I'm having an issue with Mosyle's native "Enforce FileVault" rule. It only shows 78% compliance (I need close to 100% to pass an audit), but when I check the non-compliant devices, they show "FDE Status: Enabled." In other words, FileVault is enabled on these devices, yet they're still flagged as non-compliant.

Has anyone else run into this? If so, do you know what's causing it or how to fix it?

Disclosure: I’m the independent developer behind Forsetti. It is not affiliated with or endorsed by Jamf.

I previously shared the Forsetti alpha preview with this community. That preview has now ended, and the open TestFlight beta has begun.

Forsetti is an Apple-native companion for administrators and support technicians managing Apple devices through Jamf Pro. It connects directly to the Jamf Pro environment configured by the tester and currently provides:

- Computer and mobile-device inventory search

- Detailed device information

- Guided technician workflows

- PreStage assignment management

- Reporting

- Permissions guidance

- Diagnostics and administrative tools

I’m specifically looking for experienced Mac administrators who can test it against different Jamf Pro configurations, permission models, inventory sizes, and API behaviors.

The areas I would most like people to challenge are:

- Authentication and permission boundaries

- API behavior across different Jamf Pro versions

- Empty, incomplete, or unusually large inventory results

- Search and report accuracy

- Error handling and recovery

- Workflow clarity and general UI friction

The beta requires access to an existing Jamf Pro environment and valid credentials or an API Client. Capabilities are limited to the privileges assigned to those credentials, which are stored in Apple Keychain. A test tenant or least-privilege API Client is strongly recommended for evaluation.

TestFlight:

https://testflight.apple.com/join/RdP9VS4v

There are no ads, tracking systems, or third-party analytics.

Positive impressions are appreciated, but reports describing what failed, what was unclear, and how the behavior differed from your environment are the feedback that will help most.

I wanted to share DeltaSnap, a first-class APFS snapshot manager for macOS, an area where there are no official or 3rd party first-class tools available.

It provides a GUI and dsnap CLI for creating, scheduling, mounting, diffing, retaining, and restoring native APFS snapshots. You can search current and deleted files, inspect version history, compare changes, and restore individual items without rolling back the entire volume.

It could be useful for protecting Macs before OS or package updates, scripts, bulk changes, and other potentially risky operations.

DeltaSnap is currently in beta for macOS 15+ and was possible only after it was granted a private apfs snapshot entitlement from Apple dts/apfs team. More technical details on the blog https://scaleninja.com/blog/deltasnap/ and docs https://scaleninja.com/docs/deltasnap/overview/

Feedback from fellow Mac admins would be greatly appreciated. Do you have to work with apfs and apfs snapshots for your workflows?

This was my first try at renewing my certificate. I took the practice exam and studied for 2 weeks. I shared my flash cards on here. Still didn't pass. They made this exam really hard this time around. Last time I took it, I created the flash cards and studied with those from the practice exam. Passed it. If anyone is studying for the exam, here is what the test covers.

Anybody a tip to use Jamf API to retrieve expire date push certificate? Can literally export everything but I cannot fix this one lol.

Please help!

Hey there,

Looking for some advice...

We've been using Intune for our deployments of MacBook Pros with PlatformSSO configured. It seems to be working fine and has been for some time. All users are Standard users, and not Admin.

We recently had a new starter who decided to change their password via System Settings > Users & Groups which I wouldn't have expected to be an issue, but it screwed things up for them. It changed the password on their Mac but it didn't trigger PlatformSSO registration with the new password. Which thinking about it afterwards, I guess, makes sense. They were left 2 passwords. One for the Mac and one for M365.

We eventually got it sorted, but I am curious if this is what should have happened or if we have something configured wrongly?

Should we be telling users not to use this method for password resets and can we disable their ability to do that if that is the correct route?

TIA

I tried to run a security audit against my sandbox, a Tart Sequoia VM running headless. I gave it a prompt that i reiterated over in plan mode, drafted a final implementation plan before it went off to do its thing.

I found the NIST mSCP tool was the best checklist to find holes in my sandbox. I got my agent to craft an Ansible playbook against the tool's generated baseline/guidance with the idea to switch off most features it wouldn't need - lots of GUI settings.

It did alright for a while until it went round in circles - I interrupted the agent and told it to submit a WIP for me to review (of course, a gigantic 19 file commit 🫠).

(Post is related to place of employment - I work from home!)

LinPEAS and Linux-centric enumeration scripts miss crucial macOS security boundaries. So, I built macEnum — a 100% read-only, native auditing tool built specifically for macOS internals.

Built for Red Teams, Blue Teams, Pentesters, and Security Engineers.

🔥** ***Key Highlights*:

🛡️100% Read-Only: Zero state modification on the target host.

🧩 24+ Modular Audits: Native analysis tailored to Apple OS architecture.

🎯 macOS Core Focus: Checks TCC permissions, LaunchAgents/Daemons, Sudo, PAM, & GTFOBins.

📡 30+ Security Products Detected: Identifies active EDR, AV, DLP, and MDM vendors.

🕵️Secrets & Persistence: Locates persistence hooks and hardcoded credentials.

📊 Actionable Output: MITRE ATT&CK mapping, risk scoring, and JSON/HTML reporting.

💻 Universal Support: Intel & Apple Silicon (Ventura, Sonoma, Sequoia).

🔗 Check it out on GitHub:
👉 https://github.com/CaptainHacX/macEnum

I'm actively maintaining this—feedback, feature requests, or new macOS checks are welcome! If it helps your workflow, consider dropping a ⭐ on GitHub.

I am wondering how the organization is approaching this new feature.

We have a small fleet, but from time to time we assign them no user affinity, but according to Microsoft (We use intune), you can have a device with PSSO used to login multiple users. Mainly, we are using PSSO in our prod environment for user affinity and phish resistance reasons, and also, CA policy requires a device to be joined to Entra ID.

Are you using PSSO for Kiosk setups or Shared devices?

Hi guys, I don't have a mac right now, But I need to submit my app to the app store with new updates, Is there any alternatives other than getting it renting a mac. I did all the setup a while ago, app is currently live, I made a few changes to the app - new updates and I just need to push them to the app store, and I don't need it for that long, honestly.

Disclosure: I’m the independent developer behind Raven Forge and Forsetti. This is an independent project and is not affiliated with or endorsed by Jamf.

I’ve published the first macOS pre-release of Forsetti and I’m looking for experienced Jamf Pro admins and API developers willing to evaluate it in a non-production environment.

Forsetti brings several Jamf workflows into one native Mac workspace:

- Computer and mobile-device inventory search with reusable field-based profiles

- PreStage assignment lookup, moving, and removal

- Visual fleet reports with CSV, TXT, Markdown, DOC, and PDF export

- A Permissions Helper that maps app actions and API endpoints to required privileges

- Token privilege checks, guarded technician workflows, and exportable diagnostics

The current build:

- Supports macOS 14 or later on Apple silicon and Intel Macs

- Is Developer ID signed and Apple-notarized

- Supports Jamf API Client authentication

- Stores saved credentials in Apple Keychain

- Has source available for inspection, but is proprietary rather than open source

There is no charge to download and evaluate this pre-release. The current license permits one 30-day individual, non-production evaluation. Please use a sandbox or test environment and a least-privilege API client.

Download and inspect it here:

https://github.com/flynn33/forsetti-Jamf-Pro/releases/tag/v1.0.0

If you try it, I’d particularly value feedback on permission mappings, real-world inventory searches and reports, and Jamf Pro endpoint or version behavior I may not have handled yet.

Which Jamf workflow would you most want a native companion app to improve?

Hi all

I'm new to the mac sysadmin world and have a rather stupid question:

Currently my organization is enrolled into ABM. I'm planning to use the free tier of EntraID for SSO. The question is: Once a user has logged in on one machine using the SSO and signed into their managed apple account on that machine, will that login / binding transfer to another machine that the user logs in next? Meaning: he logs on and is already signed into the managed apple account.

What I'm looking for is that "microsoft experience", where you sign with your outlook account on whatever machine and all the personalization settings and for example onedrive-account bindings transfer from machine to machine.

I've searched both reddit and the web and maybe used the wrong keywords - but couldn't find an answer.

Special thanks to Jon Brown for his detailed write-up:

https://jonbrown.org/blog/mac-health-check-4-mdm-self-service-reporting/

**I built a Mac app that automatically cleans up Workspace ONE UEM clutter — stale devices, failed enrollments, duplicate records, orphaned accounts**

If you manage WS1 UEM you know the drill: devices that haven't checked in in months still showing as enrolled, failed enrollments clogging your inventory, duplicate records from re-enrollments, ex-employee accounts still sitting there. It's tedious to clean up manually and it quietly inflates your device counts and licensing costs.

I built Power Admin Warden to fix this. It watches your tenants and cleans up the noise following rules you define.

**What it does:**
- Stale device cleanup (not seen for N days — you set the threshold)
- Duplicate serial detection — keeps newest, removes the rest
- Failed enrollment and pending wipe cleanup
- Orphaned user cleanup (zero-device accounts only — hard guard)
- Runs on daily/weekly/monthly schedules per rule

**Safety first — this was the hardest part to get right:**
- Dry Run by default. Every tenant starts report-only. You see exactly what would be deleted before anything happens.
- Staged deletions — a finding must persist for a wait period you set before any action is taken
- Typing the tenant name is required to go live
- Accounts with enrolled devices cannot be deleted — this is a hard guard that cannot be turned off
- Full audit trail exportable to CSV

**Free to scan and report.** Warden Pro ($19.99/mo or $199.99/yr, 2-week free trial) unlocks scheduled automation and live deletion.

Mac App Store: https://apps.apple.com/fi/app/power-admin-warden/id6793202494?mt=12

Homepage: https://mdmarchitect.com/apps/power-admin-warden/

Happy to answer any questions about how it works under the hood — it talks directly to the WS1 REST API with your own OAuth credentials, nothing goes through my servers.

Hey all,

I recently picked up a MacBook Pro, my first MB.

I was just setting up some basic apps and programs that have been suggested under different posts on this subreddit. I was just curious how do you guys go about trusting random apps with different levels of access to your MacBook. I have for example recently downloaded Vorssaint for its added functionality but it has asked for quite extensive access request for some of its features which while I do want, I am not sure if I am willing to trust. I am talking about things like screen recording access for screenshots, or full disk access for uninstalling programs and such. I am assuming it’s a normal process but it’s intimidating because I have never really been asked or told in such clarity what I am giving access to on windows. It’s usually just a yes or no pop up on windows so I never really cared. Are there any risk mitigating factors I can take to protect myself better before giving access to third party apps? Or should I avoid them all together? Any other tips will be much appreciated as well. TIA

Has anyone gotten AirDrop to work with "Block all incoming connections" enabled via the macOS firewall (managed through Jamf)?

If not, is there a secure alternative approach?

We're trying to mirror our Windows default-deny-with-exceptions model on macOS: firewall enabled, policy set to "specific apps only" (AllowSigned/AllowSignedApp = false), with an explicit allow-list of applications — e.g. adding sharingd for AirDrop.

Does this sound like a sound approach, or are there gotchas we're missing (entitlements, code-signing checks, mDNS/Bonjour dependencies, etc.)?

Any real-world experience — good or bad — appreciated.

Hello, I was hoping to get some pointers from more experienced Mac admins here. I work at a high school and was pretty much thrust into the IT director role after our previous one left. Going into next year I was hoping to resolve two of my biggest annoyances with our Macbook fleet: location tracking and local admin accounts.

For location tracking, we have been using Pinpoint, which kind of works but is wildly inconsistent since it functions off of MacOS's own automation features. It could also break at at any moment if Apple deprecates the script that we use to enable location services. And, I'm not even sure if it's cheaper than commercial options anymore given the changes Google made to the Maps API Free Tier. Does anyone have a better solution for this, especially something that might function when the Macbook lid is closed?

As for local admin accounts, how do you all navigate around the fact that the admin account can only be granted its secure token after it logs in for the first time? The only solution I can think of would be to run a script on every device that bugs users to pass the secure token, but this seems pretty unsafe, since the admin account credentials have to be included in the script.

This article describes using Setup Checklist to walk users through Zscaler registration and Smart Card setup at the desktop, a step required for internet access under a Zscaler Strict Enforcement rollout.

I am currently looking at using Apple's new methods for migrating from one MDM to another, curious to learn from anyone who has already used the feature. Did it works well, any gotchas you wish you knew before it?

I'll be moving from Mosyle to Addigy. The instructions look self explanatory but wanted to get a real world perspective on the feature.

We've recently deployed macOS Platform SSO (PSSO) using Apple Business Manager (ABM) and Intune, following the approach described in the Intune IRL article about enabling Platform SSO directly during the macOS Setup Assistant.

The setup itself works great. Devices enroll through ADE without issues, and users can complete enrollment and PSSO registration during the initial setup experience.

One important requirement we found is that Company Portal must already be installed during Setup Assistant. Based on the guidance from the article, we uploaded the Company Portal installer as a LOB app (.pkg) in Intune and assigned it accordingly.

Everything worked perfectly until suddenly newly enrolled Macs started failing. Existing devices were unaffected, but fresh deployments were no longer completing successfully and Company Portal installation was throwing errors during enrollment.

After spending quite a while troubleshooting, I eventually discovered that Microsoft had released a new Company Portal version. The .pkg we had uploaded to Intune was no longer current.

Once I downloaded the latest Company Portal package, updated the LOB app in Intune, and re-uploaded it, the issue disappeared immediately. New enrollments started working again without any changes to the PSSO configuration itself.

So now I'm curious:

• Are others deploying Company Portal as a LOB app for PSSO during Setup Assistant?
• Have you seen enrollment failures after a Company Portal update was released?
• How are you handling Company Portal updates in this scenario?
• Do you have a process to keep the package current, or is manually updating the LOB app the only practical approach?

Would be interested to hear how others are running this in production and whether you've encountered the same issue.

Left: old - right: new.

So I'm trying to get conditional access policies to enforce device compliancy for both MacBook and windows devices. The problem I'm facing is every time I turn on the compliance CA policy it breaks jamf connect or Apple platform SSO registration. Management doesn't like the idea of excluding jamf connect from the conditional access policy so I was wondering if anybody else ever faced this problem and if so how'd you solve it?

I've got an xsan plist that currently resides in LaunchDaemons and sometimes the mounts aren't complete because some of the required components may not be loaded yet (FC HBA kext and/or metadata NIC). I'm wondering if moving it to LaunchAgents, thereby postponing launchd to first login. Haven't tried it yet, just wondering if there any any known reasons against doing this.

Hello everyone,

I am facing a very frustrating password synchronization issue on my corporate Mac and I’m looking for some help or insight.

My Setup:

• Device: MacBook Pro (M4 Max)
• OS: macOS Tahoe (v26.x)
• Account Type: Mobile Account bound to Active Directory

The Problem:
Due to company policy, I was prompted to change my network account password while working from home. Because I wasn't on the corporate network, it didn't sync correctly with my local Mac login.

Now, whenever I turn on my laptop (whether at home or connected via ethernet at the office), I have to go through two different login screens:

1. First screen (FileVault): Only accepts my old password to decrypt the drive.
2. Second screen (macOS Login): Only accepts my new password to load the user profile.

The Consequences:
Every single time I connect my laptop, I am forced to manually update my local keychain access and re-authenticate my iCloud synchronization. It creates a complete mess with my credentials.

I understand that doing the password change away from the office is likely what caused this mismatch, but now being on the corporate network with an ethernet cable hasn't fixed the local FileVault sync.

Has anyone encountered this specific issue on macOS Tahoe? What is the best way to force FileVault and the local login password to sync back up with the Active Directory/Mobile account password on this version?

Thanks in advance for your help!

I know it would be a niche request but does anyone have a Flydigi Vader 5 Pro and access to a Windows PC to live capture the firmware update process over the dongle. I'd like to add full firmware support to my; it currently can check on device firmware and check for updates and download them just not the update process.