Latest Jamf 100 Flashcards
(206 cards)
1
Q
What is Jamf Pro?
A
A mobile device management (MDM) solution designed to manage Apple devices in an enterprise environment.
2
Q
What are the core functions of Jamf Pro?
A
Deployment, configuration management, application management, security enforcement, device inventory and monitoring.
3
Q
Why use Jamf Pro?
A
Centralizes management, reduces manual configuration, and simplifies deployment, security, and app management at scale.
4
Q
What is Automated Device Enrollment (ADE)?
A
Automated Device Enrollment (ADE) is an Apple service—part of Apple Business Manager (ABM) or Apple School Manager (ASM)—that automates the enrollment of Apple devices into an organization’s Mobile Device Management (MDM) system like Jamf Pro, right when the device is first turned on.
5
Q
What systems integrate with Jamf Pro for ADE?
A
Apple School Manager (ASM) and Apple Business Manager (ABM).
6
Q
What is manual enrollment?
A
A process to enroll devices not part of ADE, done via the Jamf Pro server using user credentials.
7
Q
What are Smart Groups?
A
Dynamic device groups that update automatically based on set criteria.
8
Q
What are Static Groups?
A
Manually created groups for custom device management.
9
Q
What are configuration profiles?
A
Jamf Configuration Profiles are a key feature in Jamf Pro used to manage settings and enforce policies on Apple devices (macOS, iOS, iPadOS, and tvOS). They allow admins to configure things like Wi-Fi, VPN, security settings, restrictions, and more—without needing to touch the device.
10
Q
How are apps deployed using Jamf Pro?
A
Through the Volume Purchase Program (VPP), allowing bulk deployment of apps.
11
Q
What is Self Service in Jamf Pro?
A
A user portal to install apps, profiles, and settings without IT help.
12
Q
What can security policies in Jamf enforce?
A
Passcode complexity, encryption, remote lock/wipe.
13
Q
How are non-compliant devices monitored?
A
Through Smart Groups and compliance status reports.
14
Q
What does the Jamf Pro Dashboard show?
A
A high-level overview of device health, compliance, and installed apps.
15
Q
In what formats can reports be exported?
A
CSV, PDF, and Excel.
16
Q
Name 4 remote commands Jamf Pro can send.
A
Lock, wipe, restart, reboot.
17
Q
What’s the purpose of Remote Lock and Wipe?
A
Protect or erase data on lost or stolen devices.
18
Q
How can Jamf Pro help troubleshoot a device?
A
Reviewing logs, profiles, and configuration details.
19
Q
What is important for Jamf Pro Server maintenance?
A
Regular backups and updates.
20
Q
Where can Jamf Pro be hosted?
A
On-premises or in the cloud.
21
Q
What are admin roles used for?
A
To control access and permissions for different users.
22
Q
What is Zero-Touch Enrollment?
A
Automating device setup without user interaction.
23
Q
Why customize the Self Service portal?
A
To ensure users can easily access approved resources.
24
Q
What is an App Sandbox?
A
A self-contained environment where iOS apps run.
25
How do you access Control Center on iPhone X or later?
Swipe down from the top right.
26
What informs users of potential in-app costs?
The “In-App Purchases” label.
27
What does the command ls do?
Lists contents of a directory.
28
What file extension is used for property list files?
.plist
29
What does Command-Space bar do on macOS?
Opens Spotlight.
30
What does MDM allow organizations to do?
Wirelessly configure, update, and deploy content to devices.
31
What certificate is needed for MDM/APNs communication?
A push certificate.
32
What file types can be exported from inventory search?
TSV, CSV, XML.
33
What does a configuration profile without a scope apply to?
All devices.
34
What wildcard can be used in a simple search?
*
35
What happens when you issue a Lock Computer command?
Logs out the user, restarts the computer, and sets a firmware passcode.
36
What determines when a policy runs?
The policy's trigger.
37
Can configuration profiles be scoped to categories?
Yes.
38
What does the Settings app on iOS and iPadOS allow users to do?
View device info, customize preferences, and manage settings.
39
How does the iPadOS Settings app compare to the iOS version?
It's functionally and organizationally similar.
40
What does signing in with an Apple ID enable?
Access to Apple services like iCloud and the App Store.
41
Is using an Apple ID required?
No, but some features won't be available without it.
42
What can Jamf Pro do with iOS/iPadOS settings?
Customize and restrict settings to enforce standards.
43
Where are commonly accessed settings located?
Near the top of the Settings list (e.g., Wi-Fi, Bluetooth).
44
What can be found in the General > About section?
Device name, software version, storage capacity, etc.
45
What is the purpose of the Software Update section?
Enable automatic updates and install available updates.
46
What does the Transfer & Reset section do?
Prepares the device for transfer or erases all content.
47
What can be customized in Touch ID/Face ID & Passcode?
Services that use biometrics, passcode settings, and lock timer.
48
Where can users configure settings in macOS?
System Settings.
49
What can Jamf Pro do with macOS settings?
Manage and enforce them.
50
Do settings names vary by macOS version?
Yes.
51
What is found in General > About on macOS?
Device name, OS version, storage, and more.
52
What does the Software Update section allow?
Enabling and installing system updates.
53
What’s the purpose of the Transfer & Reset section?
Move data or erase all content.
54
What info does the System Information Application provide?
Hardware, network, and installed software details.
55
What can users manage in Privacy & Security settings?
Location, camera/mic, screen recording, FileVault.
56
What is required to change locked settings?
Administrator credentials.
57
What does the search field in System Settings do?
Helps find specific settings quickly.
58
How many volumes do iOS/iPadOS devices have?
Two: system volume and data volume.
59
What is stored in the system volume?
The operating system and system data.
60
What is stored in the data volume?
User data (encrypted if a passcode is set).
61
What does Shared iPad do with storage?
Creates separate data volumes for multiple users.
62
What is an app sandbox?
An app sandbox is a security mechanism in macOS and iOS that restricts what an app can do and what data it can access.
63
What is app data?
App data refers to the information that an app stores or uses to function properly. This can include:
🔹 **User Data:**
* Preferences
* Login info
* Saved files or documents
🔹 **Configuration Data:**
Setup details
🔹 **Cache**
🔹 **Database Files:**
Local databases (like SQLite) that store structured info
In Jamf Pro, "app data", often refers to the metadata Jamf pulls in from the App Store — like:
* App name
* Version
* Description
This data helps IT admins manage apps more easily, automate updates, and deploy the correct versions. User-generated content like high scores or documents.
64
Where can app data be stored?
Locally or backed up to iCloud/servers.
65
What happens to local app data when an app is deleted?
It is removed, but cloud backups may remain.
66
What file system does macOS use by default?
APFS (Apple File System).
67
How many volumes are in the default APFS container?
Five.
68
💽 What Is Stored in the System Volume? (macOS)
On macOS, **the System Volume contains the core operating system files.** It is a read-only, sealed volume introduced with macOS Catalina (10.15) and later, as part of Apple’s System Volume and Data Volume structure for better security.
⸻
📦 **Stored in the System Volume:**
* The macOS operating system itself
* System apps (like Safari, Terminal, Mail)
* Frameworks and daemons required for the OS to run
* Core libraries and system resources
69
What is stored in the data volume?
User files, documents, and user-installed apps.
70
What is SIP (System Integrity Protection)?
A security tech protecting core system files.
71
What processes can modify SIP-protected areas?
Only Apple-signed processes (updates/installers).
72
What does Disk Utility do?
Views and modifies disk volumes.
73
What are the four root directories in macOS?
Applications, Library, System, and Users.
74
Who has access to the Shared directory?
All users on the Mac.
75
What info is found on an App Store app page?
Description, user reviews, and app privacy info.
76
What is required to install apps from the App Store?
An Apple ID.
77
How do you install an app from the App Store?
Tap “Get” or purchase, then confirm installation.
78
How do you install apps from the internet on macOS?
Download, open the disk image, and follow instructions.
79
What is Gatekeeper?
A macOS feature that checks downloaded apps for threats.
80
How do you delete an app on iOS/iPadOS?
Long press > Remove from Home Screen or Delete.
81
How do you delete an app on macOS?
Drag it from the Applications folder to the Trash.
82
How can Jamf Pro manage apps on devices?
Deploy or restrict apps without needing personal Apple IDs.
83
What are examples of macOS preferences?
Dock layout, browser home page, light/dark mode.
84
Where are app preferences stored in macOS?
In property list (PLIST) files.
85
What is the format and extension of PLIST files?
XML format, .plist file extension.
86
What app can properly display binary-formatted PLIST files?
Xcode.
87
What macOS feature previews PLIST files without editing?
Quick Look (press Space on selected file).
88
Where are system-wide preferences stored?
/Library/Preferences.
89
Where are user-specific preferences stored?
~/Library/Preferences.
90
How can you access the hidden user Library folder?
Go to Finder > Go menu > hold Option key.
91
What macOS process may delay writing preferences to disk?
cfprefsd
cfprefsd = Core Foundation Preferences Daemon
Purpose:
• It reads, writes, and manages system and user preferences on macOS.
• Works behind the scenes when you change system settings, app preferences, or configurations.
• Apps and the system use it to access or modify .plist (property list) files that store preferences.
⸻
Key Details:
• Launched automatically by the system.
• Located at: /usr/libexec/cfprefsd
• Runs as multiple instances: one for each user and one for system-level settings
92
How does Jamf Pro manage PLISTs?
Jamf Pro manages PLISTs using:
1. Configuration Profiles (Custom Settings payload)
2. Scripts (defaults or PlistBuddy commands)
3. Deploying raw PLIST files via policies or packages
93
What does MDM allow organizations to do?
Remotely configure, secure, and deploy content to devices.
94
How does Jamf Pro communicate with devices?
Through Apple Push Notification service (APNs).
95
What are the steps of MDM communication via APNs?
1. Jamf Pro contacts APNs
2. APNs notifies device
3. Device contacts Jamf Pro
4. Device confirms success to APNs
5. APNs confirms to Jamf Pro.
96
What is declarative device management?
**Declarative Device Management (DDM)** is a more efficient way for devices (like iPhones, iPads, and Macs) to **manage themselves more independently**, with **less constant back-and-forth with an MDM server.**
In simple terms:
* Old way (“traditional” MDM):
The server tells the device everything it must do — and the device keeps asking the server, “What next? What next?”
* New way (Declarative Device Management):
The server gives the device a set of rules, conditions, and goals.
The device can then act on its own, checking if it meets the goals and reporting status updates automatically — without needing constant server instructions.
⸻
97
What is needed for MDM communication?
A push certificate, renewed yearly.
98
Why use an organizational Apple ID for push certs?
It ensures continuity and access for renewals.
99
✅ MDM Commands Work When:
* **P – Powered** on
- R
* **A – APNs** configured
* **I – Internet** access
* **S – Supported** command
* **E – Enrolled**
100
What features of Jamf Pro rely on MDM?
* Remote commands,
* configuration profiles,
* app deployment
* Security Commands
* Remote Management Commands
* Inventory Collection
* Self Service (on mobile devices)
101
What does APNs allow for in MDM?
Remote management of Apple devices.
102
What happens if a device is offline?
It cannot receive MDM commands.
103
What are Apple Business Manager and Apple School Manager used for?
1. App/book license distribution
2. Automated enrollment
3. Managed Apple ID creation.
104
What are Managed Apple IDs used for?
Managed Apple IDs are used to **give users access to Apple services (like iCloud, iWork, and Shared iPad)** in a way that’s controlled and managed by an organization, such as a school or business.
🚫 What They Can’t Do:
**Can’t be used to purchase media from the App Store, iTunes Store, or Apple Books.**
105
What does GSX integration allow?
View warranty details in Jamf Pro.
106
Are all services globally available?
No, availability varies by country/region.
107
What is Jamf Pro?
Jamf Pro is a comprehensive Apple device management solution designed for IT administrators to manage macOS, iOS, iPadOS, and tvOS devices across an organization.
**Key Features** of Jamf Pro:
**- Device Enrollment**: Automates the setup and configuration of new Apple devices using Apple’s Automated Device Enrollment (formerly DEP).
**- App Management**: Distributes and manages apps through the App Store, custom apps, or third-party sources.
**- Configuration Profiles**: Applies settings and restrictions to devices (like Wi-Fi, VPN, email configurations).
**- Inventory Management**: Collects detailed hardware and software data from each managed device.
**- Self Service**: A customizable app where users can install pre-approved apps, run scripts, or access resources.
**- Security Management**: Enforces security settings, remotely locks or wipes devices, and monitors compliance.
108
Where can Jamf Pro be hosted?
Jamf Cloud or on-premise.
109
What info does the Jamf Pro Dashboard show?
1. Enrolled devices
2. Smart group counts
3. Policy and config statuses
4. Patch management reports.
110
How do users customize the JAMF Pro dashboard?
For Example:
**To Add a Smart Group to the Dashboard:**
1. Go to Computers or Devices > Smart Computer Groups (or Smart Mobile Device Groups).
2. Create or edit a Smart Group.
3. In the settings, check the option “Display on Dashboard.”
4. Save.
📊** Common Dashboard Items:**
* Smart computer groups
* Smart mobile device groups
* Policies
* Configuration profiles
* Patch management data
* Inventory data (e.g., device counts)
111
What are the four primary sidebar sections in Jamf Pro?
Computers, Devices, Users, Settings.
112
What does the Computers section manage?
Mac inventory and configurations.
113
What does the Devices section manage?
iPhones, iPads, Apple TVs, Vision Pro, Apple Watches.
114
In Jamf, what is the Users section for?
**Purpose:**
➡️ Manage user data
➡️ Link users to devices
➡️ Control access and targeting
🧩 Key Uses:
**1. Directory Integration**
🔗 Connects to LDAP, AD, or Azure AD to pull in user info.
**2. User Assignments**
👤 Assign devices to specific users for tracking and personalization.
**3. Scoping**
🎯 Target policies, profiles, and apps to users or groups.
**4. Self Service**
🛍️ Customize access to content based on users.
**5. Enrollment**
📝 User-initiated enrollment links users and devices from the start.
115
What can you do in the Jamf Settings section?
**Think “JAMF-SING” 🎶**
* J – Jamf user accounts
* A – APNs/MDM setup
* M – Management settings
* F – File distribution
* S – Security
* I – Integrations
* N – Network config
* G – Global preferences
116
📚 What Is the Resource Center in Jamf Pro?
The **Resource Center is a built-in help and learning hub** inside Jamf Pro. It’s designed to give you quick access to:
📖 **Guides and Documentation.**
🎓 **Training Resources**
🆕 **Release Notes**
🛠️ **Support Resources**
💡 **Best Practices**
117
👥 Where to Manage Jamf User Accounts:
1. Go to ⚙️ Settings in Jamf Pro.
2. Under “System Settings,” click on “User Accounts & Groups.”
118
What are Jamf user accounts used for?
**Jamf user accounts control who can log in to Jamf Pro and what they’re allowed to do once inside.**
* Access control (who can log in)
* Permissions (what actions they can perform)
You can also think of it as:
**User accounts = keys + rules**
(Keys = login access, Rules = allowed actions)
119
What are the four main privilege sets in Jamf Pro?
1. Administrator (full access)
2. Auditor (read-only)
3. Custom (Privileges are manually selected)
4. No Access (User has no permissions; enrollment only access)
120
What are user groups used for?
**Jamf user groups are used to organize users and assign the same permissions to multiple users at once.** Instead of setting privileges one-by-one, you can do it for the whole group.
⸻
🔑 Key Uses:
* Assign roles and privileges to many users easily
* Manage access based on teams or job roles (e.g., IT staff, Help Desk)
* Can include local or directory (LDAP) users
⸻
🧠 Quick Summary:
**User groups = permission shortcuts for managing many users at once.**
121
What happens if a user is in multiple groups?
If a user is assigned to multiple groups, every privilege from those groups is available to that user.
122
🗂️ What Are Categories Used For in Jamf Pro and Self Service?
Categories are used to organize items like apps, policies, profiles, and scripts in Jamf Pro and Self Service.
123
What determines the display order of categories in Self Service?
Category priority—lower numbers have higher priority.
124
What are buildings and departments used for in Jamf Pro?
**Buildings and departments** in Jamf Pro are used to:
- organize devices and users based on physical location or organizational structure,
- helping with inventory management,
- reporting, and
- targeting specific policies or configurations.
125
Can a device belong to more than one building or department at a time?
No, only one building and one department per device.
126
What is the goal of Automated Device Enrollment?
To integrate Apple Business/School Manager with Jamf Pro for automatic device setup and enrollment.
127
🚀 What Is a PreStage Enrollment in Jamf Pro?
**PreStage Enrollment** is a setup process in Jamf Pro that **automates and customizes how Apple devices are enrolled** in MDM (Mobile Device Management)
128
🤖 What Is Required for Zero-Touch Deployment in Jamf Pro?
Zero-touch deployment means a device can be fully set up and managed without IT physically handling it.
✅ Requirements:
1. Apple School Manager or Apple Business Manager (ASM/ABM)
🏫/🏢 Where devices are purchased and assigned to your MDM.
2. Automated Device Enrollment (ADE)
🔁 Connects ASM/ABM to Jamf Pro for automatic enrollment.
3. Jamf Pro instance
🖥️ The MDM that receives the device and applies your configurations.
4. PreStage Enrollment configured in Jamf Pro
⚙️ Defines how the device should behave during setup (skip screens, apply settings, etc.).
5. Device must be assigned to Jamf Pro in ASM/ABM
📲 Ensures the device knows to contact your Jamf server.
6. Internet connection on first boot
🌐 So the device can contact Apple and start enrollment.
⸻
🧠 Quick Summary:
Zero-touch = Device ships → connects to Wi-Fi → enrolls in Jamf → auto-configured.
129
What kinds of devices can be added automatically to Apple Business/School Manager?
Devices purchased through business or education channels.
130
What is user-initiated enrollment?
A method where users enroll their own devices into Jamf Pro after Setup Assistant.
131
Is supervision enabled with user-initiated enrollment on iOS?
❌ No, supervision is not enabled by default with user-initiated enrollment on iOS.
⸻
🧠 Here’s Why:
* User-initiated enrollment means the user manually enrolls the device (usually by visiting a Jamf URL).
* On iOS, this method does not grant supervision.
* Supervision gives IT more control over the device (e.g., silent app installs, restrictions).
* To enable supervision, you must use Automated Device Enrollment (ADE) via Apple School/Business Manager and a PreStage enrollment in Jamf.
⸻
✅ Summary:
Supervision is only enabled on iOS with Automated Device Enrollment — not user-initiated.
132
Is supervision enabled with user-initiated enrollment on macOS 11 or later?
✅ Yes, supervision is enabled with user-initiated enrollment on macOS 11 (Big Sur) or later — but only for M1/M2 (Apple silicon) or T2 chip Macs.
⸻
🧠 Key Points:
* On macOS 11+, when a user manually enrolls their Mac via user-initiated enrollment, the device can be supervised.
133
Can users remove management from supervised, user-initiated enrolled devices?
Yes, users can remove management from devices enrolled via user-initiated enrollment, even if the device is supervised.
134
What URL is used for user-initiated enrollment?
[Jamf Pro server URL]/enroll (or :8443/enroll for on-premise servers).
135
What do simple inventory searches in Jamf Pro use?
⚙️ They Use inventory fields, like:
* Device name
* Username
* Serial number
* Operating system version
* Model
* IP address
Basic matching (e.g., “is,” “contains,” “starts with”)
136
What symbol is used as a wildcard in Jamf Pro searches?
The asterisk (*).
137
How often do inventory updates occur by default?
📱 For iOS/iPadOS Devices (like iPads) in Jamf Pro: inventory update once every 24 hours.
🖥️ For Computers (macOS devices) in Jamf Pro inventory update every 7 days
138
What service does Jamf Pro use to send remote commands?
Apple Push Notification service (APNs).
139
What do advanced searches in Jamf Pro allow?
Advanced searches let you filter, sort, and export detailed data about your devices using custom criteria.
140
What does the operator “Like” do in an advanced search?
The “Like” operator is **used to find partial matches** in fields
141
How can multiple criteria be grouped in a search?
Using parentheses.
142
What are some common mass actions?
* **Send Remote Commands, like:**
* Update Inventory
* Lock Device
* Wipe Device
* Restart Device
* Enable Lost Mode (iOS)
* Clear Passcode (iOS)
***Install Configuration Profiles
* Install Apps (macOS or iOS)
* Remove MDM Profile (if allowed)
* Send Messages to macOS users**
143
What are the two types of device groups in Jamf Pro?
Static groups and smart groups.
144
How is membership managed in static groups?
Manually added or removed.
145
What defines membership in a smart group?
A smart group is a dynamic group in Jamf Pro — **devices or users are added automatically based on criteria you set.**
146
Give an example of a static group.
A classroom cart of iPads or test devices.
147
What does a Smart Group do?
🧠 Summary:
A smart group updates itself automatically based on live criteria — no manual work required.
📌 For Example: Devices that need Zoom app installed automatically.
Smart Groups automatically includes all devices that do not have Zoom installed.
* If a device installs Zoom later, it’s removed from the group.
* If a new device checks in and doesn’t have Zoom, it’s added.
This is perfect for scoping policies (like installing Zoom) only to the devices that actually need it.
148
Where can group membership be monitored in Jamf Pro?
From the Jamf Pro Dashboard.
149
What does scope define in Jamf Pro?
Which devices receive a management task.
150
What are the three parts of a scope?
Targets, Limitations, Exclusions.
151
🎯 What do Targets do in a Scope?
**Targets** are the **primary group** of devices or users you want to **include** when scoping something (like a policy, app, or profile).
152
What do limitations do?
Narrow down the target group of who receives the item.
153
What do exclusions do?
Remove devices from the scope—overriding both targets and limitations.
154
In Jamf, what are configuration profiles used for?
**Configuration profiles are used to define and distribute settings and restrictions to managed Apple devices** (macOS, iOS, iPadOS, tvOS). These profiles let you control device behavior without needing to manually configure each one.
Here’s what configuration profiles are typically used for:
* Wi-Fi settings – Automatically connect devices to specific networks.
* VPN settings – Configure secure remote access.
* Email settings – Preload email accounts with server details.
* Security settings – Enforce passcodes, encryption, and firewall rules.
* Restrictions – Limit device features (e.g., disabling the App Store or camera).
* App and device management – Set preferences for apps, system behavior, and device access.
155
Where are installed profiles located on macOS?
General > Device Management in System Settings.
156
What service is used to deploy configuration profiles?
Apple Push Notification service (APNs).
157
What payloads are commonly used in configuration profiles?
Passcode, Restrictions, and Wi-Fi.
158
What does the General payload contain?
he General payload defines the **basic info and behavior** of a configuration profile—such as Name, Description, Level and Scope
159
Can you include multiple configurations of the same payload?
No, you can’t include multiple configurations of the same payload (like two Wi-Fi settings) in one Jamf profile. Instead, create separate profiles for each configuration.
160
Should unrelated payloads be combined in a single profile?
No—use separate profiles to reduce complexity.
161
What are the two ways to distribute App Store apps in Jamf Pro?
"Make Available in Self Service" and "Install Automatically/Prompt Users to Install."
162
What is managed app distribution?
Managed app distribution in Jamf refers to **the way apps are deployed, owned, and controlled by the organization on Apple devices** using Mobile Device Management (MDM).
🔑 Key points:
* Apps are assigned to devices or users through Apple’s Volume Purchasing (via Apple Business/School Manager).
* Apps are owned by the organization, not the user.
* Apps can be automatically installed, updated, or removed remotely.
* Users don’t need an Apple ID to install these apps.
* Jamf can reclaim and reassign app licenses when a device is unenrolled or a user no longer needs it.
📦 This ensures easy, centralized control of apps across all managed devices.
163
Why use managed distribution?
✅ Why use managed distribution?
**1. No Apple ID required**
→ Users don’t need to sign in to the App Store—apps just show up on the device.
**2. Central control**
→ IT admins can remotely install, update, or remove apps at any time.
**3. License management**
→ Easily track, reassign, and reclaim app licenses using Apple Business/School Manager.
**4. Silent installs**
→ Apps can be installed without user interaction—ideal for classrooms or company devices.
**5. Better user experience**
→ Fewer steps for users and no personal Apple account issues.
**6. Security**
→ Ensures only approved apps are installed and managed properly.
💡 In short: **It gives organizations full control over app deployment, without relying on users to take action.**
164
How does Jamf Pro get app data for deployments?
It syncs with the App Store.
165
Can apps be updated automatically through Jamf Pro?
Yes.
166
What does the Software Updates feature in Jamf Pro allow?
Remote deployment and installation of software updates.
167
Where is the Software Updates feature accessed?
Computers > Software Updates and Devices > Software Updates.
168
What are the three components of an update plan?
1. 🎯 **Target –**
The **device or group of devices** you want to update.
(e.g., a smart group of Macs running macOS 13.)
2. ⚙️ **Action –**
The **type of update behavior** you want to apply.
(e.g., download only, install immediately, or schedule install.)
3. 🔢 **Version –**
The **specific OS or app version** you want to deploy.
(e.g., macOS 14.4.1 or a specific version of Pages.)
169
What update options are available in an update plan?
🛠️ Update Options Available in an **Update Plan**:
**1. Download Only**
⤷ Downloads the update to the device, but does not install it yet.
**2. Install Later**
⤷ Prompts the user to install the update at a later time.
**3. Install Tonight**
⤷ Prompts the user to schedule the install overnight.
**4. Install Now**
⤷ Immediately installs the update (may cause a restart).
**5. Notify Only**
⤷ Sends a notification that an update is available, but takes no action.
**6. Schedule Update with Deferral (macOS only)**
⤷ Allows you to configure a deferral period (e.g., users can postpone the update for a certain number of days).
170
Can Jamf Pro install an older version of software?
No, Jamf Pro cannot install an older version of Apple software (like macOS or iOS) using standard MDM commands.
171
What happens if a device is off during an update plan?
It gets a prompt to install the update when turned on or reconnected.
172
What is a policy in Jamf Pro used for?
**A policy is used to automate 📝 tasks and 📱💻 manage devices by performing specific actions** on Macs, iPads, and other Apple devices.
🛠️ What is a policy used for?
Policies are used to:
* Install software (e.g., apps, packages, updates)
* Run scripts (like cleanup tasks or custom configurations)
* Configure system settings
* Enforce security (e.g., set passwords, enable FileVault)
* Perform maintenance (e.g., run inventory, reboot, flush logs)
* Deploy printers, printers, or network settings
* Trigger events (like on login, check-in, or manually)
173
What are some common tasks performed with policies?
Installing software, running scripts, adding printers.
174
What tool does Jamf Pro use to run policies?
The jamf binary (does not require APNs).
175
What policy is created by default in Jamf Pro?
✅ “Enrollment Complete” policy
📦 What does it do?
This policy is triggered immediately after a device is enrolled and is meant to:
* Kick off initial setup tasks
* Run scripts or configurations
* Install apps or profiles needed right after enrollment
176
What are the four fundamental components of a policy?
Content, Trigger, Execution Frequency, and Scope.
177
Can policies be added to the Jamf Pro Dashboard?
Yes, for easier monitoring.
178
What happens when you flush a policy log?
The policy can run again at the next trigger.
179
What payload must be configured in all policies?
The General payload.
180
What does the Local Accounts payload do?
Creates, deletes, or resets local user accounts.
181
🛠️ What can the Maintenance payload do?
**1. 📝 Update Inventory**
* Sends updated system info (like OS version, installed apps, storage, etc.) to Jamf Pro.
**2. ♻️ Flush System Caches**
* Clears temporary files and caches to help resolve app or system issues.
**3. 🧼 Reset Printing System**
* Removes all printers and resets the printing subsystem.
**4. 🔄 Update or Run macOS Software Updates**
* Prompts the Mac to check for and install available Apple software updates.
**5. 🔁 Repair Disk Permissions** (macOS 10.10 and earlier)
* Fixes file permission issues. (Note: Not available on modern macOS versions.)
182
Why use caution with frequent inventory updates in policies?
It's a resource-intensive task.
183
What is Jamf Self Service?
An application provided by Jamf Pro that allows users to install apps, run scripts, and access IT-approved tools
184
How are policies made available in Self Service?
1. Create or Edit a Policy in Jamf Pro.
2. Go to the Self Service tab.
3. Enable Self Service by checking the option ✅ for “Make this policy available in Self Service”.
4. Add a title, description, and icon for the policy.
5. Optionally, categorize the policy and scope it to relevant devices/users.
6. Deploy the policy.
185
What does 'Once per computer' execution frequency mean?
In Jamf Pro, the **“Once per computer” execution frequency means that the policy will only run one time on each managed computer**, regardless of how often the policy’s trigger is activated (e.g., at check-in, login, or custom event).
186
What does 'Ongoing' frequency mean?
“Ongoing” execution frequency means the policy can run an unlimited number of times — every time its trigger is activated.
187
What payloads can be used in a Jamf Pro Self Service policy?
*** 📦 Packages** – Install software
*** 📜 Scripts** – Run custom tasks
*** 🛠 Maintenance** – Update inventory, flush caches
*** 🖨 Printers** – Add or remove printers
*** 📌 Dock Items** – Add apps or links to the Dock
*** 👤 Local Accounts** – Create or manage user accounts
188
What are optional Self Service configurations?
* 🖼 Icon – Custom image for the policy
* 📝 Title & Description – Friendly display name and explanation
* 📂 Category – Organize by type (e.g., Utilities, Apps)
* 🔘 Button Name – Custom label for the action button
* 🔐 Require Admin – Prompt for admin credentials (optional)
* 🔄 Restart Options – Restart before/after or user choice
189
What size and format are recommended for Self Service icons?
512x512px in GIF or PNG format.
190
Where is Terminal located on a Mac?
/Applications/Utilities
191
What command shows the manual for another command?
man (e.g., man pwd)
192
What does the jamf binary do?
Handles most Jamf management tasks on a Mac.
193
How do you access the jamf help menu?
* Jamf Pro Help (official manuals)
* Jamf Learn (courses + training)
* Jamf Nation (community Q&A)
194
How do you run a jamf command as root?
Use sudo (e.g., sudo jamf policy)
195
What does sudo jamf recon do?
(**Recon** stands for **reconnaissance**)
Initiates an inventory update with Jamf Pro.
196
What is a script?
**A Jamf Script is just a regular shell script (bash, zsh, etc.) that you upload into Jamf Pro, and then you can run it on Macs through policies or Self Service.**
197
What command opens apps or URLs?
open (e.g., open https://jamf.com or open -a Chess.app)
198
What does the sleep command do?
Pauses execution for a set time (e.g., sleep 5)
199
What is the purpose of #!/bin/bash in a script?
It tells the Mac to use the Bash shell to execute the script.
200
How are comments added to scripts?
With a # symbol.
🔹 In scripts (like Bash, Zsh, etc.), you add comments by starting the line with a #.
Anything after the # on that line is ignored by the script when it runs.
It’s just for humans to explain what the script is doing.
201
Do scripts run as root when deployed from Jamf Pro?
Yep — they do! ✅
⸻
🔹 **Scripts deployed from Jamf Pro usually run as root by default.**
That means:
* They have full admin (superuser) privileges.
* They can modify system files, install apps, change settings — anything!
* You don’t need to add sudo inside your script — it’s already running with elevated permissions.
202
🧰 What does PreStage Enrollment Do?
🧠 Mnemonic: “ACES ID”
* A – Automated enrollment at first boot
* C – Customized Setup Assistant experience
* E – Enforced supervision & security
* S – Scoped device assignment
* I – Identity integration (LDAP/IdP)
* D – Deploy profiles and apps
⸻
203
What is the difference between Scope and Target?
✅ Scope = the full picture
The scope defines who can receive the item — includes:
1. Targets (who should get it)
2. Limitations (narrow it down further)
3. Exclusions (who should NOT get it)
⸻
🎯 Target = who you want to give it to
This is the main group of devices or users you want to affect.
* Can be a smart/static group, a user, a device, or all computers/devices.
204
🧰 What is the Jamf binary?
It’s a command-line tool that gets installed on managed Macs during enrollment. It allows Jamf Pro to:
* Execute policies
* Install software
* Run scripts
* Update inventory
* Trigger management tasks
205
✅ What Jamf Scripts are used for
* Installing or updating apps.
* Fixing system settings (like Wi-Fi, printers, dock icons, etc.).
* Cleaning up caches or temp files.
* Running custom security tweaks.
* Automating repairs (like resetting permissions).
206
🛠 How you use a script in Jamf:
1. **Write** your script (bash, zsh, python, etc.).
2. **Upload** it into Jamf Pro:
* Go to Computers → Management Settings → Scripts → New.
3. **Attach** the script to a Policy.
4. **Set** Triggers and Scope:
* When should the script run? (e.g., on check-in, at login, on demand)
* Which Macs should it target?
Jamf will push the script to the Mac and execute it under root (admin permissions).
