Release History

Password Policy Requirement Enhancements

When a user changes their password with Jamf Connect, the Change Password screen now displays your organization's password policy requirements in the following scenarios:

Changes and Improvements

Resolved Issues

Compatibility with macOS Ventura 13

Jamf Connect 2.16.0 provides compatibility with macOS Ventura 13. This includes compatibility for the following features and workflows:

Compatibility and new feature support are based on testing with the latest Apple beta releases.

Password Policy Requirement Enhancements

For more information, see the Jamf Connect Settings Reference.

Other Changes and Improvements

Resolved Issues

Password Policy Requirements Display at the Login window

If a user's password syncing fails because their new password doesn't meet the requirements enforced by macOS (via MDM passcode configuration, etc.), the user now sees a list of the requirements their password must meet directly at the Jamf Connect login window.

For more information, see Local Account Creation and Subsequent and Routine Logins.

Okta authentication at the login window with password requirements

OpenID Connect authentication at the login window

Prompt Users to Change Non-compliant Passwords

When a user sign in through with the menu bar app with a password that does not meet the password policy requirements configured via MDM, the users are now notified and prompted to change their password.

Resolved Issues

• [PI103293] When executing an authchanger command with the DefaultJCRight parameter, you no longer incorrectly receive an error message. DefaultJCRight enables using the Jamf Connect Pluggable Authentication Module (PAM) for sudo and other system preference changes.

• [PI110230] Updating macOS from 12.3.1 to 12.4.x no longer results in abnormal Jamf Connect Login behavior.

• [PI100478] [PI007071] When a Mac updates, Jamf Connect no longer interrupts the update process and prompts users to log in.

• [PI110002] If a user authenticates with letter cases different from what is stored for the user (e.g.,MaRiLYn vs. Marilyn), the user no longer fails to connect to the Kerberos shared drive.

• [JC-4108] Improved the spacing for the Sign In window banner image, adding spacing between the image and the top of the window.

• [JC-4191] On Apple silicon Mac computers, the Jamf Connect login interface no longer appears during minor macOS updates. Instead, it appears after all software updates are fully installed.

• [JC-4108] The Enable Jamf Unlock toggle is now visible on the local login screen if the Enable Unlock Authentication at the Login Window (EnableUnlockForLogin) key is enabled (set to true).

• [PI110367] If a username is created in your IdP with capital letters, it is now converted to lowercase to prevent issues with scripts and some applications.

Disable Password Syncing for Specific Local Accounts

The Password Sync Block List (PasswordSyncBlockList) setting is now available for configuration in Jamf Pro and Jamf Connect Configuration. It allows you to specify a list of local macOS accounts that you do not want to go through password syncing (typically admin accounts). You can specify one or more local accounts as an array of strings using their local macOS account names (i.e., short names).

For more information, see Password Policy Settings.

Configure Custom Local Account Full Names

The Full Name (OIDCFullName) setting is now available for configuration in Jamf Connect Configuration. It was added to Jamf Pro in the 2.13.0 release. This setting allows you to specify a single different claim for full name, such as firstName, lastName, or another custom value unique to your environment. This preference overrides the default attributes used to set the full name for an account: name, family_name/given_name, and first/last.

For more information, see Advanced Login Authentication Settings.

Default Login Window Background Image Change

For more information, see Login Window Custom Branding Settings.

Users Now See Password Requirements

If a user's password syncing fails because their new password doesn't meet the requirements enforced by macOS (via MDM passcode configuration, etc.), the user now sees a list of the requirements their password must meet instead of a generic message.

For more information, see Password Syncing with Jamf Connect.

Other Changes and Improvements

• Jamf Connect login window screens are now available in Traditional Chinese.

• Due to device token upgrades, Okta no longer registers Jamf Connect authentications as "anomalous".

• Made branding enhancements to the menu bar app.

• To make your login window and menu bar app preferences easier to configure, preferences in Jamf Pro now display the default settings (unless you change them), and only preferences that you change or enter values for are saved to the file.

Resolved Issues

• [PI110177] Jamf Connect now performs a single network check when a computer is locked for longer than the network check-in frequency instead of performing two network checks. Network check-in frequency is specified by the Network Check-in Frequency (NetworkCheck) preference—the default is every 60 minutes.

• [JC-3999] On the login screen when the Enable Unlock toggle is on, the user is now prompted to provide a pin, as expected, rather than a password.

• [PI101105] [JC-3932] The Jamf Connect login window is now disabled when Apple Migration Assistant is running, enabling the migration process.

• [JC-3912] At the login window, the Wi-Fi network selection window no longer enlarges when selecting different networks.

• [PI110155] Users' Jamf Connect menu bar password and Google Cloud Identity password did not sync in some situations. This issue is now resolved.

Local Login Window Upgrades

• The local login window now resembles the macOS login window. This includes the following:

  • If multiple users are set up on a Mac, a user is now able to see all available account options, select their account, and log in. If you create a configuration profile with the SHOWFULLNAME key, users' full names show up here as well. For more information, see the SHOWFULLNAME key in Device Management Profile LoginWindow Properties in the Apple Developer Documentation.

• The Jamf Connect local login window now checks for Jamf Unlock availability based on existing pairing records for the user. If a pairing record exists, the user is allowed to use Jamf Unlock to log in.

• There is now an Enable Jamf Unlock switch on the local login screen so that users can pair with the Jamf Unlock iOS app when they log in, enabling authentication via the user's biometrics or pin. This switch also exists in the Jamf Connect menu bar app.

Users select from available account options when multiple users are set up on a Mac.

A user's local login displays with a password field and a button with a phone icon for singing in with Jamf Unlock. The Enable Jamf Unlock toggle appears at the bottom of the screen if the user is paired with Jamf Unlock.

For more information, see End User Experience and Workflows.

New Login Window Preferences

The Full Name (OIDCFullName) preference is now available for configuration in Jamf Pro. It allows you to specify a single, different attribute for full name, such as firstName, lastName or another custom value unique to your environment. This preference overrides the default attributes used to set the full name for an account: name, family_name/given_name, and first/last.

The Hide "Create New User" option at migration (CreateNewUserHide) preference is now available for configuration in Jamf Pro and Jamf Connect Configuration. It enables hiding the Create New User option from users during account migration. With this setting enabled (set to true), users are unable to disrupt account migration by creating a new account. This setting is not enabled (set to null) by default.

For more information see Login Window Preferences.

Microsoft Identity Platform Endpoints Support

Jamf Connect now supports updated Microsoft identity platform endpoints. If Microsoft Azure AD is your IdP, see the note above, "Microsoft Azure AD Change Required" for information about required changes.

Debugging Change

Due to enhancements, tmp log files for the login window (/tmp/jamf_login.log file) no longer automatically include debug level information. You may still manually produce logs using the Terminal or Console apps to help troubleshoot issues.

For more information, see Jamf Connect Logs.

Resolved Issues

• [PI109623] When Jamf Unlock is enabled for a user on a computer, you may only authenticate as that user. Documentation now exists to help you disable Jamf Unlock for the user, log in as an admin to make changes, then renable the user. For more information, see Enabling Jamf Unlock on Computers.
• [JC-3794] When a user resizes the Pair new device window in the menu bar app under Paired Devices > Pair new device, the QR code now scales with the window.
• [JC-3921] At the login window, a progress bar no longer remains in the background after closing the acceptable use policy screen at the login window.
• [JC-3998] Improvements ensure that admins don't receive unnecessary notifications during the Jamf Connect installation process.
• [PI110103] The menu bar app no longer launches multiple times during the first launch of the app during installation. Only one copy of Jamf Connect remains open at a time.
• [PI110113] The login window message no longer overlaps with the Done button at the bottom of the screen during the login process.
• [PI109924] Duo MFA and PingID MFA windows that require Webkit now render properly on devices running macOS12.3. macOS 12.4 resolved this issue.
• [PI109612] FileVault enabled users now consistently appear on the FileVault unlock screen after rebooting.
• [PI104597] [PI010181] When Jamf Pro is configured to pass through enrollment customization details to the login window, the login window no longer only passes through the first and last space-separated elements of each user's name. This results in correctly passing through full names when they contain multiple spaces (e.g., Abdul Malik Abadi).
• [JC-3907] When Jamf Connect is configured to use Kerberos authentication, users may now retrieve tickets for authentication on computers without a Kerberos preferences plist or with an old Kerberos preferences plist (e.g., from being previously bound to an Active Directory domain).
• [PI110012] The menu bar app now notifies users during each background check if their local and network passwords are out of sync rather than notifying them only one time. The notification prompts users to sync their passwords. The interval of background checks and the resulting notification is set by the Network Check-in Frequency (NetworkCheck) menu bar app preference, which is set to every 60 minutes by default. For more information about this preference, see Menu Bar App Preferences.
• [JC-3793] When a user keeps the return key pressed down during local or network login, unexpected behaviors no longer occur.
• [JC-3874] When a user switches between Wi-Fi networks and attempts logging into a network that only requires a password, the password field now displays instead of both username and password fields.

Login Window Enhancements

Enhancements include:

• [PI109797] When the Use Local Authentication by Default (OIDCDefaultLocal) login window preference is set to true, the Shutdown and Restart buttons now display at the bottom of the screen when Jamf Connect first loads.

• [JC-3808] When the Use Passthrough Authentication (OIDCUsePassthroughAuth) login window preference is set to true, the login window no longer displays a step indicator if there is only one step required.

Local login window

Azure IdP login window

Resolved Issues and Enhancements

• [PI109860] If your IdP is Azure or a hybrid integration and you configure the Discovery URL (OIDCDiscoveryURL) login window preference or the Discovery URL (Discovery URL) menu bar app preference, ROPG now works and you no longer get an error message.

• [PI109787] Password synchronization no longer fails when a user connects their mobile active directory (network) account with their IdP account using Jamf Connect's local account migration workflow.

• [JC-3749] It is now easier for potential Jamf Connect customers to uninstall the Jamf Connect test file.

• [JC-3735] Only one Jamf Connect menu bar app now launches, rather than two, when Jamf Unlock is enabled. This results in only one Jamf Connect icon in the menu bar rather than two.

• [PI109938] When Jamf Connect is deployed automatically via Jamf Pro, users' credentials are saved in their login keychain so they no longer receive a keychain error. Jamf Connect no longer looks for an existing keychain item in the context of the _appstore user's home directory rather than the user who is logged in and running the app.

• [JC-3910] If a user has the menu bar app open and loads the launch agent, all instances of the menu bar app are now killed so that when the system relaunches the app, only one copy is running. The second instance no longer kills itself and relaunches.

• [PI009255] When Jamf Connect is configured to use Kerberos authentication, users may now change their passwords on computers without a Kerberos preferences plist or with an old Kerberos preferences plist (e.g., from being previously bound to an Active Directory domain). While resolved in version 2.7.0, this issue persisted in versions 2.8.0 and 2.9.0.
• [PI102789] When a user disconnects from their VPN/internal network and attempts to change their password using Jamf Connect menu bar app's change password feature, they're no longer presented with a Kerberos password change window that fails to change their password since the Kerberos realm is unreachable. Instead, they're presented with a web interface window where they can change their IdP password.

Azure Default URLs Added for Changing and Resetting Passwords

If Azure is your IdP, you no longer need to add a URL to your configuration that opens when end users select Change password or Reset password in the Jamf Connect menu bar app. Instead:

• For password changes which require a user to know their current password, Jamf Connect now defaults to opening the URL https://myaccount.microsoft.com/ where the end user may change their password. This is associated with the Menu Bar preference key Change Password URL (ChangePasswordURL).

• For password resets where a user does not know their current password, Jamf Connect now defaults to opening the URL https://passwordreset.microsoftonline.com/ where the end user may reset their password. This is associated with the Menu Bar preference key Reset Password URL (ResetPasswordURL).

• Note: If Okta is your IdP, this functionality already exists and directs end users to Okta URLs.

For more information, see Menu Bar App Preferences.

Resolved Issues and Enhancements

• [JC-3775] Implemented changes to more efficiently manage Okta communications.

• [PI109956] Identified and resolved a security issue related to specific configurations of Okta and initial MFA setup requirements

• [JC-3798] In Jamf Connect Configuration there is a character limit that limits how much of a configuration name you can see in the left hand navigation. You may now hover over a configuration name to see the full name if it goes beyond the character limit.

• [PI109837] The Change Password menu bar item now works reliably in all environments. Previously, when users selected Change Password in environments that specified a Kerberos realm using a .local domain, nothing happened if the Kerberos realm was unreachable.

• [PI109890] The Jamf Connect menu bar app now correctly performs network checks to validate passwords and notifies Google users when their network password does not match their local password.

• [JC-2866] The Cancel button in the Acceptable Use Policy window now works as expected on macOS 11 or later.

• [PI010418] [JC-3229] Local accounts that are FileVault-enabled now display on the FileVault unlock screen after restarting when the Jamf Connect login window is enabled.

• [JC-3745] The ROPG Scopes (Scopes) setting is now configurable in the Connect pane of the Jamf Connect Configuration app.

Display an Acceptable Use Policy via URL

You can now populate Jamf Connect's Acceptable Use Policy screen using a URL. This eliminates the need to create and deploy an Acceptable Use Policy TXT or PDF file to computers alongside Jamf Connect.

For more information, see Acceptable Use Policy Screen.

Default Password Verification Interval Change

The Network Check-in Frequency (NetworkCheck) setting is now set to one hour rather than 15 minutes by default. Extending the default interval mitigates the risk of the Jamf Connect menu bar app unexpectedly locking out a user from their identity provider (IdP) resources in environments where authentication frequency limits exist.

For more information, see Password Policy Settings.

Custom OpenID Connect Scopes Support for Menu Bar App

The Jamf Connect menu bar app now supports the Scopes (Scopes) setting. This allows you to receive additional OpenID Connect claims, such as email, in a user's ID token during sign-in with Jamf Connect. To use this setting, include this key-value in the IdPSettings dictionary of a menu bar configuration profile.

This setting resolves [PI109710].

For more information, see Menu Bar App Preferences.

Resolved Issues

• [JC-2925] Jamf Connect menu bar now consistently retrieves Kerberos tickets when a user changes their network and during Jamf Connect network checks.

• [JC-3030] Kerberos tickets are no longer destroyed if a user disables VPN and the menu bar preference key CacheTicketsOnNetworkChange is set to True.

• [PI109830] The Jamf Connect login background image now appears behind the "Welcome to your new Mac!" login screens instead of appearing as a black screen.

• [JC-2585] The Shutdown, Restart, and Local Login buttons are now hidden from the Jamf Connect login window when the Acceptable Use Policy screen displays.

• [JC-2918] Jamf Connect now starts after a user's account is created instead of the native Apple Setup Assistant window.

• [JC-3703] When users change their password using Jamf Connect, passwords for keychain items specified in Jamf Connect Configuration are automatically updated to match their new password.

• [JC-3229] FileVault-enabled users now appear on the FileVault unlock screen upon restart.

• [PI109771] Using a third party MFA provider for pass-through authentication no longer produces a ROPG failure that results in users reentering their password. Users now enter their password one time.

Resolved Issues

• [JC-3740] In Jamf Connect Configuration, selecting then deselecting the Automatically Open Jamf Connect at Login checkbox on the Connect pane no longer removes additional apps from users' login items.

• [JC-3737] The Automatically Open Jamf Connect at Login setting is now respected when an end-user selects this preference from the menu bar app's Preferences window.

• [PI109800] Jamf Connect no longer launches prematurely while users are setting up their Mac with Apple Setup Assistant.

• [JC-3702] In Jamf Connect Configuration, the tooltip for the Use Passthrough Authentication checkbox on the Login pane is now translated into supported languages. Supported languages include English, German, Spanish, French, and Japanese.

Installer Changes

Jamf Connect now automatically opens upon first installation. Additionally, when Jamf Connect is upgraded, the app now automatically quits and then relaunches as the updated version. This ensures that older versions do not run concurrently.

For more information, see Launch Agent and Jamf Connect Updates.

Ability to Uninstall Jamf Connect Using a Package in the DMG

The Jamf Connect DMG now contains a package to fully uninstall Jamf Connect. To uninstall Jamf Connect, run the Jamf Connect Uninstaller package on the intended user's machine.

For more information, see Uninstalling Using the Jamf Connect Uninstaller Package.

Resolved Issues

• [JC-3204] The Jamf Connect menu bar app is now able to retrieve custom Azure ShortName attributes.

• [JC-3247] The Jamf Connect login window message that appears when signing in as a new user, "Creating your account on this Mac", is now translated into supported languages.

• [JC-2859] The Jamf Connect Configuration interface now allows you to save 0 as the value of the Network Check-in Frequency field, disabling check-ins for network connection availability every x number of minutes.

• [JC-2963] The Jamf Connect menu bar app now provides a descriptive error message when users enter either an incorrect username or password.

• [JC-2977] When importing a configuration, the Create Jamf Connect keychain checkbox is now pre-checked in the Jamf Connect Configuration interface.

• [JC-3185] ldapsearch search queries now resolve, rather than becoming unresponsive, if a user is in 1000+ active directory groups.

• [JC-3199] The Enable Jamf Unlock toggle at the top of users' screens now automatically translates to the supported language set on each user's Mac.

Jamf Connect Configuration Upload Integration with Jamf Pro

You can now upload configurations created in the Jamf Connect Configuration app directly to your organization's Jamf Pro instance. This eliminates the need to save the configuration profile locally and then manually upload the profile to Jamf Pro.

Keep the following requirements and limitations in mind when using this feature:

For more information, see Creating a Configuration Profile using Jamf Connect Configuration.

Passthrough Authentication for OneLogin and PingFederate

Organizations that use OneLogin and PingFederate with the Jamf Connect login window can now securely send the password entered by users in the sign-in web view to Jamf Connect for local authentication. This allows Jamf Connect to complete network and local authentication without prompting users to re-enter a password. During local account creation, this ensures that the network password is automatically used as the local password.

To enable passthrough authentication with OneLogin or PingFederate, do the following:

For more information about passthrough authentication with Jamf Connect, see Passthrough Authentication with Jamf Connect.

Set Jamf Connect as a Login Item

You can now set the Jamf Connect menu bar app as a macOS login item for users. This ensures that Jamf Connect automatically opens after login rather than needing to manually direct users to open the app from the /Applications folder.

To enable this feature, set the Automatically Open Jamf Connect at Login (AutoOpenAppAtLogin) setting to true in the SignIn dictionary of your Jamf Connect menu bar app configuration profile. this setting is set to false by default.

For more information, see Menu Bar Sign-in Settings.

Resolved Issues

Password Syncing Support for Google Cloud ID

You can now deploy the Jamf Connect menu bar app to allow users to sync passwords between their Google account and local account on the Mac.

To setup password syncing, organizations that use Google as their identity provider (IdP) need the following:

For more information about password syncing with Google, including how to generate and install an LDAP certificate, see Integrating with Google Identity and Password Syncing with Google.

For more information about Google's Secure LDAP service, see About the Secure LDAP service from the Google Workspace Admin Help web site.

Jamf Unlock with the macOS login window

Users can now use the Jamf Unlock app to log in via Apple's native macOS login window.

To enable Jamf Unlock authentication at the login window for users, you need the following:

When enabled, users have the option to use Jamf Unlock authentication rather than entering their local password by using the Enable Jamf Unlock switch at the top of the login window.

Keep the following in mind when enabling this feature:

For more information, see Enabling Jamf Unlock on Computers.

Other Changes and Improvements

Resolved Issues

Documentation Updates

Passthrough Authentication for Microsoft Azure AD

Organizations that use Microsoft Azure AD with the Jamf Connect login window can now securely send the password entered by users in the Microsoft sign-in web view to Jamf Connect for local authentication. This allows Jamf Connect to complete network and local authentication without prompting users to re-enter a password. During local account creation, this ensures that the network password is automatically used as the local password.

To enable passthrough authentication with Microsoft Azure AD, do the following:

Resolved Issues

Compatibility with macOS Monterey 12

Jamf Connect 2.5.0 provides compatibility with macOS Monterey 12. This includes compatibility for the following features and workflows:

Compatibility and new feature support are based on testing with the latest Apple beta releases.

Passthrough Authentication for Google Cloud ID

Organizations that use Google Cloud ID with the Jamf Connect login window can now securely send the password entered by users in the Google sign-in web view to Jamf Connect for local authentication. This allows Jamf Connect to complete network and local authentication without prompting users to re-enter a password. During local account creation, this ensures that the network password is automatically used as the local password.

To enable passthrough authentication with Google Cloud ID, set the Use Passthrough Authentication (OIDCUsePassthroughAuth) setting to true in your Jamf Connect login configuration profile. This setting is set to false by default.

Other Enhancements

Resolved Issues

Menu Bar App Branding Enhancements

You can now configure the menu bar app to use a new alternate icon rather than the default Jamf logo and company name.

To use the new icon, set the Use Unbranded App Icon (AlternateBranding) setting to true in the Appearance dictionary or your Jamf Connect menu bar app configuration profile. This setting is disabled by default.

For more information, see Using the Alternate Branding in the Menu Bar App.

Resolved Issues

Support for Jamf Unlock Menu Bar App Settings in Jamf Connect Configuration

You can now configure menu bar app settings that are used to configure Jamf Unlock authentication with computers using the Jamf Connect Configuration app.

Resolved Issues

Kerberos Ticket Caching

You can now use the Cache Kerberos Tickets on Network Change (CacheTicketsOnNetworkChange) setting to determine whether a user's Kerberos tickets are cached or destroyed when a network status changes on computers. When set to true, computers will cache Kerberos tickets when a network change occurs. By default, this setting is set to false and Kerberos tickets are destroyed during a network change.

For more information, see Kerberos Settings.

Custom Username for Resource Owner Password Grant (ROPG) Authentication

You can now use the ROPG Short Name (OIDCROPGShortName) setting to define an attribute from an ID token to use as the username during the ROPG authentication flow.

This setting is only used in complex IdP environments where an IdP does not respect the claims used by Jamf Connect to define the username (e.g., unique_name, preferred_username, email, and sub) during the ROPG workflow.

For more information, see Advanced Login Settings.

Bug Fixes

Jamf Unlock 1.1.0

Jamf Unlock 1.1.0 includes new managed app configuration settings and bug fixes. For more information see the Jamf Unlock Release History.

Introducing Jamf Unlock 1.0.0

Jamf Unlock is a mobile device app that allows a user to unlock their Mac with a mobile device without using a password. With Jamf Unlock users complete a setup process to create or generate identity credentials(certificate) on their device, which is then used to pair and establish trust with a Mac. Once the setup is complete, users can easily use the app as an alternate authentication method in the following scenarios:

• Unlocking a Mac
• Prompts to change settings in System Preferences
• Commands executed with root privileges with the sudo command

IT administrators can configure Jamf Unlock authentication settings via managed app configuration and deploy the app to users in their organization.

To use Jamf Unlock in your environment, you need the following:

• A Jamf Unlock subscription and the Jamf Connect 2.4.0 menu bar app installed on computers.

  Note:

  You must also include the Enable Unlock (EnableUnlock) setting in your menu bar app configuration profile. For more more information, see Enabling Jamf Unlock on Computers.

• An MDM solution, such as Jamf Pro

• Managed devices with iOS 14.0 or later that are connected to the internet

• Computers with macOS 10.15.4 or later with the Jamf Unlock menu bar app installed

• A cloud identity provider (IdP) and an OpenID Connect app integration.

  Note:

  If you already deployed the menu bar app in your environment, you can use an existing app integration for the menu bar app by adding an additional Redirect URI for Jamf Pro. If you use Okta and its authentication API with the menu bar app, you must create a new app integration for to support the OpenID Connect authentication protocol.

For more information, see Jamf Unlock Overview.

Bug Fixes

Bug Fixes

New Menu Bar App Preference for Network Checks

You can now use the Perform Network Checks on Network Changes (checkOnNetworkChange) setting to determine whether Jamf Connect performs a network check when a computer's network status changes. This setting is included in the PasswordPolicies dictionary and is a boolean that is set to true by default. For more information, see Password Policy Settings.

Change to Admin Roles Setting in Jamf Connect Configuration

Jamf Connect Configuration now only configures the Admin Roles (OIDCAdmin) setting as an array of strings.

If you import existing configuration profiles into Jamf Connect Configuration and configure the Admin Roles setting in your environment, make sure that an array of strings is used in your configuration profile before importing rather than a single string, like the following:

<key>OIDCAdmin</key>
<array>
<string>role</string>
</array>

Bug Fixes

Login Window

[PI-009285] Improved the login and account creation experience by displaying an animated loading bar between when a user authenticates and when the Finder displays.

Menu Bar App

Keyboard Layout Selection at the Login Window

Users can now select a keyboard type from the Jamf Connect login window by clicking the keyboard button  in the upper-right of the screen. Users can select from any keyboard input source supported by macOS. This feature also fixes PI-009230.

New Menu Bar App Preference Key for Okta Password Expiration Dates

The Password Expiration Manual Override (ExpirationManualOverrideDays) setting allows Okta administrators to display the amount of days remaining before a user's password expires in the menu bar app for Okta accounts that are not managed by Active Directory. This setting is included in the PasswordPolices dictionary and is an integer that specifies the lifetime of an Okta password in your organization. For example, if users must change their Okta password every 90 days, set the integer value to 90.

Identity Provider Endpoint Usage

Jamf Connect now detects and uses any discovery URLs that are included in a Jamf Connect configuration profile instead of using the pre-configured discovery URLs that are included in Jamf Connect's authentication framework by default.

To ensure authentication with Jamf Connect continues to succeed, make sure you do the following before you deploy Jamf Connect 2.3.0:

• If you are using an identity provider other than PingFederate or a custom option, make sure discovery URL key-value pairs are either not configured (Jamf Connect uses pre-configured discovery URLs for supported IdPs) or match the discovery endpoint documented by your IdP.
• If you use Jamf Connect with Azure AD in an AD FS hybrid identity environment, in addition to making sure the Discovery URL (OIDCDiscoveryURL) is not configured, make sure the Hybrid ID Discovery URL (ROPGDiscoveryURL) uses your AD FS discovery endpoint.

LAPS User Setting Behavior Changes

The LAPS User (LAPSUser) setting is now ignored on computers in the following scenarios: 

• If any account type logs in with Jamf Connect on computers with macOS 11 or later.
• If a local administrator logs in with Jamf Connect on computers with macOS 10.15 or earlier.

This helps ensure this setting only runs to enable FileVault for standard users on macOS 10.15 or earlier. This change also fixes PI-007744.

Custom Menu Bar Icon Changes for macOS 11 or Later

On computers with macOS 11 or later, the Dark Mode Icon (MenubarIconDark) setting is no longer supported. To continue using a custom menu bar icon for Jamf Connect on macOS 11 or later, make sure to only use the Light Mode Icon (MenuBarIcon) setting. 

Keep the following in mind about menu bar icons for macOS 11 or later:

• macOS 11 will automatically change the tint of a monochrome icon to clearly display against the desktop image.
• If you use a custom icon with multiple colors for Jamf Connect, the icon will automatically be converted to a monochrome template to match Apple guidelines. Using an icon with multiple colors is not recommended and may cause the menu bar icon to display in an unexpected way.

Bug Fixes

The following issues are fixed in the login window:

The following issues are fixed in the menu bar app: