Jamf's mobile threat defense can tell Intune when an iPhone or Android device has a malicious app, a risky network profile or a vulnerable OS version, and Intune can then block that device from Microsoft 365. Getting there takes consent in two consoles, an activation profile, the Jamf Trust app and the right policy settings. In this post I'll cover the setup, how to prove it works, and what to check when devices never get a threat level.
How it works#
Microsoft Learn lists Jamf as an Intune Mobile Threat Defense (MTD) partner under several names (Jamf Mobile Threat Defense, Jamf Mobile Threat Protection, Jamf Mobile Security). The Intune connector drop-down shows Jamf Trust, the name of the device app, and older Intune documentation used the earlier product name, Wandera. You administer it in the Jamf Security Cloud portal.
- UEM Connect in Jamf Security Cloud synchronises user and device lifecycle data with Entra ID and Intune, along with each device's threat level.
- Jamf Trust on the device collects telemetry such as OS vulnerabilities, malicious apps, malicious network profiles and cryptojacking. Jamf turns it into a risk level, which you can tune in the Jamf console.
- Intune uses the threat level in device compliance (and so in Conditional Access) and in app protection policies for unenrolled devices.
Supported platforms: Android 11 and later, and iOS/iPadOS 15.6 and later.
Note: Intune compliance policies only evaluate devices enrolled in Intune. iPhones and iPads managed by Jamf Pro report compliance through Jamf Pro Device Compliance instead, so don't assume the Intune threat-level setting applies to them.
Prerequisites#
- Microsoft Intune Plan 1 and a Jamf Security Cloud subscription with a super admin account.
- An Entra admin who can consent to the permissions Jamf requests, including Read directory data and Send device risk information to Intune.
- In Intune, the Endpoint Security Manager role, or a custom role with Read and Modify on the Mobile Threat Defense permission.
Step 1: Connect Intune and Jamf Security Cloud#
- In the Microsoft Intune admin center, go to Tenant administration › Connectors and tokens › Mobile Threat Defense, select Create and choose Jamf Trust.
- Select Open the Jamf Trust admin console and sign in to Jamf Security Cloud.
- Go to Integrations › UEM Integration, open the UEM Connect tab and set EMM Vendor to Microsoft Intune.
- Next to Microsoft Intune User and Device Sync, select Grant, sign in as the Entra admin, tick Consent on behalf of your organization and accept. Repeat for every listed integration until each has a green tick.
- Back in Intune, finish the connector, turn on the toggles you need and save. Microsoft's Jamf guide turns on all of them.
The toggles control which platforms send threat data for compliance and app protection evaluation, plus options such as Enable App Sync for iOS devices and Send full application inventory data on personally-owned iOS/iPadOS devices; review the privacy impact of the inventory options before enabling them. Also note Number of days until partner is unresponsive: if Jamf stops syncing for longer than that, Intune stops relying on its data.
Step 2: Activate Jamf Trust on enrolled devices#
- In Jamf Security Cloud, create an activation profile under Devices › Activation profiles. For Intune deployments, Microsoft recommends setting Associated User to Authenticated by Identity Provider › Microsoft Entra.
- Choose Microsoft Intune as the UEM solution and download the iOS profile: iOS and iPadOS supervised or unsupervised, matching your fleet.
- In Intune, go to Devices › iOS/iPadOS › Configuration profiles › Create › New Policy, choose Templates › Custom, upload the file and assign it to a pilot group, naming it after the activation profile.
- Deploy the Jamf Trust app (iOS bundle ID
com.jamf.trust) and its app configuration as described in Microsoft's Add MTD apps guidance, for iOS/iPadOS and Android.
Watch out: Microsoft's guide stresses picking the profile that matches each device's supervision state. In a mixed fleet, deploy both profiles to separate groups rather than one profile to everyone.
Step 3: Unenrolled devices with app protection#
For personal devices that only run app protection policies, users activate Jamf by signing in with Entra ID, so the activation profile must use the Microsoft Entra associated-user option. In Jamf Security Cloud, under Devices › Activation profiles, open the Identity-based provisioning tab and, in the Microsoft section, turn on the toggle for that profile. Keep Everyone (any group) or limit it to specific Entra group IDs; a profile without group IDs is the catch-all for users who match no other profile.
Step 4: Use the threat level in policies#
- Compliance: in an iOS/iPadOS or Android compliance policy, set Require the device to be at or under the Device Threat Level (Device Health section) to Secured, Low, Medium or High. Secured tolerates no threats; High tolerates every level, which effectively makes the setting report-only. Assign the policy to user groups, because Microsoft doesn't support device-group targeting for this setting, and pair it with a Conditional Access policy that requires a compliant device.
- App protection: under Conditional launch › Device conditions, add Max allowed device threat level with the action Block access or Wipe data. If you also use Microsoft Defender for Endpoint as an MTD, check which service the policy uses for this check.
Verify#
- Jamf Security Cloud shows green ticks on every UEM Connect grant, and the pilot device appears as activated.
- In Intune, the Mobile Threat Defense list shows the Jamf connector as Enabled, with a current last synchronized time.
- On the device record, under Device compliance, the threat-level setting is evaluated rather than missing.
- The Entra sign-in log for the pilot user shows the device as compliant and the Conditional Access policy as satisfied.
Troubleshooting common problems#
| Symptom | Likely cause | What to check |
|---|---|---|
| Connector status stays Not Set Up, or shows Available instead of Enabled | A grant without a green tick, or no platform toggle turned on | Re-run every Grant in UEM Connect, turn on the platform toggles, then save the Intune connector again |
| Consent fails | The admin can't grant tenant-wide consent for the requested permissions | Use an Entra admin whose role allows admin consent |
| Device noncompliant on threat level while Jamf shows it clean | Jamf Trust not activated, wrong activation profile, or no report yet | Device list in Jamf Security Cloud; open Jamf Trust; check the profile assignment |
| Some devices never activate after the profile deploys | Profile type doesn't match the device's supervision state | Profile status in Intune; split assignments by supervision state |
| Threat level ignored after an outage | Partner marked unresponsive | Last sync time; UEM Connect health in Jamf Security Cloud |
| App protection never checks the threat level | App protection toggle off, setting missing in Conditional launch, or no Entra identity-based provisioning | Connector toggles, policy settings, the activation profile's Microsoft section |
Tips & gotchas#
- Pilot with High first so you can watch threat data arrive before tightening to Medium or Low.
- Comparing partners? See MTD connectors in Intune, the Defender equivalent in the machine risk score checklist, and the Jamf and Intune overview.
