Jamf Pro vs Intune for Mac and iPhone in 2026: strengths, gaps and when to run both

If your organisation runs Microsoft 365 and owns Macs and iPhones, sooner or later someone asks whether Jamf Pro or Intune should manage them. Both are capable Apple management tools, built around different ideas. In this post I'll compare them on the areas that decide real projects, with no pricing and no marketing claims, and finish with a proof-of-concept plan so you can decide on evidence rather than opinion.

How to read this comparison#

Both products ship changes every month, so treat this as a map of documented capabilities in October 2026, not a scorecard. Two ground rules help. First, an Apple device can be enrolled in only one MDM at a time, so "running both" means splitting devices between the tools, or letting Jamf Pro manage Apple devices while Microsoft services handle identity, compliance signals and security. Second, compare against your own requirements list, not against either vendor's feature list.

At a glance#

Apple features and declarative device management#

Apple is moving device management to declarative device management (DDM), and software updates show it most clearly: Microsoft describes MDM-based update policies as deprecated and configures Apple updates through DDM, which needs iOS/iPadOS 17.0 or macOS 14.0 and later. Both tools have a DDM path now.

• Jamf Pro packages DDM as blueprints, built from templates or a component library, with activation conditions and dedicated software update components. Blueprints need Jamf Pro hosted in Jamf Cloud with Jamf Account single sign-on (OIDC) turned on. They have their own release notes, separate from Jamf Pro versions; the September 2026 notes, for example, added a Managed App component for macOS 26 and later.
• Intune exposes Apple declarative configurations, such as Software Update, under Declarative Device Management in the settings catalog, next to classic MDM payloads.

Microsoft is also moving more of Intune's Apple configuration into the settings catalog and recommends creating new policies there wherever possible. The Device features and Device restrictions templates, along with the already deprecated Endpoint protection and Extensions templates, are no longer being updated; in a future Intune release they'll be migrated to the settings catalog policy type, and creating new profiles from them will be deprecated. Microsoft Learn doesn't give a date. Certificate, Wi-Fi, VPN, email, wired network and derived credential profiles are still created from templates.

For day-zero support, read each vendor's statement for the next major Apple release and, rather than relying on reputation, check when each one supported the declarations you actually use in the last release cycle.

Scripting, inventory and targeting#

Jamf Pro is built around inventory. Extension attributes collect any value a script can return, smart groups recalculate from inventory, and policies run scripts and packages on triggers such as check-in, login or enrollment, or from Self Service. If you have years of Mac automation, much of it probably lives here.

Intune is built around Entra ID. Assignments target Entra groups, refined with filters; macOS shell scripts run as root or as the signed-in user on a schedule; custom attributes report script output per device. Entra dynamic groups and filters work from a fixed set of device properties, so list every smart group that depends on an extension attribute and work out its Intune equivalent before you assume parity. The migration guide has a mapping table.

Users: Self Service+ and Company Portal#

Self Service+ is Jamf's end-user app. On macOS it combines Jamf Pro content with the device's Jamf Protect security status and Jamf Connect account and password status; Jamf can roll it out automatically to Macs on macOS 13 or later, replacing classic Self Service, and Jamf also offers it on iOS and iPadOS. Company Portal offers available apps, enrollment and compliance status. On the Mac it also carries Microsoft's Enterprise SSO plug-in, so Jamf-managed Macs need Company Portal for Device Compliance registration and Platform SSO anyway.

Compliance, Conditional Access and identity#

With Intune, compliance is native: the policy evaluates the device and Entra ID uses the result in Conditional Access. With Jamf Pro, smart groups decide compliance and Device Compliance sends the state through Intune's partner compliance connector, so users still need Intune and Microsoft Entra ID P1 licences, and each device must be registered with Entra ID. Platform SSO works with either tool, and Jamf Connect remains Jamf's own option for Entra ID sign-in at the Mac login window.

When to keep Jamf Pro and integrate#

• A large Mac fleet whose policies, extension attributes and smart groups encode years of work.
• Your team relies on Jamf Connect, Jamf Protect or Self Service+.
• Microsoft 365 requirements can be met with the integrations: Device Compliance, Platform SSO, Entra ID single sign-on to Jamf Pro and Defender for Endpoint.

When to consolidate on Intune#

• Windows is the majority platform and one team manages everything.
• You want one compliance engine, one reporting surface and one set of RBAC roles.
• Your Mac requirements are covered by the settings catalog, DDM, shell scripts and PKG/DMG apps.
• Most devices use Automated Device Enrollment and run OS 26 or later, where Apple's migration flow avoids a wipe.

Splitting by device type, for example Jamf Pro for Macs and Intune for iPhones, is also a valid design, as long as each device has exactly one MDM.

Verify your decision with a proof of concept#

1. Enroll test devices through ADE in each tool and time the full setup, including apps.
2. Rebuild your ten most important profiles and scripts, and five smart groups that use extension attributes. On the Intune side, build them in the settings catalog rather than the templates due for deprecation.
3. Prove FileVault escrow, Platform SSO and a Conditional Access policy that requires a compliant device.
4. Deploy Defender for Endpoint and check device health in the Microsoft Defender portal.
5. Run a DDM software update with a deadline and check the reporting.
6. Walk your help desk's five most common Mac and iPhone tickets through each console.

Tips & gotchas#

• Revisit software update management first: legacy MDM update commands are deprecated on Apple's side, whichever tool you choose. See DDM software updates in Intune.
• Keeping Jamf Pro doesn't remove Intune licensing if you want Device Compliance.
• Don't treat the decision as permanent. Apple's newer migration flow makes a later move far less disruptive for ADE devices.

References#

• Configure update policies for Apple devices (Microsoft Learn)
• Apple device configuration list in the Intune settings catalog (Microsoft Learn)
• Jamf Pro Blueprints Configuration Guide (Jamf Learning Hub)
• Self Service+ for macOS Deployment Guide (Jamf Learning Hub)