Jamf FAQs

Below is a list of common questions and answers for Jamf @ Stanford.

Jamf @ Stanford

What is Jamf @ Stanford?

Jamf is a Mobile Device Management (MDM) solution for managing the Apple platform. With Jamf, we can proactively manage the entire lifecycle of all Apple devices. Lifecycle management for macOS includes deploying and maintaining software, responding to security threats, distributing settings, and analyzing inventory data.

How does Jamf work?

When a device enrolls with Jamf@Stanford, it uses the Apple Push Notification service (APNs) to communicate directly with the Jamf MDM instance in the cloud to receive configurations. The experience between a device and IT changes as new opportunities are available. As the Stanford Jamf system matures, setup can begin when a device comes out of the box (known as zero-touch deployment) without a technical consultant's physical interaction. A client can decide what applications and settings they want from the application catalog (coming later) while essential updates install in the background without downtime. 

What information does Jamf collect?

We've customized our implementation to collect only the data needed to support Stanford Mac devices and keep our networks and data safe. Jamf can:

• View model, serial number, and operating system
• Identify your device by name
• Reset lost or stolen device to factory settings
• View disk encryption status
• View information for installed applications (e.g. log files, plist settings files)

For a complete list of attributes, Jamf can view for a computer, review the Managing Computers > Inventory for Computers > Computer Inventory Information Reference section of the latest version at the Jamf Pro Administrator’s Guide.

What information does Jamf NOT collect?

Jamf does not collect personal information, such as the contents or names of individual files (documents, email, etc.) or any browsing history. Jamf can't:

• View browsing history on a device
• See your personal emails, documents, contacts, or calendar
• Access your passwords
• View, edit, or delete photos
• View frequency of application use
• See the location of a device

Jamf for macOS

Why do we no longer have the option to create a Mac account during Setup Assistant? What is the username and password for the initial login?

Upon first booting a new installation of macOS on a Mac, Setup Assistant walks you through the simple steps needed to start using your Mac. Some users have been experiencing a macOS bug where Setup Assistant does not end by presenting your opportunity to create a Mac account username and password.  When Apple releases macOS Sonoma in Fall 2023, they expect it to include a fix for this problem; however, the earliest versions of Sonoma have yet to include that fix.

In the meantime, we are using the following workaround as an interim solution. 
 

×Note: This interim solution only applies to computers purchased before July 1, 2023.

​If there is no account available for login at the completion of the Setup Assistant, our interim solution is to wipe and reinstall macOS. However, before running the Setup Assistant again, please follow these steps to ensure you can create a Mac username and password for your account:

1. Submit a Help request with the following text as a Short description of what you need:

   ​​ Requesting Jamf help with Apple's macOS computer account creation bug; the computer Serial Number is: <type serial number>

2. A UIT EED Systems team member will update your ticket to indicate your computer has been assigned the fix. Once you receive this update in the ticket, proceed with step 3 below.
3. Run through Setup Assistant, again, by erasing and wiping and reinstalling macOS.
4. Confirm you are presented with the Create a Computer Account screen.

❗️Note that you may have to wipe and reinstall macOS several times, before macOS successfully presents the below screen at the end of the setup process.

Why has Stanford chosen Jamf to replace HCL BigFix on Stanford Macs?

Due to security changes in recent versions of the macOS architecture, BigFix is no longer adequately performing the tasks needed to manage Apple's operating system. As we transition management systems to Jamf, BigFix will remain until Jamf provides management parity. The same teams who currently govern BigFix will manage Jamf.

How do updates work?

Jamf’s software updates and patching will usually be invisible to you. Software updates download to your computer in the background at a speed that allows your computer tasks to proceed without interruption or delay. App Store updates are installed daily around midnight, whereas third-party apps might have their own schedule. Microsoft apps are updated monthly and installed automatically if the programs are closed.

Will I still have administrative access to my Mac?

There will be no automatic changes to the privileges of your device.

How do I know if Jamf is installed on my device?

Open System Preferences > Profiles. From the list on the left, click on Stanford Device Management. On the right, you should see “Description: https://jamf.stanford.edu”.

I received a Profile Installation Failed error message when trying to install Jamf. What does this mean?

If you receive an error message stating “Profile installation failed," it’s likely your macOS device is already enrolled in Jamf, and no further action is required.

In the MDM Profile, it shows in red text that Jamf has the ability to delete data from my computer. Should I be worried?

For transparency reasons, Jamf’s capability as it relates to erasing data is displayed. This is a standard function of any device management system. Be assured that your data is safe and we will not take this action without your consent. This function is generally reserved for lost or stolen devices.

What is Self-Service App?

Included with Jamf enrollment or accessible via the App Store, Self-Service empowers end-users with access to University-approved applications and configurations through a click of a button. The highly customizable Self Service catalog features productivity, compliance, connectivity software, and more. You can install software or quickly configure your device without IT intervention by launching Self Service from your Applications folder. Some groups might see the Self-Service icon on their desktop. Visit the Jamf website to learn more about Apple self-service.

Jamf for iOS/iPadOS

What if I don't want device management?

Device management is required to:

• Access the Stanford network while on campus
• Use Cardinal Key

If you are certain that the implications of having an unmanaged device will not impact you, you may remove management from a non-Stanford purchased device by navigating to mydevices.stanford.edu and following these instructions for removing your device from MDM.

I received a Profile Installation Failed error message when trying to install the Jamf profile. What does this mean?

You received a pop-up error message that says: “The new MDM payload does not match the old payload.” because you already have a Mobile Device Management (MDM) profile installed. You can only have one MDM on your device at a time.

To resolve this, navigate to Settings, Open the Profile of the installed Mobile Device Management and select Remove Management. You can then enroll in the new Device provider (Jamf) and download that profile. 

My device is new or otherwise unmanaged. How do I enroll it into Jamf?

If your device is new or unmanaged, follow these instructions to enroll in Jamf.

What is Self-Service App?

Included with Jamf enrollment or accessible via the App Store, Self-Service gives you access to a curated set of university-approved applications and configurations. The customizable Self-Service catalog features productivity, compliance, connectivity software, and more. You can install software or quickly configure your device without IT intervention by launching Self-Service from your mobile device. Visit the Jamf website to learn more about Apple self-service.

Note: The Self-Service app does not have access to view what apps you already have installed on your device, so you may see it offer an option to install an app you already have.

How do I opt-out of the automatic installation of the Gmail App?

Open the Self Service app on your mobile device to install the "Block - Gmail App Installation" configuration profile.

Completion will be indicated by a "Block-SU-Gmail-App" Web Clip appearing on your home screen. Feel free to delete this Web Clip/Bookmark, as it has no effect on your device's block status.
The Gmail app can be left to uninstall on its own, or you may remove it yourself; it will no longer automatically re-install upon your device's daily Jamf inventory routine.

NoteThe Self-Service app does not have access to view what apps you already have installed on your device, so you may see it offer an option to install an app you already have.

How do I unblock the automatic installation of the Gmail App?

Open the Self Service app on your mobile device to install the "Allow - Gmail App Installation" configuration profile.

Completion will be indicated by an "Allow-SU-Gmail-App" Web Clip momentarily appearing on your home screen, then disappearing along with the "Block-SU-Gmail-App" Web Clip if found.

How do I opt-out of automatic installation of the Microsoft Outlook App?

Open the Self Service app on your mobile device to install the "Block - Microsoft Outlook App Installation" configuration profile.

Completion will be indicated by a "Successfully Blocked - Microsoft Outlook App" Web Clip appearing on your home screen. Feel free to delete this Web Clip/Bookmark, as it has no effect on your device's block status.

The Microsoft Outlook app can be left to uninstall on its own, or you may remove it yourself; it will no longer automatically re-install upon your device's daily Jamf inventory routine.

Note: The Self-Service app does not have access to view what apps you already have installed on your device, so you may see it offer an option to install an app you already have.

How do I unblock the automatic installation of the Microsoft Outlook App?

Open the Self Service app on your mobile device to install the "Allow - Microsoft Outlook App Installation" configuration profile.

Completion will be indicated by a "Successfully Allowed - Microsoft Outlook App" Web Clip momentarily appearing on your home screen, then disappearing along with the "Successfully Blocked - Microsoft Outlook App" Web Clip if found.

How do I opt-out of the automatic configuration of the Apple Mail app on my iPhone or iPad?

Open the Self Service app on your mobile device to install the "Block - Apple Mail App Configuration" configuration profile.

Completion will be indicated by a "Block-SU-Mail-Configuration" Web Clip appearing on your home screen. Feel free to delete this Web Clip/Bookmark, as it has no effect on your device's block status and is only for informational purposes.

How do I unblock the automatic configuration of the Apple Mail app on my iPhone or iPad?

Open the Self Service app on your mobile device to install the "Allow - Apple Mail App Configuration" configuration profile.

Completion will be indicated by an "Allow-SU-Mail-Configuration" Web Clip momentarily appearing on your home screen, then disappearing along with the "Block-SU-Mail-Configuration" Web Clip if found.

I noticed a warning message during the installation that reads, "The administrator may collect personal data, add/remove accounts and restrictions, list, install, and manage apps and remotely erase data on your iPhone." What does this mean?

This warning is required by Apple and Stanford cannot adjust the language. To understand what this warning means for you and your mobile device, please refer to Mobile Device Management (MDM) Additional iOS Privacy Information.