Jamf Connect with Entra ID checklist

Symptoms to confirm

• The login window shows Microsoft's sign-in page, so errors appear there with an AADSTS code. Microsoft's error reference describes the ones that matter for Jamf Connect as follows (the wording on the sign-in page can differ slightly):

AADSTS50011 InvalidReplyTo - The reply address is missing, misconfigured, or doesn't match reply addresses configured for the app.
AADSTS65001 DelegationDoesNotExist - The user or administrator hasn't consented to use the application with ID X.
AADSTS50105 EntitlementGrantsNotFound - The signed in user isn't assigned to a role for the signed in app.
AADSTS53000 DeviceNotCompliant - Conditional Access policy requires a compliant device, and the device isn't compliant.
AADSTS53003 BlockedByConditionalAccess - Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.
AADSTS50126 InvalidUserNameOrPassword - Error validating credentials due to invalid username or password.
AADSTS50076 UserStrongAuthClientAuthNRequired - ... the user must use multifactor authentication to access the resource.

• When the password check uses a registration that doesn't allow public client flows, it fails with AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'. Other signs: the menu bar app keeps asking for the password, and the Entra sign-in log for the Jamf Connect app shows repeated Interrupted entries, sometimes followed by lockouts.

Likely causes

Jamf Connect uses two flows against its app registration:

• Interactive sign-in (OpenID Connect authorization code flow) at the login window. Microsoft's page handles MFA and shows errors; redirect URI, consent, assignment and Conditional Access problems surface here.
• A Resource Owner Password Grant (ROPG) check that validates the password so Jamf Connect can create or sync the local account. The menu bar app repeats it in the background. ROPG is non-interactive: it can't satisfy MFA, the app must allow public client flows, and Entra ID must be able to validate the password in the cloud.

Checklist

1. 1

   Check the app registration (AADSTS50011)

   In the Microsoft Entra admin center, open Entra ID › App registrations and the Jamf Connect app. Jamf's setup uses Accounts in this organizational directory only and the redirect URI https://127.0.0.1/jamfconnect under the Public client (mobile & desktop) platform, not Web.

2. 2

   Grant admin consent (AADSTS65001)

   Under API permissions, select Grant admin consent for your tenant. The background password check can't show a consent prompt, so without admin consent it fails with AADSTS65001.

3. 3

   Allow public client flows for the password check (AADSTS7000218)

   On the Authentication settings of the registration Jamf Connect uses for sign-in and the ROPG check, set Allow public client flows to Yes. Without it, Entra ID expects a client secret and returns AADSTS7000218.

4. 4

   Make sure the password can be validated in the cloud (AADSTS50126)

   AADSTS50126 is usually a mistyped password, but ROPG also needs Entra ID to validate the password itself rather than hand it to a federation server. For a federated domain, Jamf's documentation covers confirming password hash sync and creating a Home Realm Discovery policy for cloud password validation.

5. 5

   Rebuild the Conditional Access exclusion (AADSTS50076, AADSTS53000, AADSTS53003)

   Don't use per-user MFA: it challenges every sign-in, including the non-interactive password check that can't complete MFA, so enforce MFA through Conditional Access instead. Then follow Jamf's current procedure, which recommends new app registrations rather than edited ones:

   • Create an app registration that exposes a custom API (Jamf names it Jamf Connect - Conditional Access Policy API).
   • Create the Jamf Connect app registration that calls that custom API as a scope (Jamf names it Jamf Connect - OIDC Endpoint); it uses the public client redirect URI, allows public client flows and needs admin consent for the custom scope.
   • In every policy scoped to all resources (all cloud apps), add Jamf Connect - Conditional Access Policy API to the excluded resources under Target resources.
   • Build the Jamf Connect configuration with the custom API and scope.
6. 6

   Assign users (AADSTS50105)

   If the enterprise application has Assignment required turned on, every Jamf Connect user needs an assignment, directly or through a group. Jamf's setup can also add app roles (for example Administrator and Standard) to decide who gets an admin account, so check role assignments when users get the wrong account type.

Verify

Keep a way back: if the login window misbehaves after a change, a Jamf Pro policy running this command restores the standard macOS login window.

• Before deploying, run the sign-in and password (ROPG) tests in the Jamf Connect Configuration app against your registrations.
• In the Entra sign-in logs, filter on the Jamf Connect application. Good looks like successful login-window sign-ins (with MFA where policies require it) and background password checks that no longer show as Interrupted.
• Every policy scoped to all cloud apps lists the custom API under excluded resources.
• On a test Mac, sign in at the login window, confirm the local account is created or matched, then change the password in Entra ID and check that the menu bar app prompts to sync.

sudo /usr/local/bin/authchanger -reset

Prevent it next time

• Document both registrations: which is the custom API, which allows public client flows, and which client IDs the profile uses.
• Re-check the exclusion whenever someone creates a policy targeting all resources, and test changes in report-only mode first.
• Keep MFA in Conditional Access only. Background reading: the MFA error codes and AADSTS53000 vs AADSTS53003.