Third-party compliance partners in Intune (Workspace ONE, Ivanti, Citrix): setup and fixes

If your iPhones, Android devices or Macs are managed by another MDM such as Omnissa Workspace ONE UEM, Ivanti or Citrix, you can still use the Conditional Access control "Require device to be marked as compliant": the partner reports compliance through Intune into Microsoft Entra ID. In this post I'll walk through the data flow, setup on both sides, registration, Conditional Access and the usual fixes.

How it works#

1. The partner MDM evaluates the device against its own compliance rules.
2. It sends the device's management and compliance state to Intune's partner compliance service.
3. Intune writes that state to the device record in Microsoft Entra ID, where Conditional Access evaluates it.

Two rules shape every design. Assigning a partner to an Entra user group makes that partner the MDM authority for those users' devices on that platform, and you can use only one partner per platform. The integration covers Android, iOS/iPadOS and macOS; not every partner supports all three.

Microsoft's generally available list (checked October 2026) includes 42Gears SureMDM, 7P, Addigy, BlackBerry UEM, Citrix Workspace device compliance, CLOMO MDM, Fleet, IBM MaaS360, Jamf Pro, Iru, Ivanti Neurons for MDM, Ivanti EPMM, mobiconnect, Mosyle Fuse, Mosyle Onek12, Omnissa Workspace ONE UEM, Scalefusion and SOTI MobiControl. Partners can also self-onboard their own connectors, and Microsoft notes it's revamping the partner process, so re-check the list.

Prerequisites#

• An Intune subscription, and Intune licences for the device users, even though Intune doesn't manage those devices.
• Microsoft Entra ID P1 or P2 for Conditional Access.
• The partner's subscription with the Entra integration. Ivanti's knowledge base, for example, describes it as a premium offering for Secure UEM Premium and Platinum customers; Workspace ONE needs Omnissa Intelligence opted in.
• For a self-onboarded partner, the Entra application ID the partner gives you.

Step 1: Add the partner in Intune#

1. In the Intune admin center, go to Tenant administration › Connectors and tokens › Partner compliance management › Add compliance partner.
2. On Basics, pick the partner. The entry can carry a product-specific name: Omnissa's guide, for example, says to select Workspace ONE Conditional Access, so follow your partner's guide. For a partner missing from the list, choose Custom MDM Compliance Partner and enter its Entra application ID; if the ID doesn't belong to a validly onboarded partner, the configuration can't be completed.
3. Choose the Platform. Repeat the wizard for each platform the partner manages.
4. On Assignments, select the user groups whose devices this partner manages, then Review + create.

To change groups later, open the configuration, select Properties and edit the assignments. With Workspace ONE, also sync manually: in the UEM console go to Settings › System › Enterprise Integration › Directory Services and select SYNC next to Sync Azure Services. Until you do, users in newly assigned groups don't report compliance.

Step 2: Configure the partner side#

• Omnissa Workspace ONE UEM: follow Omnissa's Conditional Access using Microsoft Entra ID guide. Intelligence is on by default for SaaS; on-premises customers must configure it. Entra ID GCC High is supported only in Omnissa-hosted FedRAMP SaaS environments, and Windows devices follow a different path with their own restrictions in Omnissa's guide.
• Ivanti Neurons for MDM (formerly MobileIron Cloud): under Admin › Microsoft Entra ID › Device Compliance, add a configuration under Device Compliance for iOS, macOS and Android, confirm that partner compliance and Conditional Access are set up, enter your tenant ID, and set the enrollment URL (where unmanaged devices are sent) and remediation URL (where noncompliant devices are sent). Then add a Partner Device Compliance configuration with compliance status reporting turned on and distribute it to the devices; Ivanti's troubleshooting steps check that users have it. For Ivanti EPMM, follow Ivanti's documentation for that product.
• Citrix and others: use the partner's own integration guide; Microsoft's partner page points to each partner's documentation.

Step 3: Register the devices in Entra ID#

Conditional Access needs the device registered in Entra ID; the partner's agent drives registration with a Microsoft app:

• iOS/iPadOS and Android: Ivanti lists Microsoft Authenticator on users' devices as a requirement, and Omnissa lists both Intelligent Hub and Microsoft Authenticator as required apps for Workspace ONE.
• macOS with Workspace ONE: Omnissa recommends Secure Enclave-based registration through Intune Company Portal; legacy keychain-based registration needs Intelligent Hub 21.11 or later.

Users normally start registration from the partner's agent app; a device that doesn't complete it can't satisfy a compliant-device policy.

Step 4: Add Conditional Access#

Create a policy for a pilot group: platforms iOS, Android and macOS as relevant, grant Require device to be marked as compliant, mode Report-only. Ivanti's guide recommends the same report-only start. Check the sign-in logs, then switch it on. If registration is blocked by your own policies, check which apps the partner says to exclude. Background: What If and report-only mode.

Verify#

• Partner compliance management lists a configuration for the partner on each platform you use, assigned to the right user groups, and the partner's console reports a working connection.
• In the Microsoft Entra admin center, Devices › All devices shows the test device as compliant: Yes, or No if it fails a partner rule, but not N/A.
• A sign-in from that device shows it as compliant in the sign-in log, and the report-only policy reports success.

Common problems#

Migration considerations#

When moving devices from a partner to Intune, Microsoft's cleanup order is:

1. Retire the device from the partner MDM first; that notifies Intune to clean up. Removing the management profile locally isn't enough.
2. Confirm the device shows None in the MDM column in Entra ID, then enroll it in Intune.
3. When every device has moved, disable the Intune connection in the partner's console, or switch the partner connection off under Tenant administration › Connectors and tokens.

Because the partner assignment sets the MDM authority for those users' devices on that platform, remove migrating users from the partner's group before they enroll in Intune, and expect a short gap until Intune's own compliance evaluation reports in.

Tips & gotchas#

• Use a dedicated user group per partner and platform, and add Intune licensing to the same onboarding step.
• Monitor partner-managed devices in Entra ID (Devices › All devices), which is where Microsoft points you; they aren't enrolled in Intune.
• Using Jamf Pro for Macs? See the Jamf Pro Device Compliance setup guide and partner connector troubleshooting.

References#

• Support third-party device compliance partners in Intune (Microsoft Learn)
• Conditional Access using Microsoft Entra ID (Omnissa Docs)
• N-MDM: Azure Device Compliance for iOS and Android (Ivanti knowledge base)