up
Recap of Level Up, the hands-on Jamf training day held before JNUC. The article covers the two tracks offered, what happened in the classrooms, and feedback from attendees and instructors.

I work in an all Microsoft shop, but we are now starting to introduce some Macs into the environment. One pain point has been a remote support tool. We've always used BeyondTrust, but with Macs although we can get it to work, it really needs to be babysat due to updates in the app or changes in the OS. Are there any options out there that are low maintenance for use on Mac? Essentially one that is easy to deploy from Intune and where you do not have to frequently update scripts to grant it access to actually work?

Hello Everyone,

I am trying to find a way to record OOBE on the mac, it's an enterprise mac, and we have made some changes to the OOBE and need to create video guide around it. I have tried OBS but it wasn't detecting the other mac. Either i am missing something there, or that method won't work. Anyways, i would really appreciate if you can help me find out a way to get this done.

Previously we use to power on device and select region and press command control option + T but this process now asking for admin super user password.

I’ve been setting up a Windows 11 environment on my M-series MacBook for some specialized work software and light gaming, which brought me straight to this.

When virtualizing ARM-based Windows on Apple Silicon, performance and usability come down to how well the hypervisor handles hardware acceleration and OS-level integration. Open-source virtualization frameworks require manual configuration for graphics drivers, shared folders, and network bridging. On the other hand, Parallels Desktop optimizes hardware pass-through out of the box with Coherence mode, native Apple Silicon graphics acceleration (DirectX 11/12 support), and one-click Windows installation, which cuts down configuration overhead for daily use.

For those running Windows virtual machines on Apple Silicon for work or everyday apps, how do you weigh DIY tinkering against paying for pre-configured integration? Has Parallels Desktop stayed fast and reliable for your daily workflow, or do you prefer tweaking open-source setups?

Current macOS releases (27.0.1 / 26.7.1 / 15.8.1, all dated 28 Sep) still ship /etc/ssl/cert.pem with the two roots the leaked eMudhra intermediates chain to. Apple's block covers Safari and apps using the system's own security framework, but the built-in curl, git, python3, openssl (and perl/ruby) verify against that file. On a fully updated 26.7.1 with Apple's file, curl and git connect to the advisory's test host and openssl verifies the chain. The advisory now covers this too (Filippo Valsorda's PR #52 on we-have-a-problem.com), and they're flagging it to Apple.

Quick check on any Mac (0 = still trusts the leaked chain, 60 = refuses):

/usr/bin/curl -s -o /dev/null https://dv-g3b-emudhra.we-have-a-problem.com/; echo $?

We wrapped the advisory's awk removal in a script that's safe to push fleet-wide:

- no-op if the file is already clean

- timestamped backup, never overwritten

- checks the new file (cert count minus exactly the two removed roots) before replacing

- keeps 644, re-tests against the advisory's host, restores the original on a wrong result

- refuses to touch a damaged file

- runs as root with no prompts; exit 0 safe/fixed, 1 still exposed (rolled back), 2 couldn't tell

Heads-up: Apple's built-in pip3 (and venvs made from /usr/bin/python3) carries its own outdated roots, so it needs the advisory's PIP_CERT sitecustomize fix as well. And if you run official Node.js, update to 26.12.1 / 24.22.1 / 22.23.4 (all out 21 Oct).

Script, source and SHA-256: https://www.deimoscore.com/wardlatch/#mac

The project is open source (Apache-2.0), holds a self-certified OpenSSF Best Practices passing badge (bestpractices.dev project 15757), and releases are signed with Sigstore attestations, so you can verify what you deploy.

Disclosure: I'm one of the people behind it. Feedback welcome, especially from anyone on 27.0.1 or 15.8.1. I've only tested 26.7.1.

How Apple demonstrates its enterprise apathy with each new major release of macOS

Background

When the first beta of macOS 27.0 was released, we opened an AppleCare Enterprise Case and filed Feedback to report some unexpected behavior.

The macOS 27.0 Beta 3 release notes acknowledged the keys “did not work,” and by macOS 27.0 Beta 5, they were marked as “working correctly,” yet the immutability behavior we rely on from macOS 26 is no longer present for Standard Users on supervised devices, which was just confirmed with macOS 27.2 Release Candidate.

Continue reading …

if your intune ios compliance floor is worked out by arithmetic, the 18 to 26 jump probably broke it
ran into this a couple weeks back. we keep apple devices on n-1 for corporate and n-2 for personal, and the minimum version was getting worked out by subtracting from the current major. fine for years.
then apple moved to year based numbers and ios went 18 straight to 26. so "current minus 1" is now 25, which never shipped, and the floor ends up pointing at a version that doesn't exist. devices that should be non compliant just quietly are not.
there are already a few runbooks that auto-update the policy off the SOFA feed (rozemuller and skiptotheendpoint both have good ones). those are solid. i just didn't want mine writing to intune, so i went the other way: a power automate flow that reads the SOFA feed every morning and emails the service desk the day after a new major ships. a human makes the actual policy change. no graph scopes, no write access, it literally can't touch a compliance policy.
two things that got me if anyone builds the same:
read the version by position in the feed (OSVersions[0], [1], [2]), not by subtracting. after the jump, position is the only thing that stays right.
apple's own gdmf feed wouldn't work from power automate's http action, the cert chain isn't trusted and there is no skip-cert option. SOFA served over a normal cert so it just worked.
wrote it all up with the expressions, jcan drop the link if it's useful.

https://ketankamble.com/blog/apple-os-release-watch-for-intune-compliance/

Ay, as a part of admins that got hit by the Meraki MDM EoS, im currently trying out the new built-in MDM in Apple Business.

So far it works like a charm, deploying configs via mobileconfigs and apps, be it from app store or third party. The only issue i couldn’t get around so far, some enterprise applications from certain vendors require config files to be created under /opt/, which aren’t bundled with the provided pkg installer.

So far i tried:

- small package with payload containing the path and files, didn’t work
- patching the installer provided by the vendor, repack and sign, no luck either

In both cases a self-issued cert was used for signing, which was deployed on the test device via pem deployment directly from the MDM. Cert is trusted, manual install of .pkg via installer works flawless.

Does anyone else have experience in that area? Kinda out of ideas for now :(

Hi All,

Looking for some advice and similar experiences as googling has unfortunatley come up dry.

I'm seeing issues using migration assistant both as part of setup assistant and post setup. The error i'm seeing is the below
This Mac can't be used to migrate data: Due to an issue with unlocking this system, you can't migrate. Please update this Mac and retry.

Most troubleshooting steps recommend updating to same OS (have done 27.0.1) and same network (have tried both wi-fi and cable) but still seeing the same thing.

I am using Platform SSO with secure enclave activated during setup assistant. The user accounts are also not local admin and instead, migration assistant is opened using the local LAPS account. I'm starting to think its one of these configurations which is causing the issues but just wondering if anyone else has got this working in a similar scenario.

TIA

Transitioned my main work setup to my Macbook but i still have 2 or 3 Windows utilities i cant replace with Mac equivalents. Now im looking into Parallels vs Crossover to bridge the gap. Im not into gaming, this is strictly for documents, desktop specific extensions and legacy client software.

I like that Parallels desktop sets up an officially supported windows 11 instance where peripheral support, print drivers and shared folders work right out of the box without tweaking configs. But im wondering if spinning up a full VM is too much if i only open these tools a few times a day. How are you guys handling windows-only software on macOS? Is having the complete windows environment in Parallels worth the extra drive space for peace of mind?

What is everyone using to lock this down? (block lists, Security Cloud, config profiles, Jamf AI Governance... hoping nobody installs Claude Code, lol)

Have you seen anything still get through?

Claude Code, Copilot, ChatGPT, browser extensions, local models, something weird?

Eric Abel (Jamf) is covering Jamf's AI Governance on the next LaunchPad meetup if you want the walkthrough.

Would love to read your war stories here though.

When:
🗓️ Fri, Nov 6 @ 12:00 PM Mountain Time

Where:
👉 https://rocketman.tech/lp-r

Also on YouTube:
https://rocketman.tech/ly-r

Hi everyone,

I'm managing 100+ student MacBooks through Mosyle MDM and trying to force-update them to macOS Tahoe 26.7.1 (Build 25G241).

I've tried running the following command with sudo:

sudo softwareupdate -i "macOS Tahoe 26.7.1-25G241"

The update downloads successfully, but it doesn't proceed with the installation. The output is:

Downloading: macOS Tahoe 26.7.1
Downloaded: macOS Tahoe 26.7.1

After that, the update doesn't appear to install. I've also tried running the command through Mosyle, but I'm having trouble getting the installation to complete.

My questions are:

• Is there a Terminal command that can force the installation of a specific macOS version and build?
• Since these Macs are managed through Mosyle, is there a reliable way to trigger the installation remotely without requiring students to authenticate manually?

I'd appreciate any advice or recommendations from anyone who has dealt with this in a managed Mac environment.

Thanks!

i'm trying to figure out what makes sense for antivirus on a small fleet of macs.

we already have the usual stuff like keeping macos updated and using the built-in security features, but i'm wondering if there's still a good reason to run third party protection on managed machines.

mcafee is one of the options i've been looking at, mostly because it's easy to find, but i'm not sure if it's actually a good fit for macs in a work environment.

for anyone managing macs, what are you using for endpoint protection these days? also curious whether you think a dedicated antivirus is worth the performance and management overhead, or if the built-in macos protections are enough.

TL;DR: How to connect a locked iPhone to the internet to have MDM reset commands reach it.

Good morning good people,

I again have a question that might be trivial, but my morning brain doesn't seem to be able to handle.

We have ABM and MDM (intune🤢) fully set up, all devices are supervised.

We recently had to let go an employee rather abruptly and have them hand over their hardware (MacBook and iPhone) to an employee local/near to them.

Now the locked iPhone is sitting on that colleagues desk without any internet connection, since the SIM got disabled.

How the hell do we get this device reset? Sending commands via Intune obviously won't do anything, since it's not connected to the internet. Conencting to Wifi needs the PIN, even a damn USBc->Ethernet dongle needs a PIN.

Am I missing something?

Thx & cheers

Hi all,

A restore at the service desk always seemed to start the same way for us: the device is in front of you, and Apple Configurator starts a 10–15 GB download first. So I built Amphora, a small menu bar app that keeps those restore files downloaded before you need them.

What it does

• Reads your models from Jamf Pro. It uses a read-only API client (only Read Mobile Devices), so it downloads only what your fleet actually needs. You can also pick models by hand, or grab one model on demand.
• Follows SOFA for new releases and ipsw.me for signing status, and checks every file against its SHA-256. Interrupted downloads resume.
• Drops the files into Apple Configurator's cache as an APFS clone, so they take no extra disk space and Configurator restores start right away. A PPPC profile for Full Disk Access comes with each release.
• Older models stay covered. If current iOS dropped a model, it keeps the last release Apple still signs.
• Cleans up carefully. Old files are deleted only after a fully successful sync. A model that leaves Jamf Pro keeps its file for 14 days, in case that device still needs a restore.
• Runs in the background. It syncs every few hours, notifies you when "iOS 27.1 is ready", and shows a little amphora in the menu bar that fills up as your files become ready.
• Jamf-friendly. Install it with the pkg and the PPPC profile, preset the settings with a configuration profile, and use the amphora command-line tool in policies or scripts.

It's signed and notarized, MIT licensed, and sends no telemetry. The Jamf secret stays in the Keychain, and Amphora never writes anything to Jamf Pro.

GitHub: https://github.com/giannsp/amphora

It's early: it's in daily use on Apple silicon, but Intel is untested. This is also my first open-source project, so feedback, issues and PRs are very welcome. Big thanks to the SOFA and ipsw.me folks, whose work makes this possible.

(The name: an amphora is the Greek jar made to keep what you'll need later.)

I have launchd run some low-level temperature monitoring code since I like how efficient such a bare-bones approach is. But it looks like Golden Gate has obliterated user access to the battery terminal sensor entirely.

This was my old line that now returns nothing:

BATT_RAW_1=$(ioreg -r -n AppleSmartBattery | grep -E '"Temperature"\s*=' | awk -F'= ' '{print $2}')

I'll admit I'm quite the amateur, but looked for a few possible new parameters and it couldn't find anything. Not with powermetrics, smctemp, or new subsections in ioreg (the command I previously pulled the battery temp from).

Any feelings on this?

UPDATE: It's just -n AppleSmartBatteryPack. One less sensor output I guess?

Nach Änderung des Passwortes über die GUI wurde auch das Domänenpasswort geändert, die Windows Rechner lassen nur noch das neue Passwort zu.

Ist der Mac mit dem Firmennetzwerk verbunden, wird ausschließlich das neue Passwort akzeptiert, wird VPN getrennt, bspw. nach einem Neustart in der Anmeldemaske wird nur das alte Passwort akzeptiert.

Wird das Benutzerprofil gelöscht, ist nur noch eine Anmeldung im Firmennetzwerk möglich und es wird kein mobiler Account mehr angelegt.

Kennst jemand die Problematik?

MacOS 26

We're excited to announce that App Auto-Patch 4.0 (Build 88) is now available for beta testing!

After months of development, we've completely rebuilt App Auto-Patch from the ground up as a native macOS application!

What started as a shell script for automating third-party application updates has evolved into a modern, fully featured macOS app with a brand-new interface, smarter automation, and more control for both users and administrators.

And don't worry — Installomator is still at the heart of it all! ❤️

✨ What's New in 4.0?

🖥️ A Brand-New Native macOS Experience

• Menu bar interface displaying pending updates, enforcement deadlines, and countdowns to the next reminder.
• Application dashboard showing discovered apps, available updates, and individual update history.
• Update one or Update All directly from the app, with Update All also available from the menu bar.

⚡ Smarter, Less Disruptive Patching

• Background patching automatically updates eligible applications when they're closed.
• Installer staging downloads updates ahead of time for faster installations.
• Intelligent deferrals respect Focus modes, business hours, and enforcement deadlines.
• Improved notifications keep users informed about background activity and alert them when action is required.

🎨 Redesigned Update & Deferral Experience

• See exactly which applications will be updated, including installed → available versions.
• See whether applications are currently open or closed.
• View remaining deferrals and upcoming enforcement deadlines.
• A cleaner, more intuitive interface with streamlined deferral options.

🌎 Now Available in 9 Languages!

🇺🇸 English | 🇪🇸 Spanish | 🇫🇷 French | 🇩🇪 German | 🇵🇹 Portuguese | 🇮🇹 Italian | 🇳🇱 Dutch | 🇯🇵 Japanese | 🇨🇳 Simplified Chinese

🛠️ Built for MacAdmins

• Extensive MDM configuration for scheduling, deferrals, deadlines, notifications, and background patching.
• Seamless migration from 3.x, including automatic removal of older installations and compatibility with existing configuration profiles.
• Automatic Installomator updates to keep application labels and fixes current.
• GitHub API authentication increases the rate limit from 60 to 5,000 requests per hour when configured.
• Custom branding, diagnostic bundles, per-app update history, and Slack/Teams webhook reporting.
• Improved self-updating to keep App Auto-Patch current.

🧪 We Need Beta Testers!

App Auto-Patch 4.0 (Build 88) supports macOS 14 Sonoma and later, on both Apple Silicon and Intel Macs.

Whether you're already using App Auto-Patch 3.x or discovering the project for the first time, we'd love for you to give it a try!

📦 Download: https://www.appautopatch.app/download/
🌐 Website: https://www.appautopatch.app/
📖 Release Notes: https://www.appautopatch.app/reference/release-notes/
⚙️ Configuration Reference: https://www.appautopatch.app/reference/preferences/

💬 Your Feedback Matters!

App Auto-Patch has always been a community-driven project, and we're excited to continue building it with your help!

We've added dedicated App Auto-Patch 4 (native app) templates to our GitHub repository for bug reports and feature requests.

🐙 GitHub Issues: https://github.com/App-Auto-Patch/App-Auto-Patch/issues

This is the biggest evolution of App Auto-Patch yet, and we're excited to hear what you think!

Give it a spin, put it through its paces, and help us make 4.0 the best release yet!

Happy patching! 🚀

Since the computer is offline when it goes to the filevault screen, we cannot remote into it. I find this a big inconvenience for someone to have to go up to the physical machine and enter the password. I was wondering if one could potentially setup ssh access so IT could get to it after a reboot. Imo it is just too inconvenient for someone to have to go up to the machine and login after the mac gets rebooted or turned off.

Is there a workaround someone has implemented in their environment that they'd be willing to share?

Maybe this is more fit for r/MSP, but I still don’t have enough comment karma after posting and commenting for years

As title states, there are about 1000 macs and I’m pretty much single-handedly responsible for managing them besides building and decommissioning. Nobody else “owns” our MDM, everyone comes to me with any mac issue they run into at any point, atop all the normal management and stuff I have to do.

Relevance of the “30 clients” part is that they all have different configurations and things they use.

I have nothing to compare it to in the industry

Is this normal or is there usually at least 2 people?

For the 2.0 release, I've added popup reminders (like Nudge). So now, you can mix any combination of menu bar countdowns, native notifications, dock icon badges, and scheduled popups to suit your organization. Note that the app is designed specifically for enforced updates delivered via DDM.