Jamf Pro with Entra ID as cloud identity provider: setup, group lookups and Graph errors

Jamf Pro can read users and groups straight from Microsoft Entra ID instead of an LDAP server: for inventory lookups, for scoping by Entra groups and for mapping Jamf Pro privileges to group membership. Setup is a short consent flow, but when it goes wrong you get a consent page that won't complete, lookups that return nothing or scopes that ignore nested groups. In this post I'll explain how the integration works, fix each failure and show what a healthy connection looks like.

Symptoms#

Need admin approval
AADSTS65004 UserDeclinedConsent - User declined to consent to access the app.
Authorization_RequestDenied. Insufficient privileges to complete the operation.

• The Microsoft consent page shows Need admin approval instead of the permission list, or returns AADSTS65004 after someone clicked Cancel.
• The connection saves, but its automatic verification or the attribute mapping test fails. When the connector lacks a permission, Microsoft Graph refuses the query with HTTP 403 and Authorization_RequestDenied. Insufficient privileges to complete the operation.
• User lookups return nothing for some users, or a user's memberships miss nested groups.
• Scoping by an Entra group misses expected users, or Jamf Pro slows down on objects scoped to many Entra groups.
• After the connection is added and its data used, scopes and accounts that relied on LDAP stop working.

Why it happens#

When you add the connection, Jamf Pro sends you to Microsoft's admin consent page for Jamf's connector application (the Jamf Pro Entra ID Connector in Jamf's documentation). Consent adds it to your tenant's enterprise applications and grants its Microsoft Graph permissions. Jamf documents "Sign in and read user profile" and "Read directory data" for the Jamf Pro application, and lists GroupMember.Read.All (application), User.Read (delegated) and User.Read.All (application). For lookups, Jamf Pro gets a token with the client credentials flow, queries Graph and maps the results to its own attributes. Each failure is a broken link in that chain:

• Consent: Jamf requires a Global Administrator; an account without enough rights sees Need admin approval instead of the permissions.
• Permissions: if a permission or its admin consent is removed later, Graph answers with Authorization_RequestDenied, which Microsoft attributes to the caller lacking sufficient permissions.
• Mappings: the User Id mapping must use an attribute that supports the $filter parameter in Entra ID; the Group Id mapping is always id.
• Groups: nested membership is only evaluated when transitive lookups are enabled, and Jamf Pro user groups used for privilege mapping must be standard groups named exactly like the Entra groups.
• LDAP: Jamf warns that adding the Entra ID connection before migrating an existing Active Directory or Entra Domain Services LDAP configuration can break the environment.
• Scale: many cloud identity provider groups in one scope cause performance issues.

How to fix it#

1. Confirm the prerequisites#

You need a Jamf Cloud environment (Jamf Commercial Cloud, Premium Cloud or High Compliance Cloud) and a Global Administrator for consent. If Jamf Pro already scopes with an LDAP server you plan to replace, follow Jamf's Migrating an LDAP Server to an Entra ID Cloud Identity Provider Instance workflow instead of adding a fresh connection.

2. Create the connection correctly#

1. In Jamf Pro, go to Settings › System › Cloud identity providers, click New, choose Entra ID and click Next.
2. Sign in on the consent page as a Global Administrator and accept the permissions. When prompted, verify the URL and click Continue.
3. On the Server Configuration tab, give the connection a unique display name (the Tenant ID is pre-filled) and select Transitive membership lookups if you use nested groups. If you also use Entra ID SSO for Jamf Pro, select Transitive groups for SSO and set User Mapping from the SAML Assertion to match your SSO user identifier. Jamf recommends a Connection Timeout of 5.
4. Keep the default mappings on the Mappings tab unless you have a reason to change them, then click Save. Saving triggers an automatic verification.

3. Fix consent errors#

Need admin approval means the signed-in account can't grant these permissions; have a Global Administrator run the New › Entra ID flow. AADSTS65004 means consent was declined; run the flow again and accept.

4. Fix Authorization_RequestDenied#

Check what the connector actually holds. In the Microsoft Entra admin center, open Enterprise applications, find the Jamf connector and open Permissions, or use Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All"
Get-MgServicePrincipal -Filter "startswith(displayName,'Jamf')" | Select-Object DisplayName, AppId, Id

$sp    = Get-MgServicePrincipal -ServicePrincipalId "<Id of the Jamf connector>"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

# Application permissions used for directory lookups
Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id | ForEach-Object {
    $roleId = $_.AppRoleId
    ($graph.AppRoles | Where-Object { $_.Id -eq $roleId }).Value
}

# Delegated permissions granted for the whole tenant
Get-MgOauth2PermissionGrant -Filter "clientId eq '$($sp.Id)'" | Select-Object ConsentType, Scope

Compare the output with Jamf's current permission list. If anything is missing, select Grant admin consent for your tenant on the application's Permissions page as a Global Administrator, then save the Jamf Pro connection again so it re-verifies.

5. Fix lookups and mappings#

Run Jamf's attribute mapping test (see Testing Cloud Identity Provider Attribute Mappings) with a known user and group. If a user can't be found, check that the User Id mapping uses an attribute that supports $filter and that the user actually has a value in it. Reverting custom mappings to Jamf's defaults is the quickest way to isolate a bad one.

6. Fix group scoping#

• Enable Transitive membership lookups so nested groups count.
• For privilege mapping, create standard Jamf Pro user groups named exactly like the Entra groups.
• In scope limitations and exclusions, Entra users and groups appear under the Directory Service headings.
• Instead of scoping one object to many Entra groups, build a smart group with those criteria and scope to it.

Verify the fix#

• The saved connection verifies, and the mapping tests return the expected attributes for a user, a group and that user's nested memberships.
• A test configuration profile limited to one Entra group reaches only its members.
• In the Entra sign-in logs, Service principal sign-ins for the Jamf connector show Success.
• The PowerShell check lists the permissions Jamf documents, with admin consent granted.

Prevent it next time#

• Treat the connector like any app with directory read access: review it with your app consent hygiene, but never remove its permissions without checking Jamf's list.
• Migrate from LDAP deliberately with Jamf's workflow; don't add the Entra connection alongside and hope.
• Prefer smart groups over long lists of Entra groups in scopes.
• For Entra ID sign-in to Jamf Pro and Self Service, see Single sign-on to Jamf Pro with Entra ID; for the bigger picture, see the Jamf and Microsoft integration overview.

References#

• Microsoft Entra ID Integration (Jamf Pro Documentation)
• Configuring an Entra ID Cloud Identity Provider Connection (Jamf Pro Documentation)
• Troubleshoot Authorization_RequestDenied error with Microsoft Graph (Microsoft Learn)
• Microsoft Entra authentication and authorization error codes (Microsoft Learn)