Set Account Pictures via Jamf Connect

 This guide will walk you through setting the local macOS account pictures for endusers via Jamf Connect





Requirements:

Jamf Pro

Jamf Connect

Formatted ID Token Path setup in Jamf Connect Login Config (/private/tmp/token)

Azure Storage Blob

Email addresses of users follow a pattern for all users (john.smith@myorg.com, jsmith@myorg.com, etc..)


Tested with:

Azure AD and Jamf Connect


Test User:

John.smith@ericsontech.com


Steps:

1. First step is to get all of your user images. To make this easy on yourself name them the same as the user's email address. So for John Smith his email is john.smith@ericsontech.com I would name his image as john.smith@ericsontech.com.png and upload that image and all other user's images to an Azure Storage blob.

Example:










2. Setup this script to run via Jamf Pro. I have mine setup to run via Jamf Connect Notify

Note: 

You will need to update this with your Azure Storage Blob url 

curl -L "https://myazureblobname.blob.core.windows.net/mdm/$EMAIL.png" -o /tmp/$EMAIL.png

Also in the $USR update with your local itadmin account username if you have one.                      (example: ericsontechadmin)

The $USR is important as this is how we get the current user.

The $EMAIL may need to be updated here print a[i]}' | grep upn | cut -d ":" -f2) with a different value in your token for the user's email. In my it's UPN.

Link to script on Github:

3. The script will read the token that gets created when the user logs into Jamf Connect and use it to download the user's picture from Azure and set it to their account picture.

4. Example token file:












5. Final Result:



Comments

Post a Comment

Popular posts from this blog

Setup Device Compliance with Jamf and Intune

Image
  Requirements: Azure user group created Jamf Pro Smartgroup created Global admin rights in Azure AD Admin account in Jamf Pro Steps to setup Device Compliance 1. Login to Jamf Pro and go to: Global-->Device Compliance-->Pick your Compliance Group (Jamf Pro Smartgroup)-->Pick your Applicable Group (Smart group containing all computers Jamf Pro uses to send a compliance status to Microsoft Intune.) 2. Enable the setting in Jamf Pro and you will be redirected to Azure permissions page. Click Accept on each one. 3. Click the Open Microsoft Endpoint Manager button 4. Click the Add compliance partner button 5. Pick Jamf Device Compliance 6. Click Add groups and add your user group you created in Azure AD. I created one called "All Users" 7. You should see a screen like this. 8. Click Confirm 9. Now wait for the activation to apply. 10. Now the connection is complete and you can start registering devices via Company Portal. 11. Important with the new workflow Macs only sho
Read more

Vanta mass deployment

Image
I recently encountered a client with the need to deploy the Vanta agent to multiple macOS devices. Surprisingly, there was no officially supported method for this, even after consulting with Vanta support. However, through some reverse engineering, I managed to devise a solution. Let's begin by outlining the prerequisites for making this script work effectively. 1. A paid Vanta subscription and an admin account. 2. Your  VANTA_KEY= from here:  Setup Instructions - Vanta   3. Region of Vanta instance 4. Method to get email of the user you want to assign this agent to (optional) Ok now that we have this info we can edit my script. These are the values we need to update: AGENT_KEY="" OWNER_EMAIL="" REGION="" Examples: AGENT_KEY="rtvgbh5rvcnn928h2ag5ten11148q3ucwfj3f8zkr2grdk696rt0" OWNER_EMAIL="kyle@ericsontech.com" REGION="us" Here is the full script you can edit. https://raw.githubusercontent.com/kylejericson/JAMF/master/S
Read more