Jamf Device Compliance connector in Intune: partner status, permissions and sync errors

When the link between Jamf Pro and Intune breaks, nothing dramatic happens: Macs and iPhones stop turning compliant in Microsoft Entra ID, new registrations sit at N/A, and Conditional Access starts blocking people. In this post I'll show where the connector lives on both sides, what healthy looks like, and how to fix the usual causes.

Symptoms#

• Tenant administration › Connectors and tokens › Partner compliance management in the Intune admin center has no Jamf Device Compliance entry for a platform, or its Partner Status isn't Active.
• A device registered from Self Service stays at Compliant: N/A under Devices › All devices in the Microsoft Entra admin center, even after an hour or more.
• Users who register through the Company Portal app get an error mentioning AccountNotOnboarded.
• Jamf Pro devices match Device Compliance Integration - Registration Status: Not Registered.
• Legacy leftovers: Partner device management status: Terminated in Intune, or Jamf computers with Conditional Access Inventory State: Unresponsive.

Not a symptom: Jamf-managed devices missing from Intune's device list; that's by design.

Why it happens#

Two rules explain many cases: assigning a group makes Jamf the management authority for those users' devices on that platform, with one partner per platform; and Jamf states users can't be scoped to both Partner Device Management and Partner Compliance Management while registering or re-registering computers.

How to fix it#

1. Check the Intune side#

Open Tenant administration › Connectors and tokens › Partner compliance management and select the refresh icon. Every platform you use needs a Jamf Device Compliance entry with Partner Status Active. Open an entry and use Properties to check the assignment: a specific Entra user group (Microsoft recommends a dynamic one), never Add all users, which Microsoft says inhibits the connection.

2. Check the user#

The user must be in that group and hold an Intune licence. With Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "User.Read.All","GroupMember.Read.All"
$upn = "jane.doe@contoso.com"
Get-MgUserLicenseDetail -UserId $upn |
  Select-Object -ExpandProperty ServicePlans |
  Where-Object ServicePlanName -like "INTUNE*"
Get-MgUserMemberOf -UserId $upn -All |
  ForEach-Object { $_.AdditionalProperties["displayName"] }

Good looks like an Intune service plan with ProvisioningStatus Success, and the connector's group in the list.

3. Check the Entra applications#

In the Microsoft Entra admin center, open Entra ID › Enterprise apps and find Cloud Connector for Device Compliance and User registration app for Device Compliance. Both should exist with admin consent on their Permissions page. Microsoft notes that Jamf's wizard creates them, each through a sign-in a Global Administrator approves, and that they can't be pre-created. If one was deleted or lost its consent, repeat the connection from Jamf Pro's Settings › Global › Device Compliance with a Global Administrator, following Jamf's procedure for your version, rather than rebuilding an app by hand. Also check Service principal sign-ins for failures from the connector app, and keep the registration app excluded from compliant-device Conditional Access policies.

4. Check Jamf Pro and the devices#

• In Settings › Global › Device Compliance, confirm each platform is enabled with the intended Applicable and Compliance groups.
• Build a smart group on Device Compliance Integration - Registration Status is Not Registered to find devices that never registered.
• Check inventory age. Microsoft's example Compliance group includes Last Inventory Update less than 2 days ago, so a Mac that stops submitting inventory falls out and turns noncompliant. On the Mac, sudo jamf recon submits inventory and sudo jamf policy runs pending policies.
• Compliance reaches Entra ID when Compliance group membership changes, so updates follow your inventory cadence, not a fixed sync interval.

5. Repair a registration stuck at N/A#

With the device in the Compliance group and the user in the connector's group, run Microsoft's documented check in Terminal as the signed-in user:

/usr/local/jamf/bin/jamfaad gatherAADInfo

No prompt and Microsoft Entra ID acquired for macOS user followed by the user name means registration is good. A prompt that completes suggests the first attempt failed. A prompt ending in an error needs deeper registration troubleshooting. Remind users that registration runs from Self Service; Company Portal alone ends in AccountNotOnboarded.

6. Clear legacy leftovers#

If Partner device management still includes users you're moving to Device Compliance, remove their groups from Included groups and save; then in Jamf Pro open Settings › Global › Conditional access, select Edit, clear Enable Intune Integration for macOS and save. Follow the order in the migration guide, because it affects Macs that haven't moved yet. A Terminated status means the legacy connection was ended; Microsoft notes the legacy macOS records are removed about three months later.

7. Don't mix Intune enrollment with Jamf#

If a device is also enrolled in Intune MDM, Intune applies its own compliance policies and ignores the partner's. Retire it properly from one MDM; Microsoft notes that removing a management profile locally doesn't trigger Intune's cleanup. A fully released device shows None in the MDM column in Entra ID.

Verify the fix#

• Partner compliance management shows Partner Status Active for every platform you use.
• Jamf Pro reports the device's registration status as Registered.
• Under Devices › All devices in Entra ID, the device shows Compliant Yes; Jamf notes these records are labelled as managed by Microsoft Intune even though Jamf manages them.
• A fresh sign-in shows the compliant-device policy as Success. If the device is compliant but sign-ins still fail, the problem is client-side: see AADSTS53000 on a Jamf-managed Mac.

Prevent it next time#

• Assign the partner to a dedicated user group and make Intune licensing part of the same onboarding step.
• Document the two Entra apps as integration components so an app clean-up doesn't delete them.
• Add the connector status and the Not Registered smart group to a monthly health check. Setup from scratch is in the Device Compliance setup guide.

References#

• Integrate Jamf Pro with Microsoft Intune to report device compliance to Microsoft Entra ID
• Support third-party device compliance partners in Intune
• Jamf: Configuring the connection between Jamf Pro and Microsoft Intune