Description: We are ready to migrate the remaining SGPS devices to the TAMUS Elastic Cluster.

The following smart group will be added to the deployment scope. This will target all devices in the SGPS site that are currently enrolled in the Jamf server under Elastic Deployment V2 - SGPS (Full Site) https://tamu.jamfcloud.com/smartComputerGroups.html?id=-1&o=c

This scope will also include any new devices enrolled into the SGBS site via the existing prestage enrollments, ensuring they are automatically migrated to the TAMUS Elastic Cluster.

Description: Details of maintenance: Update Privileges elevation tool to the latest version to enable updated security features and functionality.

Benefit of change: There are various benefits of the new version of Privileges. Here is the release page on changes made up to the latest version. https://github.com/SAP/macOS-enterprise-privileges/releases -Revoke admin rights at login

• Unified expiration interval for administrator privileges

• Renew expiring administrator privileges at any time

• Smart card and PIV token support

• Tamper protection (requires macOS 13 or newer)

• Run actions on privilege change

• Status item for the macOS menu bar

• Command line tool now supports Touch ID

• AppleScript support

• Webhooks

• Localized in 41 languages

• Elevate privileges by end user credentials for better security

• Send logs to Elastic when privileges change Impact to customers: The functionality of the customer device will be the same but the Privileges application UI has been slightly updated to a more sleek look.

Description: We are ready to migrate the remaining CLLW devices to the TAMUS Elastic Cluster.

The following smart group will be added to the deployment scope. This will target all devices in the CLLW site that are currently enrolled in the Jamf server under Elastic Deployment V2 - CLLW (Full Site) https://tamu.jamfcloud.com/smartComputerGroups.html?id=1575&o=r

This scope will also include any new devices enrolled into the CLLW site via the existing prestage enrollments, ensuring they are automatically migrated to the TAMUS Elastic Cluster.

Description: We are moving the computers that belong to the College of Architecture to the Architecture site that was created for them.

We used Axonious to find the device ownership for all of our machines in the server and were able to get a list of 30 machines that have the following tag from Axonious: College: Architecture from this data source: Mssql: MSSQL_ Divcollegedesc.

The list has been giving to the IT Staff at the Architecture College which they have reviewed and approved the list.

Breaking computers out into their own site in Jamf is important because it allows for proper scoping, management, and security separation between departments. Sites ensure that devices receive only the policies, configuration profiles, applications, and restrictions intended for their specific college or unit.

By assigning computers to the correct site, administrators can prevent accidental deployments, reduce configuration conflicts, and maintain clearer ownership and accountability of devices. This also improves troubleshooting, reporting accuracy, and access control by limiting visibility and administrative actions to only the devices that team is responsible for.

Overall, proper site separation helps maintain a cleaner Jamf environment, reduces risk during deployments, and supports scalable device management across multiple colleges and departments

Description: We are ready to migrate the remaining CLAR devices to the TAMUS Elastic Cluster.

The following smart group will be added to the deployment scope. This will target all devices in the CLAR site that are currently enrolled in the Jamf server under Elastic Deployment V2 - CLAR (Full Site) https://tamu.jamfcloud.com/smartComputerGroups.html?id=1576&o=r

This scope will also include any new devices enrolled into the CLAR site via the existing prestage enrollments, ensuring they are automatically migrated to the TAMUS Elastic Cluster.

Description: Details of maintenance: A new computer Configuration Profile was created in Jamf Pro for TAMU_WiFi access. This profile has been assigned to all macOS devices to ensure it is installed before the current WiFi profile expires on April 18th, 2026.

Benefit of change: Devices with the new WiFi profile will maintain uninterrupted wireless internet access and will not experience connection issues after the current WiFi certificate expires.

Impact to customers: If the device cannot receive the WiFi profile after the current certificate expires, campus members might need to log in locally instead of using Jamf Connect/Entra login to connect to TAMU_WiFi, or they may need to troubleshoot why the profile failed to install.

Description: Details of maintenance: A new computer Configuration Profile was created in Jamf Pro for TAMU_WiFi access. This profile has been assigned to all macOS devices to ensure it is installed before the current WiFi profile expires on April 18th, 2026.

Benefit of change: Devices with the new WiFi profile will maintain uninterrupted wireless internet access and will not experience connection issues after the current WiFi certificate expires.

Impact to customers: If the device cannot receive the WiFi profile after the current certificate expires, campus members might need to log in locally instead of using Jamf Connect/Entra login to connect to TAMU_WiFi, or they may need to troubleshoot why the profile failed to install.

Description: Details of maintenance: Backup of Smart groups on https://tamu.jamfcloud.com.

Problem record: https://service.tamu.edu/TDNext/Apps/34/Tickets/TicketDet?TicketID=633742

Benefit of change: Clean up the Jamf Productions server and reduce load from unused Smart Groups

Impact to customers: None

Description: Details of maintenance: Upgrading Jamf Pro Server from 11.24 to 11.25. Note: This upgrade is performed by the UEM Team.

Benefit of change: This upgrade provides the following feature enhancements, bug fixes, and critical CVE vulnerability patches. (https://learn.jamf.com/en-US/bundle/jamf-pro-release-notes-current/page/New_Features_and_Enhancements.html)

Impact to customers: Jamf Pro console access and device enrollment capabilities for IT support teams may not be available during the upgrade.

Description: Details of maintenance: An updated PrinterLogic package will be available on Self-Service for Health devices.

Benefit of change: This updated package fixes an issue with PrinterLogic compatibility with macOS Tahoe devices.

Impact to customers: None, this will be an optional Self-Service download.

OIDC-based SSO Through Jamf Account Enabled by Default for New Jamf Pro Instances

Automatic Jamf Protect Tenant Registration

Configuration Profiles

Mobile Device Configuration Profiles

Improved Declarative Device Management for Migrated Instances

A "Federated" user account type has been added to Jamf Pro, designed for use with OIDC-based SSO through Jamf Account. This addition supports improvements to the Jamf Pro setup experience. Federated user accounts do not have a password and cannot be used for local login, Self Service login, or enrollments.

The resource center has been relocated to the sidebar in the Jamf Pro interface.

Jamf Pro API Changes and Enhancements

Description: [Copied from change 400463]

Details of maintenance: Upgrading Jamf Pro Server from 11.21.1 to 11.24. Note: This upgrade is performed by the UEM Team.

Benefit of change: This upgrade provides the following feature enhancements, bug fixes, and critical CVE vulnerability patches. (https://learn.jamf.com/en-US/bundle/jamf-pro-release-notes-11.24.0/page/New_Features_and_Enhancements.html)

Impact to customers: Jamf Pro console access and device enrollment capabilities for IT support teams may not be available during the upgrade.

[PI138122] Fixed: Configurations using passthrough authentication cause a password mismatch if a user's password is reset by a local administrator prior to logging in with Jamf Connect.

[PI143260] Fixed: Importing a configuration profile into Jamf Connect Configuration with the User Promotion Choices (UserPromotionChoices) setting in use causes the array for the setting to be replaced by the following text: (.

[PI143263, PI144134] Fixed: Jamf Connect presents the following one-time prompt on computers with macOS Tahoe 26.1 beta, both on the login window and on the desktop: "Self Service+ wants to use your confidential information stored in "Jamf Connect" in your keychain."

[PI143435] Fixed: When RapidIdentity is the identity provider, the Jamf Connect login window requests the local account password during the password verification workflow instead of the identity provider password.

Description: Details of maintenance: Jamf Connect will be upgraded to 3.5.0 for Athletics devices.

Benefit of change: Jamf Connect will be on the latest supported version. This change will fix the "Jamf Connect Wants to access key "Jamf Connect" in your keychain" popup that many users have been receiving. Athletics was exempted from the previous change due to the need to test if their Entra tenant would still work with this change.

Impact to customers: Customers will see UI changes in the Jamf Connect login screen which does contain UI changes. These changes are outlined in this Knowledge Base article: Apple Device Management – MacOS Login with Jamf Connect

Description: Details of maintenance: Jamf Connect will be upgraded to 3.5.0 and Self-Service will be upgraded to Self Service+.

Benefit of change: Jamf Connect and Self Service will be on the latest supported version. This change will fix the "Jamf Connect Wants to access key "Jamf Connect" in your keychain" popup that many users have been receiving.

Impact to customers: Customers will see UI changes in the Jamf Connect login screen and will have Self-Service replaced with Self Service+ which does contain UI changes. These changes are outlined in these two Knowledge Base articles: Apple Device Management – MacOS Login with Jamf Connect Apple Device Management – Using Apple Self Service+

Description: Details of maintenance: The new version of Code Maroon will be made available in Self-Service replacing the older, out of date version. An Uninstaller named "Code Maroon - Uninstall" will also be made available. When Code Maroon is run, users will be presented with a list of locations. When a location is selected, the installer/script for that location will run. The installers are assigned to 11 different policies that only run via custom event triggers. These policies will be set to global but will not run unless a corresponding location is selected via Code Maroon.  These 11 location policies that will be set to global are: Coder Maroon - BCS Coder Maroon - College Station Coder Maroon - Corpus Christi Coder Maroon - Dallas Coder Maroon - HECM Coder Maroon - Houston Coder Maroon - Kingsville Coder Maroon -  Law Coder Maroon - McAllen Coder Maroon - RoundRock Coder Maroon - Temple

After installation the user will be asked for an optional restart to successfully complete the installation. This is made clear before and after the installation.

Benefit of change: The older version of Code Maroon is out of date and this new version will ensure that users will continue to receive alerts in the future. The uninstaller will also make it easier to uninstall the application if the user chooses to do so.

Impact to customers: None. The application will just be an optional download on the Self-Service Hub.

Description: Details of maintenance: The Proofpoint agent has been upgraded from 3.8 to 4.4.2.76. This change will be upgrading the version for targeted devices.

Benefit of Change: This will get devices on the latest version of proofpoint that contains proper macOS Tahoe compatibility.

Impact to customers: No impact to customers.

Description: This change is to remove stale devices that have not been in communication with the Jamf Pro management server, or any other sensor. Devices that meet the criteria "Have not checked in since 1/1/2025" will be removed from the server. These devices will be cross-verified in Axonius to ensure no other service has detected these devices in use to rule out an issue with Jamf Pro communication.

--Benefit of Change: this will remove devices that may be included in reports unless specifically accounted for, skewing report numbers. It will also free up Jamf Pro licensing and allow for more accurate numbers for billing and reconcilliation.

Description: This change introduces new Jamf sites, Automated Device Enrollments, and prestage configurations for the Bush, Architecture, and Mays schools. By separating these colleges into their own managed environments, we can streamline deployments and improve scoping accuracy. This structure reduces manual effort for IT and supports more reliable, consistent device onboarding across all three groups.

Description: Details of maintenance: This change consists of the implementation of a new Recast Management Server [MECM-1P-RCST-W1.auth.tamu.edu] and upgrade of existing Recast Console Extension agents on MECM Jump Servers and Recast Agents on workstations.

Degraded Recast Management Servers: mecm-1p-rcst-c1.auth.tamu.edu cm2-recast.as.tamu.edu

MECM Jump Servers: mgmt-3p-cst.auth.tamu.edu batcave.it.tamu.edu mgmt-2p-cst.ads.tamu.edu cm2.as.tamu.edu

Benefit of change: This change addresses issues with both former Recast Management Servers that were both in different states of degradation and could not be reverted to a functional state since no backup snapshot existed.

By implementing a new sever, its database is now on the primary sql.it.tamu.edu SQL server and the old servers may now be decommissioned.  The new server is on the latest Recast version 5.11.2511.1804, and agents and Recast Console Extensions will be upgraded on each MECM Jump Server. This brings alignment of each application version in accordance with the vendors specification for a properly configured environment.

The latest version includes several bug fixes and Right-Click Tools features outlined in the following release notes: https://docs.recastsoftware.com/help/recast-software-version-5-11-releases#recast-version-51125111804.

Impact to customers: There is no impact on campus faculty, staff, or students as it is a tool used by MECM admins. Recast Agents for OAL workstations will be upgraded and Unit Admins may deploy the new Recast Agent at their earliest convenience.