Credentials Microsoft Certified Trainer (MCT) 2026Microsoft Innovative Educator Expert 2025–2026Microsoft Elevate Educator Expert 2026–2027ISC2 Certified Information Systems Security Professional (CISSP)Microsoft 365 Certified: Enterprise Administrator Expert (MS-102)Microsoft Certified: Azure Solutions Architect Expert (AZ-305)PMI Project Management Professional (PMP) 28 certifications · see all Verify on Credly
Omer EltayebMicrosoft 365
LinkedIn
  1. Home
  2. Articles
  3. Intune
  4. Jamf
IntuneTroubleshooting

Mac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors

Fix Jamf Device Compliance registration on Macs: Account not onboarded, Device is already enrolled, keychain prompts, duplicate Entra devices and registrations that never turn compliant.

Omer Eltayeb Updated 6 min read Checked against Microsoft Learn and vendor documentation

When a Jamf-managed Mac won't register with Microsoft Entra ID, Conditional Access treats it as an unknown device and Microsoft 365 access stops. The fault can sit in Self Service, jamfAAD, Company Portal, the keychain or Entra ID. In this post I'll map the registration flow, show where each piece logs, match the messages people actually see to their causes, and walk through a clean re-registration.

Errors this guide fixes

  • Account not onboardedCompany Portal
  • AccountNotOnboardedCompany Portal+2 more guides
  • Device is already enrolledCompany Portal
  • Registration-only command line flag (-r) can only be used when partner management is enabled in IntuneCompany Portal
  • Portal launched without WPJ only arg while account is under partner managementCompany Portal log
  • JamfAAD wants to access key "Microsoft Workplace Join Key" in your keychainmacOS keychain prompt
  • Microsoft Teams wants to sign using key "Microsoft Workplace Join Key" in your keychainmacOS keychain prompt
Jump to the fix Browse the Intune error library
How this guide is organised: Symptoms → How registration works, and where it logs → Why it happens → How to fix it → Verify the fix → Prevent it next timeFlow diagram of the article's sections in reading order: 1. Symptoms. 2. How registration works, and where it logs. 3. Why it happens. 4. How to fix it (4 steps: Check the plumbing; Rerun registration the supported way; Ask jamfAAD what it knows; Clean up a stale or duplicate registration). 5. Verify the fix. 6. Prevent it next time. Toolbox: Devices › All devices, Global › Device Compliance, MS-Organization-Access, gatherAADInfo, AccountNotOnboarded.1Symptoms2How registration works, andwhere it logs3Why it happens4How to fix it5Verify the fix6Prevent it next time1Check the plumbing2Rerun registration thesupported way3Ask jamfAAD what itknows4Clean up a stale orduplicate registrationTOOLBOXDevices › All devicesGlobal › Device ComplianceMS-Organization-AccessgatherAADInfoAccountNotOnboardedHow this guide is organised: Symptoms → How registration works, and where it logs → Why it happens → How to fix it → Verify the fix → Prevent it next timeFlow diagram of the article's sections in reading order: 1. Symptoms. 2. How registration works, and where it logs. 3. Why it happens. 4. How to fix it (4 steps: Check the plumbing; Rerun registration the supported way; Ask jamfAAD what it knows; Clean up a stale or duplicate registration). 5. Verify the fix. 6. Prevent it next time. Toolbox: Devices › All devices, Global › Device Compliance, MS-Organization-Access, gatherAADInfo, AccountNotOnboarded.1Symptoms2How registration works, and where it logs3Why it happens4How to fix it1Check the plumbing2Rerun registration the supported way3Ask jamfAAD what it knows4Clean up a stale or duplicate registration5Verify the fix6Prevent it next timeTOOLBOXDevices › All devicesGlobal › Device ComplianceMS-Organization-AccessgatherAADInfoAccountNotOnboarded
At a glance: how this guide is organised · 4 fix steps · 5 key tools

Symptoms#

  • Company Portal shows Account not onboarded (Microsoft's admin guidance calls it AccountNotOnboarded) or Device is already enrolled.
  • A Company Portal pop-up reads Invalid command line input Registration-only command line flag (-r) can only be used when partner management is enabled in Intune. Please contact your IT admin.
  • The Company Portal log contains Portal launched without WPJ only arg while account is under partner management.
  • Keychain prompts like these appear during registration or when apps open:
Text
JamfAAD wants to access key "Microsoft Workplace Join Key" in your keychain.
To allow this, enter the "login" keychain password

Microsoft Teams wants to sign using key "Microsoft Workplace Join Key" in your keychain.
  • Registration seems to work, but Entra ID still shows N/A or not compliant after an hour, or one Mac has several device objects.

How registration works, and where it logs#

  1. Self Service runs the registration policy (the Microsoft Device Compliance payload with Register computers with Microsoft Entra ID), scoped to the Applicable smart group.
  2. The user signs in with the work account. jamfAAD, Jamf's Entra agent, uses the User registration app for Device Compliance, and the Mac is registered with Entra ID through Company Portal, which Jamf launches in a registration-only mode.
  3. The device identity lands in the user's login keychain: the Microsoft Workplace Join Key and a certificate issued by MS-Organization-Access.
  4. jamfAAD's gatherAADInfo reports the Entra device ID to Jamf Pro, and Jamf Pro sends the compliance state (Compliance smart group membership) through Intune's partner compliance connector to Entra ID.
ComponentWhere to look
Self Service policyThe computer's policy logs in Jamf Pro
jamfAADmacOS unified log (command below). For more detail, set the logPII key to true in the com.jamf.management.jamfAAD domain with a Custom Settings profile; it adds the sign-in account and authority host, locally only. Remove it afterwards.
Company PortalHelp › Save Diagnostic Report saves the logs to a file you can collect; Help › Send diagnostic report uploads them to Microsoft
Entra IDEntra ID › Devices › All devices, and the user's sign-in logs
IntuneTenant administration › Connectors and tokens › Partner compliance management: the macOS Jamf partner must be Active
Bash
log show --last 1h --predicate 'subsystem CONTAINS "jamfAAD"'

Why it happens#

Message or symptomCauseFix
Account not onboarded, Portal launched without WPJ only arg...Company Portal was opened directly instead of from Self Service, so it skipped the Jamf connectionQuit Company Portal and run the Self Service policy. If the Mac enrolled in Intune this way, remove it from Intune first.
Device is already enrolled, duplicate devicesAn earlier Intune enrollment was never removed, or the user tried several timesClean up (fix step 4)
Registration-only command line flag (-r)...Microsoft documents it for the legacy macOS Intune integration: Jamf Pro has told Intune that the integration is turned offOn a legacy setup, re-enable the integration in Jamf Pro (or finish the migration). On Device Compliance, the equivalent checks are that macOS is enabled in Settings › Global › Device Compliance and the partner is Active
JamfAAD wants to access key...Expected: jamfAAD needs the workplace join key. Deny or a wrong password stops registration.Rerun, enter the Mac login password, select Allow
... wants to sign using key "Microsoft Workplace Join Key"An app asking to use the registration keyEnter the password and select Always Allow; each app asks separately
Sign-in during registration demands MFA or a compliant deviceA Conditional Access policy doesn't exclude the User registration app, or the 2026 baseline scopes enforcementAdd the exclusion; Jamf Pro 11.32.1+ and the scope profile from the setup guide
Entra ID stays at N/AIncomplete device record, Mac not in the Compliance group, or user not in the connector's groupFix step 3

How to fix it#

1. Check the plumbing#

Confirm the Intune partner is Active and assigned to a group containing the user, Jamf Pro has macOS enabled with the right groups, the Mac is in the Applicable group with Company Portal installed, and the user has a local or mobile account (network accounts aren't supported).

2. Rerun registration the supported way#

Quit Company Portal, run the registration policy from Self Service, sign in, and allow the keychain prompt with the Mac password.

3. Ask jamfAAD what it knows#

Run as the signed-in user:

Bash
/usr/local/jamf/bin/jamfaad gatherAADInfo
security dump-keychain ~/Library/Keychains/login.keychain-db | grep MS-ORGANIZATION-ACCESS
  • Microsoft Entra ID acquired for macOS user ... with no prompt: registration is fine, so look at Compliance group membership and the connector assignment.
  • A prompt that completes cleanly: the first attempt probably failed on the user side.
  • A prompt that ends in an error: read the user's Entra sign-in log entry for the error code (see Mac blocked by Conditional Access), then the jamfAAD log.
  • No MS-ORGANIZATION-ACCESS match: there's no registration in this user's keychain (Jamf's migration script uses the same test). Rerun the policy.

4. Clean up a stale or duplicate registration#

  1. Delete the Mac's old device objects in Entra ID, and have the user remove old instances of the Mac on the Company Portal website (portal.manage.microsoft.com).
  2. In Keychain Access (login keychain), delete the registration items Microsoft lists: Microsoft Workplace Join Key and Microsoft Session Transport Key (public and private), the certificate issued by MS-Organization-Access, the application passwords com.microsoft.workplacejoin.thumbprint and com.microsoft.workplacejoin.registeredUserPrincipalName, and identity preferences for https://enterpriseregistration.windows.net. Leave Jamf's own public and private key alone: Microsoft warns that removing it breaks enrollment.
  3. Restart, then run the Self Service policy again.

If that isn't enough, Microsoft documents a full reset: remove the MDM profile and the Jamf framework in Terminal, delete the Jamf Pro inventory record and the Entra device, remove the Company Portal, Self Service and jamfAAD files it lists, uninstall Company Portal, wait at least 30 minutes, re-enroll in Jamf Pro and register again. For the first step, Jamf documents sudo /usr/local/bin/jamf removeFramework for the framework, and the Remove MDM Profile command on the computer's Management tab in Jamf Pro when the MDM profile can't be removed locally. That takes the Mac out of management, so schedule it.

Verify the fix#

  • gatherAADInfo returns Microsoft Entra ID acquired for macOS user ... without prompting.
  • Entra ID has exactly one device object for the Mac, owned by the right user and marked compliant once the Mac is in the Compliance smart group. It starts as not compliant; that's normal.
  • A fresh Microsoft 365 sign-in shows the device ID and compliant state in the Entra sign-in log.

Prevent it next time#

  • Tell users to register only from Self Service and to approve the keychain prompt with their Mac password.
  • Keep the User registration app excluded from Conditional Access, and read the 2026 baseline scopes change.
  • When you wipe or reassign a Mac, delete its Entra device object too; see duplicate device objects in Entra ID.
  • Keep Company Portal current through the Jamf App Catalog.

References#

TagsJamfJamf ProCompany PortalmacOSDevice registration

Revision history: Oct 2026 — re-checked against Microsoft Learn and the vendors' documentation: 2 corrections; 1 detail reworded or labelled as reported by admins.

Written and checked against current Microsoft Learn documentation and the vendor documentation linked in the references. Test changes with a pilot group before rolling them out to everyone, and if an admin center path has moved since, search for the setting name instead.

Spotted a mistake, or did this fix work differently for you? Email me or message me on LinkedIn — corrections are credited in the article.

Written by

Omer Eltayeb

Intune Subject Matter Expert in Cairo, Egypt, former Microsoft Cloud Solutions Architect, Microsoft Certified Trainer and Microsoft Innovative Educator Expert (2024–26) and Microsoft Elevate Educator Expert (2026–27). I share practical, step-by-step guides, study plans, scripts and toolkits for Microsoft Intune, Configuration Manager, Microsoft Entra ID, Microsoft Defender, Exchange and Microsoft 365 with the community.

Microsoft Certified Trainer (MCT) 2026Microsoft Innovative Educator Expert 2025–2026Microsoft Elevate Educator Expert 2026–2027ISC2 Certified Information Systems Security Professional (CISSP)Microsoft 365 Certified: Enterprise Administrator Expert (MS-102)
Connect on LinkedIn My community contributions More about me
Keep reading

More Intune articles

All Intune articles