Set up Jamf Pro Device Compliance with Microsoft Entra ID and Intune, step by step

Jamf Pro Device Compliance lets Jamf decide whether a Mac is compliant and passes that verdict to Microsoft Entra ID through a partner connector in Intune, so one Conditional Access policy can protect Microsoft 365 on Windows PCs and Jamf-managed Macs alike. In this post I'll set it up end to end: Jamf Pro groups and policy, the connection wizard, the Intune connector, a Conditional Access policy that doesn't block registration, and how to prove it works.

Prerequisites#

• Jamf Pro version. Jamf lists 10.43.0 or later for macOS in Jamf Cloud and 11.6.0 or later on-premises (11.7.1 for government environments). Tenants affected by Microsoft's 2026 baseline scopes change need 11.32.1 or later (Step 6).
• Cloud Services connection enabled in Jamf Pro. It's on by default in most Jamf Cloud instances; on-premises servers must turn it on.
• Licences: Microsoft Entra ID P1 (for Conditional Access) and Microsoft Intune for the users.
• Admin accounts: a Jamf Pro account with device compliance privileges; a Global Administrator for the wizard's two consent prompts; Intune Administrator or narrower roles (Groups, Conditional Access and Application Administrator) for the rest.
• On the Macs: local or mobile accounts (network accounts aren't supported), the latest Self Service, a supported Company Portal, and a configured Microsoft SSO extension or Platform SSO, which Jamf now lists as a requirement.

Step 1: Create the Applicable and Compliance smart groups#

Device Compliance is driven by two computer smart groups. Create them in Jamf Pro under Computers › Smart Computer Groups › New:

Add your own rules (minimum macOS version, required security agents), starting achievable and tightening later. Entra ID is updated when Compliance group membership changes, so the inventory criterion matters: a Mac that stops sending inventory drops out and becomes noncompliant.

Step 2: Deploy Company Portal#

Registration needs Company Portal installed, even though users shouldn't open it themselves. In Computers › Mac Apps › New, choose Jamf App Catalog, add Microsoft Intune Company Portal, target All Managed Clients with Install Automatically, enable Install supporting configuration profiles, switch on Deploy and save. The catalog version keeps itself current.

Step 3: Create the Self Service registration policy#

1. In Computers › Policies › New, give the policy a clear name such as Register with Microsoft Entra ID and keep it enabled.
2. In the Microsoft Device Compliance payload, enable Register computers with Microsoft Entra ID.
3. On the Scope tab, target the Applicable smart group.
4. On the Self Service tab, make the policy available, set a button name and a short description, and enable Ensure that users view the description.

Create the groups and this policy before you connect to Intune: the wizard in Step 5 asks for both groups.

Step 4: Create the Entra user group#

In the Microsoft Entra admin center, open Groups › All groups › New group and create a security group (dynamic is recommended, static works) with the users of Jamf-managed Macs. The Intune connector is assigned to it.

Step 5: Connect Jamf Pro to Intune#

1. In Jamf Pro, open Settings › Global › Device Compliance and select Edit. Tick the macOS platform, choose your Compliance group and Applicable group, turn on the switch at the top right and save.
2. Complete the two Microsoft sign-in prompts with a Global Administrator. The first creates the Cloud Connector for Device Compliance app in Entra ID; the second creates the User registration app for Device Compliance.
3. A Configure Compliance Partner dialog opens; its button takes you to the Intune admin center.
4. In Intune, go to Tenant administration › Connectors and tokens › Partner compliance management › Add compliance partner. Pick Jamf Device Compliance, platform macOS, and assign the Entra user group from Step 4. Don't choose Add all users; Microsoft notes that it inhibits the connection.
5. Create it, select Confirm in the Jamf tab, then refresh the Intune page.

Good looks like this: the macOS Jamf Device Compliance entry shows a Partner Status of Active.

Step 6: Add Conditional Access without blocking registration#

Registration is itself a sign-in, so a policy demanding a compliant device can block the step that makes the Mac compliant. Jamf's guidance: exclude the User Registration app for Device Compliance from every all-resources policy that requires compliance, MFA or other user interaction. Then build the Mac policy:

• Users: a pilot group of Mac users first.
• Target resources: All resources, excluding the User Registration app.
• Conditions › Device platforms: macOS.
• Grant: Require device to be marked as compliant.
• Enable policy: Report-only until the sign-in logs look right. See What If and report-only mode.

The 2026 baseline scopes change#

Microsoft's stricter evaluation of sign-ins requesting only baseline scopes such as User.Read began rolling out on 15 June 2026, according to Jamf. In affected tenants registration hits a challenge it can't complete, even with the exclusion. Jamf's fix needs Jamf Pro 11.32.1 or later: grant admin consent under Enterprise applications › User Registration app for Device Compliance › Permissions, then deploy a computer configuration profile with an Application & Custom Settings payload (Upload), preference domain com.jamf.management.jamfAAD and this property list, so registration requests Jamf's own scope:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>microsoftCAScopes</key>
  <array>
    <string>api://b03c10a8-71c7-45f9-b44a-3335ab76e970/JamfDeviceComplianceRegister</string>
  </array>
</dict>
</plist>

That value is for standard tenants; GCC High uses a different ID, listed in Jamf's article. Background: the 2026 baseline scopes change.

Verify#

1. On a pilot Mac, run the Self Service policy, sign in and allow the keychain prompt with the Mac password.
2. In Terminal, as that user, run the command below. Healthy output is Microsoft Entra ID acquired for macOS user ... with no sign-in prompt.
3. Entra ID › Devices › All devices lists the Mac as managed by Microsoft Intune. It starts as not compliant and flips to compliant once the Compliance group includes it. It won't appear in Intune's own device list; that's expected.
4. In the Entra sign-in logs, the pilot user's sign-ins from the Mac show the device as compliant and managed, and the report-only policy would have been satisfied.

/usr/local/jamf/bin/jamfaad gatherAADInfo

Tips & gotchas#

• Users must register from Self Service. Opening Company Portal directly ends with AccountNotOnboarded; see Mac registration errors.
• If gatherAADInfo prompts and fails, or Entra ID still shows N/A after an hour, check Compliance group membership and that the user is in the connector's group.
• Still on the old Settings › Global › Conditional Access integration? Don't build a second setup beside it; follow the migration guide.
• Connector trouble: partner connector errors. Sign-in blocks: Mac blocked by Conditional Access.

References#

• Integrate Jamf Pro with Microsoft Intune to report device compliance to Microsoft Entra ID (Microsoft Learn)
• Jamf Pro Device Compliance Requirements (Jamf Learning Hub)
• Configuring Jamf Pro Device Compliance for Microsoft's Baseline Scope Enforcement (Jamf Learning Hub)