Many organisations manage Windows with Intune and their Macs, iPhones and iPads with Jamf Pro, yet want one Conditional Access story for Microsoft 365. Jamf and Microsoft meet in more places than most admins realise: compliance, device identity, user sign-in, admin sign-in, threat signals and app deployment. In this post I'll map each integration, explain what it's for and where it's configured, and point to the detailed guide for each.
Status (October 2026): Jamf Pro's original macOS Conditional Access integration is retired. Jamf gives 31 January 2025 as the removal date of the Microsoft Partner Device Management API it used, and Microsoft's main Jamf integration page gives the same date for the end of support (Microsoft's Jamf troubleshooting article still shows the earlier 1 September 2024). New connections must use Device Compliance. In 2026 Jamf also changed the registration flow for Microsoft's Conditional Access baseline scopes enforcement (Jamf Pro 11.32.1 or later). Re-check Microsoft Learn and the Jamf Learning Hub, because both change often.
How it works: Jamf decides, Entra ID enforces#
The core integration is Device Compliance. Jamf Pro works out whether a device is compliant using smart groups, then sends its management and compliance state through Intune's partner compliance connector (Microsoft's Partner Compliance Management API) to the device object in Microsoft Entra ID. Conditional Access can then require a compliant device for Jamf-managed Macs, iPhones and iPads exactly as it does for Intune-managed Windows PCs.
Three consequences surprise people. Intune doesn't manage these devices, so they don't appear in Intune's device list, although Entra ID labels them as managed by Microsoft Intune. Your Intune compliance policies don't evaluate them; the Jamf smart group does. And each user must register the device with Entra ID from Jamf Self Service: on macOS that needs Company Portal installed, on iOS and iPadOS Microsoft Authenticator. Users need Microsoft Entra ID P1 and Intune licences.
The integrations at a glance#
| Goal | Integration | Where it's configured | Guide |
|---|---|---|---|
| Only compliant Macs reach Microsoft 365 | Jamf Pro Device Compliance (macOS) | Jamf Pro Settings › Global › Device Compliance; Intune Tenant administration › Connectors and tokens › Partner compliance management | Setup |
| Same for iPhone and iPad, plus app protection | Device Compliance (iOS/iPadOS) with Intune app protection policies | Jamf Pro, Intune, Authenticator on the device | iOS guide |
| Still on the old integration | Legacy macOS Conditional Access (retired) | Jamf Pro Settings › Global › Conditional Access | Migration |
| Fix registration, connector or sign-in failures | jamfAAD, Company Portal, partner connector, sign-in logs | Mac, Jamf Pro, Intune, Entra admin center | Registration, connector, blocked Macs |
| SSO to Microsoft apps, Entra-backed Mac sign-in | Microsoft Enterprise SSO plug-in and Platform SSO | Jamf Pro configuration profile; Company Portal on the Mac | Platform SSO |
| Entra ID account at the Mac login window | Jamf Connect | Entra app registration; Jamf Connect profile | Jamf Connect |
| Scope Jamf Pro by Entra users and groups | Entra ID as Jamf Pro's cloud identity provider | Jamf Pro cloud identity provider settings; Entra consent | Cloud IdP |
| Admins and users sign in to Jamf with Entra ID | SAML single sign-on | Entra enterprise app; Jamf Pro SSO settings | SAML SSO |
| Device threat level in compliance | Jamf as an Intune Mobile Threat Defense partner | Intune Tenant administration › Connectors and tokens › Mobile Threat Defense; Jamf console | MTD |
| Defender for Endpoint on Macs | Defender package and profiles from Jamf Pro | Jamf Pro; Microsoft Defender portal | Defender |
| Microsoft 365 apps, Company Portal, AutoUpdate | Jamf Pro packages and Mac Apps | Jamf Pro | Apps |
| Consolidate or compare | Move to Intune, or keep both | Apple Business Manager, Intune | Migration, comparison |
Compliance: Device Compliance and its alternatives#
Device Compliance is configured from the Jamf side. A wizard in Jamf Pro creates two Entra apps, Cloud Connector for Device Compliance and User registration app for Device Compliance; you then add Jamf Device Compliance as a partner in Intune, assigned to a user group. Two smart groups drive it: Applicable (who must register) and Compliance (who passes). The User registration app must be excluded from Conditional Access policies that require a compliant device, or users can't register.
Two newer points matter in 2026. Jamf's requirements now include a configured Microsoft SSO extension or Platform SSO, and Microsoft is moving device identity keys on Apple devices from the keychain to the Secure Enclave, so apps that don't use MSAL, Safari included, need the Enterprise SSO plug-in to take part in device-based Conditional Access. Jamf also documents Attested Device Compliance, where Conditional Access trusts a named location built from IP addresses issued by Jamf's Security Cloud service, which only enrolled, Apple-attested, compliant and threat-free devices can use. Treat it as a separate design to evaluate.
Identity: Platform SSO, Jamf Connect and Entra ID in Jamf Pro#
- Platform SSO is Apple's framework; Microsoft's implementation ships in Company Portal as the Enterprise SSO plug-in. Jamf Pro delivers the SSO extension settings in a configuration profile (extension ID
com.microsoft.CompanyPortalMac.ssoextension, team IDUBF8T346G9). The Intune version is covered in Platform SSO for macOS with Intune. - Jamf Connect is Jamf's own login window and menu bar app. It authenticates users against Entra ID at login, can create local accounts and keeps the local password aligned with the cloud one. If you run it alongside Platform SSO, test the combination on your versions.
- Entra ID inside Jamf Pro covers two separate things: Entra ID as a cloud identity provider (user and group lookups for scoping) and SAML single sign-on for admins and Self Service.
Security and apps#
Jamf's mobile threat defense can feed a device threat level into Intune compliance and app protection through the Mobile Threat Defense connector. For endpoint protection, Microsoft documents deploying Defender for Endpoint on Macs with Jamf Pro; Jamf Protect is Jamf's own Mac security product, and this series sticks to the Microsoft integrations. Microsoft's own walkthrough deploys Company Portal from the Jamf App Catalog, which keeps it current.
Verify: what a healthy setup looks like#
- In Intune, Partner compliance management shows Jamf Device Compliance as Active for each platform you use.
- In Entra ID, each device has one object, managed by Microsoft Intune, and is compliant while in the Compliance smart group.
- On a registered Mac, the command below returns
Microsoft Entra ID acquired for macOS user ...without a prompt. - Sign-in logs for Mac users show the device ID and a compliant state.
/usr/local/jamf/bin/jamfaad gatherAADInfoTips & gotchas#
- One management source per device. A Jamf Mac registered by opening Company Portal directly enrolls without its Jamf connection and shows
Account not onboarded. - Assign the Intune partner to a user group; Microsoft warns that Add all users inhibits the connection.
- Start Conditional Access in report-only mode: What If and report-only.
- Comparing other partners? See third-party compliance partners in Intune.
