Legacy integration to Device Compliance migration checklist

Checklist

1. 1

   Build the groups and the registration policy

   Create the Applicable and Compliance computer smart groups and the Self Service registration policy as described in the setup guide. Make sure the Applicable group includes every Mac that will migrate, because Jamf scopes the migration script to it.

2. 2

   Protect sign-ins for the migration window

   Set Mac-only policies that require a compliant device to Report-only. For policies shared with Windows, add a temporary exclusion group of Mac users instead and empty it as Macs are verified.

3. 3

   Switch the integration in one sitting

   • In the Intune admin center, open Tenant administration › Connectors and tokens › Partner device management, remove the groups containing the users you're migrating from Included groups and save. Jamf notes that users can't be scoped to both Partner Device Management and Partner Compliance Management while their computers register.
   • In Jamf Pro, open Settings › Global › Conditional access, select Edit, clear Enable Intune Integration for macOS and save. Jamf notes that Intune then allows a 60-day grace period before marking the registered computers as noncompliant in Entra ID.
   • Immediately configure Settings › Global › Device Compliance: enable macOS, pick the two smart groups, save and complete both Global Administrator consent prompts.
   • In the Intune admin center, Tenant administration › Connectors and tokens › Partner compliance management › Add compliance partner: Jamf Device Compliance, platform macOS, assigned to your Entra user group (not Add all users). Confirm in Jamf and refresh until the partner shows Active.
4. 4

   Exclude the User registration app

   Exclude the new User registration app for Device Compliance from Conditional Access policies aimed at all resources that require compliance, MFA or other user interaction. If your tenant has the 2026 baseline scopes enforcement, also apply Jamf's scope profile (Jamf Pro 11.32.1 or later), described in the setup guide.

5. 5

   Deploy Jamf's migration script through Self Service

   • In Jamf Pro, go to Settings › Computer management › Scripts › New and paste the script from Jamf's guide.
   • In Computers › Policies › New, select no triggers, add the script, scope the policy to the Applicable group and make it available in Self Service.
   • Ask users to run it while logged in; it needs their session and may ask for credentials. Jamf Support can discuss options if you need a migration without user interaction.
6. 6

   Catch the stragglers

   Policy logs that end with no WPJ key found mean the user has no registration: ask them to run the normal registration policy. For broken or duplicate registrations, follow the registration troubleshooting guide.

7. 7

   Retire the old pieces

   Once every Mac reports through Device Compliance, unassign Intune macOS compliance policies that existed only for Jamf Macs (keep those for Intune-enrolled Macs), and review the legacy Entra app for removal. Then move the report-only policies back to On, one ring at a time.

Verify

• Intune shows the macOS Jamf Device Compliance partner as Active.
• On a migrated Mac, as the user, the command below returns Microsoft Entra ID acquired for macOS user ... without a prompt.
• The Mac's Entra device object turns compliant once the Mac is in the Compliance smart group.
• Sign-in logs for migrated users show the compliant-device policy would have been satisfied in report-only. Only then switch it back on.

/usr/local/jamf/bin/jamfaad gatherAADInfo

To track progress, build the two smart computer groups Jamf recommends.

Tips & gotchas

• An Applicable group that's too narrow is the classic reason Macs never migrate.
• Users who open Company Portal directly get AccountNotOnboarded; registration must start in Self Service.
• Network accounts aren't supported by the macOS integration; users need local or mobile accounts.
• For the wider picture, see how the Jamf and Intune integrations fit together.