AADSTS53000 on a Jamf-managed Mac: compliant in Jamf Pro, blocked by Conditional Access

A user is blocked with AADSTS53000 while Jamf Pro insists the Mac is compliant. The catch: Conditional Access never asks Jamf. It reads the compliance flag on a Microsoft Entra device object, and only finds that object if the browser or app proves which device it's on. In this post I'll find the broken link from the sign-in log, fix it and prove the fix.

Symptoms#

Password and MFA succeed, then Outlook, Teams or a Microsoft 365 web app refuses access. Apps typically report:

AADSTS53000: Device is not in required device state: compliant.

The Microsoft Entra sign-in log shows error code 53000 with this failure reason:

Device is not in required device state: {state}. Conditional Access policy requires a compliant device, and the device is not compliant. The user must enroll their device with an approved MDM provider like Intune.

Yet Jamf Pro lists the Mac in its Compliance smart group. Related signs:

• A keychain prompt when a Microsoft app opens, such as Microsoft Teams wants to sign using key "Microsoft Workplace Join Key" in your keychain. Allow works once, Always Allow remembers the choice for that app only, and Deny stops the sign-in.
• AADSTS53001 (DeviceNotDomainJoined) instead of 53000: the policy demands a Microsoft Entra hybrid joined device, which a Mac can never be.

Why it happens#

Compliance travels along a chain, and AADSTS53000 means one link is broken:

1. Registration. The user registers the Mac with the Jamf Self Service policy, which creates a Microsoft Entra registered device. Company Portal on its own fails with AccountNotOnboarded.
2. Compliance reporting. Jamf decides compliance with its Applicable and Compliance smart groups and sends the management and compliance state through the Jamf Device Compliance connector in Intune to Entra ID. New registrations start as not compliant and update when Compliance group membership changes. The user needs an Intune licence and membership of the connector's Entra group.
3. Device identity. The browser or app must present the device. A private window, disabled cookies, a signed-out Edge profile, Chrome without Microsoft's extension or a denied keychain prompt make a compliant Mac look unknown.
4. The right object. After a re-registration, the sign-in can present a device ID that isn't the one Jamf reports as compliant.

How to fix it#

1. Read the failed sign-in#

In the Microsoft Entra admin center, open Entra ID › Monitoring & health › Sign-in logs, filter by user, time and status Failure, and open the event. The Conditional Access tab names the failing policy; Device info tells you where to go next:

2. Check the device object#

Under Devices › All devices in the Entra admin center, search for the Mac and check Compliant (Yes, No or N/A), the join type and the device ID. Microsoft Graph PowerShell shows duplicates quickly:

Connect-MgGraph -Scopes "Device.Read.All"
Get-MgDevice -Filter "displayName eq 'MBP-JSMITH'" -All |
  Select-Object DisplayName, DeviceId, IsCompliant, TrustType,
    RegistrationDateTime, ApproximateLastSignInDateTime

Good looks like one object with TrustType Workplace (Microsoft Entra registered), IsCompliant True and a DeviceId matching the sign-in log.

3. Fix compliance reporting#

• In Jamf Pro, confirm the computer is in both the Applicable and Compliance groups, and that the criterion Device Compliance Integration - Registration Status returns Registered. An inventory-age criterion such as Last Inventory Update drops Macs that stop submitting inventory.
• Run sudo jamf recon on the Mac; a change in Compliance membership is what triggers the update to Entra ID.
• In Intune, Tenant administration › Connectors and tokens › Partner compliance management should show the macOS Jamf Device Compliance entry with Partner Status Active, assigned to a group containing the user.
• Test the registration with the command Microsoft documents, as the signed-in user:

/usr/local/jamf/bin/jamfaad gatherAADInfo

No prompt plus Microsoft Entra ID acquired for macOS user and the user name means the registration is good. A prompt that completes suggests the first attempt failed, so recheck after the next compliance update. A prompt that errors needs the registration guide; connector problems are covered in Jamf partner connector problems in Intune.

4. Make browsers and apps present the device#

Any private window or disabled cookies defeats the check. If the browser asks for a certificate, the user must pick the one provisioned at registration. Answer keychain prompts with Always Allow. For the plug-in, see Platform SSO and the Enterprise SSO plug-in on Jamf-managed Macs.

5. Clean up stale registrations#

If the sign-in presents a device ID that isn't the compliant object, the Mac is using an older registration. Remove it on the Mac, re-run the Self Service policy, wait for the compliance update, and only then delete the orphaned object in Entra ID.

6. Correct the policy#

• If Require Microsoft Entra hybrid joined device is the only grant control applying to macOS, Macs fail with 53001. Scope it to Windows, or pair it with the compliant-device control under Require one of the selected controls.
• Exclude the User registration app for Device Compliance, created by Jamf's wizard, from compliant-device policies, or unregistered Macs can't register. For the 2026 baseline-scopes change, see the Device Compliance setup guide.

Verify the fix#

• A new sign-in in a normal window shows the policy as Success, with Device info listing the Entra object's device ID and Compliant and Managed set to Yes.
• Devices › All devices shows a single object for the Mac, Compliant Yes, and Jamf Pro shows it Registered and in the Compliance group.
• What If under Entra ID › Conditional Access › Policies confirms which policies apply to macOS; it doesn't evaluate real compliance, so pair it with the sign-in log.

Prevent it next time#

• Register only from Self Service, never from Company Portal alone.
• Deploy Edge sign-in, the Chrome extension and the Enterprise SSO plug-in from Jamf before enforcing.
• Keep a smart group of Applicable Macs that aren't Registered, and match inventory-based criteria to how often Macs report.
• Pilot in report-only mode (What If and report-only); the general playbook is AADSTS53000 vs AADSTS53003.

References#

• Integrate Jamf Pro with Microsoft Intune to report device compliance to Microsoft Entra ID
• Conditional Access: conditions and supported browsers
• Jamf: Device Compliance with Microsoft Entra and Jamf Pro