2026-06-25 - Jamf School Blueprints Configuration Guide

Activation Conditions in Blueprints

You can now configure activation conditions in blueprints. An activation condition defines the state under which a blueprint's configurations apply to a device. Activation conditions are built from attributes that devices report about themselves, such as OS version, device model, and passcode status. You can also use activation conditions to target or exclude specific smart groups or static groups from receiving a blueprint's configurations.

When a device meets the conditions you define, the blueprint's configurations activate automatically without waiting for the device to check in. If you do not configure an activation condition, the blueprint applies to all devices in scope.

You can configure activation conditions in a blueprint using two methods. The first method uses a structured, tree-like visual builder that guides you through available options. This approach is recommended for most administrators. The second method is a text input field that accepts activation condition expressions, giving you direct control over the configuration and is intended for advanced use cases.

For example, you can use the criteria to target or exclude devices based on group membership. Use the operator to apply a blueprint only to devices in specific groups, or the operator to exclude groups from receiving the blueprint's configurations. In the text input field, this would be written as one of the following:

ANY @property(jamf.device.groups) IN {'groupA', 'groupB'}
NONE @property(jamf.device.groups) IN {'groupA', 'groupB'}

Note:

The visual builder supports the most commonly used criteria elements. If you enter a condition expression in the text field that the visual builder does not recognize, you cannot switch back to the structured view. After saving, the condition displays as the expression you entered rather than what was built in the structured visual view.

For more information on activation conditions, see Scope and Activation Conditions in blueprints.

Configuration Profile Payload Keys

The following configuration profile payload keys are now supported via blueprints in Jamf School:


Setting	Key Included in Payload	Requirements	Notes
Restrictions
Enable captive WiFi portal for login and unlock	`ForceCaptivePortalConnectionFromLockScreen`	Supervised computers with macOS 27* or later	Configure a captive WiFi portal at login or unlock
Enable WiFi network selection for login and unlock	`ForceWifiConfigurationOnLockScreen`	Supervised computers with macOS 27* or later	Configure WiFi network selection at login or unlock

*Feature support is based on testing with the latest Apple beta releases.

Deprecations and Removals

Apple will remove the following restrictions keys in macOS 27*, iOS 27*, iPadOS 27*, and tvOS 27*. Jamf recommends managing software updates with the Software Update Settings component. For more information, see Blueprint Builder.

allowRapidSecurityResponseInstallation
allowRapidSecurityResponseRemoval
enforcedSoftwareUpdateDelay
enforcedSoftwareUpdateMajorOSDeferredInstallDelay
enforcedSoftwareUpdateMinorOSDeferredInstallDelay
enforcedSoftwareUpdateNonOSDeferredInstallDelay
forceDelayedAppSoftwareUpdates
forceDelayedMajorSoftwareUpdates
forceDelayedSoftwareUpdates

*Feature support is based on testing with the latest Apple beta releases.