Jamf partner connector checklist

Symptoms to confirm

Not a symptom: Jamf-managed devices missing from Intune's device list; that's by design.

• Tenant administration › Connectors and tokens › Partner compliance management in the Intune admin center has no Jamf Device Compliance entry for a platform, or its Partner Status isn't Active.
• A device registered from Self Service stays at Compliant: N/A under Devices › All devices in the Microsoft Entra admin center, even after an hour or more.
• Users who register through the Company Portal app get an error mentioning AccountNotOnboarded.
• Jamf Pro devices match Device Compliance Integration - Registration Status: Not Registered.
• Legacy leftovers: Partner device management status: Terminated in Intune, or Jamf computers with Conditional Access Inventory State: Unresponsive.

Likely causes

• Two rules explain many cases: assigning a group makes Jamf the management authority for those users' devices on that platform, with one partner per platform; and Jamf states users can't be scoped to both Partner Device Management and Partner Compliance Management while registering or re-registering computers.

Checklist

1. 1

   Check the Intune side

   Open Tenant administration › Connectors and tokens › Partner compliance management and select the refresh icon. Every platform you use needs a Jamf Device Compliance entry with Partner Status Active.

2. 2

   Check the user

   The user must be in that group and hold an Intune licence. With Microsoft Graph PowerShell:

   powershell

   Connect-MgGraph -Scopes "User.Read.All","GroupMember.Read.All"
   $upn = "jane.doe@contoso.com"
   Get-MgUserLicenseDetail -UserId $upn |
     Select-Object -ExpandProperty ServicePlans |
     Where-Object ServicePlanName -like "INTUNE*"
   Get-MgUserMemberOf -UserId $upn -All |
     ForEach-Object { $_.AdditionalProperties["displayName"] }

3. 3

   Check the Entra applications

   In the Microsoft Entra admin center, open Entra ID › Enterprise apps and find Cloud Connector for Device Compliance and User registration app for Device Compliance. Both should exist with admin consent on their Permissions page.

4. 4

   Check Jamf Pro and the devices

   • In Settings › Global › Device Compliance, confirm each platform is enabled with the intended Applicable and Compliance groups.
   • Build a smart group on Device Compliance Integration - Registration Status is Not Registered to find devices that never registered.
   • Check inventory age. Microsoft's example Compliance group includes Last Inventory Update less than 2 days ago, so a Mac that stops submitting inventory falls out and turns noncompliant. On the Mac, sudo jamf recon submits inventory and sudo jamf policy runs pending policies.
   • Compliance reaches Entra ID when Compliance group membership changes, so updates follow your inventory cadence, not a fixed sync interval.
5. 5

   Repair a registration stuck at N/A

   With the device in the Compliance group and the user in the connector's group, run Microsoft's documented check in Terminal as the signed-in user:

   bash

   /usr/local/jamf/bin/jamfaad gatherAADInfo

6. 6

   Clear legacy leftovers

   If Partner device management still includes users you're moving to Device Compliance, remove their groups from Included groups and save; then in Jamf Pro open Settings › Global › Conditional access, select Edit, clear Enable Intune Integration for macOS and save. Follow the order in the migration guide, because it affects Macs that haven't moved yet.

7. 7

   Don't mix Intune enrollment with Jamf

   If a device is also enrolled in Intune MDM, Intune applies its own compliance policies and ignores the partner's. Retire it properly from one MDM; Microsoft notes that removing a management profile locally doesn't trigger Intune's cleanup. A fully released device shows None in the MDM column in Entra ID.

Verify

• Partner compliance management shows Partner Status Active for every platform you use.
• Jamf Pro reports the device's registration status as Registered.
• Under Devices › All devices in Entra ID, the device shows Compliant Yes; Jamf notes these records are labelled as managed by Microsoft Intune even though Jamf manages them.
• A fresh sign-in shows the compliant-device policy as Success. If the device is compliant but sign-ins still fail, the problem is client-side: see AADSTS53000 on a Jamf-managed Mac.

Prevent it next time

• Assign the partner to a dedicated user group and make Intune licensing part of the same onboarding step.
• Document the two Entra apps as integration components so an app clean-up doesn't delete them.
• Add the connector status and the Not Registered smart group to a monthly health check. Setup from scratch is in the Device Compliance setup guide.