Plenty of iPhones and iPads are managed by Jamf Pro while Microsoft 365 is protected by Conditional Access and Intune app protection. That combination works, but it needs two links: Jamf reporting device compliance to Microsoft Entra ID, and Jamf telling Microsoft's apps which managed user they belong to. Here's how to set up both and prove each one.
Errors this guide fixes
AADSTS53000: Device is not in required device state: compliant.Safari on a Jamf-managed iPhone+1 more guide
How it works#
- Device compliance. Jamf smart groups decide compliance, and Jamf sends each registered device's management and compliance state through the Jamf Device Compliance connector in Intune to Entra ID. Intune compliance policies play no part.
- App protection. Intune app protection follows the work identity inside Intune SDK apps such as Outlook, Teams and Edge, on any device. On iOS/iPadOS an app only counts as running on a managed device when the MDM sends it the
IntuneMAMUPNapp configuration key. Intune sends it automatically to several Microsoft apps on Intune-enrolled devices; with Jamf, that's your job. - Conditional Access joins the two with Require device to be marked as compliant, Require app protection policy, or either.
Prerequisites#
- Intune licences for the users (the partner connector requires them) and Microsoft Entra ID P1 for Conditional Access.
- Jamf Pro 10.29.0 or later for iOS and iPadOS in Jamf Cloud, or 11.6.0 or later on-premises (11.7.1 for government environments), with the Cloud Services connection enabled.
- Jamf Pro device compliance privileges, an Intune Administrator or narrower roles, and a Global Administrator if the Jamf connection is new.
- Microsoft apps deployed from Jamf Pro as managed apps; managed app configuration only reaches managed apps.
- No Jamf Context-Aware Access with Google integration for iOS alongside it; Jamf warns this disrupts compliance data.
Step-by-step#
Step 1: Build the mobile device smart groups#
Create two smart mobile device groups in Jamf Pro: Applicable, with every iPhone and iPad that needs Microsoft resources, compliant or not, and Compliance, with the criteria a device must meet, such as a minimum iOS version or a required app. Entra ID compliance follows Compliance group membership. Keep any shared-device Applicable group separate: Jamf documents that a device registered with the wrong Applicable group must be erased and registered again.
Step 2: Turn on the iOS platform on both sides#
In Jamf Pro, Settings › Global › Device Compliance enables each platform with its Applicable and Compliance groups. A first connection raises two Microsoft sign-in prompts for a Global Administrator, which create the Cloud Connector for Device Compliance and User registration app for Device Compliance applications in Entra ID, then opens the Intune admin center. If macOS is already connected, Jamf asks you to enable the new platform on the Microsoft side first.
In Intune, open Tenant administration › Connectors and tokens › Partner compliance management › Add compliance partner, choose Jamf Device Compliance and the iOS platform, and assign an Entra user group of Jamf iPhone and iPad users. Never use Add all users, which Microsoft says inhibits the connection. Only one partner is allowed per platform, and the assignment makes Jamf the management authority for those users' devices. Refresh until Partner Status shows Active.
Step 3: Let users register from Self Service#
Once the platform is configured, Jamf Self Service for iOS shows a Register with Microsoft button. Jamf's device requirements: iOS 11 or iPadOS 13 or later, the latest Microsoft Authenticator from the App Store, and Self Service for iOS 10.10.3 or later. As with Macs, a new registration starts as not compliant and updates when Jamf evaluates the Compliance group. Exclude the User registration app for Device Compliance from policies that require a compliant device, or registration can't complete.
Step 4: Create the app protection policy#
In Intune, go to Apps › Protection › Create policy › iOS/iPadOS, target Core Microsoft Apps or Microsoft Apps, set data protection and access requirements, and assign the policy to user groups. On managed devices, Send org data to other apps set to Policy managed apps with OS sharing lets work files move to other managed apps under iOS Open-in management. For stricter rules on personal devices, split managed and unmanaged devices with assignment filters.
Step 5: Send the app configuration keys from Jamf Pro#
For each Microsoft app deployed as a managed app (and any third-party or line-of-business app built with the Intune SDK), add managed app configuration in Jamf Pro with these string keys:
| Key | Value | Why it matters |
|---|---|---|
IntuneMAMUPN | The user's UPN | Without it, app protection treats an iOS device as unmanaged. |
IntuneMAMOID | The user's Entra object ID | Microsoft lists it with IntuneMAMUPN for every MDM-managed app. |
IntuneMAMDeviceID | A device ID token from the MDM | Microsoft requires it for third-party and line-of-business managed apps. Set on its own, the device still counts as unmanaged. |
Jamf Pro replaces $VARIABLES in managed app configuration with inventory values, but its list has no variable for a UPN or an Entra object ID. $EMAIL (or $USERNAME) only works for IntuneMAMUPN if it equals every user's UPN. For IntuneMAMOID, create a mobile device extension attribute that holds the object ID and use its $EXTENSIONATTRIBUTE_<#> variable. Microsoft documents no Jamf-specific value for IntuneMAMDeviceID, so confirm the device ID token with Jamf before adding it to third-party or line-of-business apps. For a Microsoft app, the preferences look like this (5 stands for your extension attribute's ID):
<dict>
<key>IntuneMAMUPN</key>
<string>$EMAIL</string>
<key>IntuneMAMOID</key>
<string>$EXTENSIONATTRIBUTE_5</string>
</dict>Users must sign in to each app with the account in IntuneMAMUPN; Microsoft doesn't support enrolling a different user in an app on a device with an MDM-enrolled account. Outlook's Intune configuration designer adds IntuneMAMUPN automatically when Allow only work or school accounts is on, but Jamf-delivered configuration has no such shortcut.
Step 6: Build the Conditional Access policy#
For a pilot group, target Office 365 or the apps you want to protect, set Device platforms to iOS, and under Grant select Require device to be marked as compliant and Require app protection policy with Require one of the selected controls. Start in report-only mode and roll out app protection before enforcing, as Microsoft recommends. On iOS with a non-Microsoft MDM, only Microsoft Edge supports device-based policies, and Safari can't satisfy app protection either, so Jamf iPhone users should use Edge for Microsoft 365 on the web.
Verify#
- Connector: Partner compliance management lists Jamf Device Compliance for iOS with Partner Status Active.
- Compliance: under Devices › All devices in the Entra admin center, the registered iPhone shows Compliant Yes.
- App protection: with an app PIN required, opening Outlook with the work account prompts the user to set one, Microsoft's suggested quick test. In Edge,
about:intunehelpshows the app and policy state, and the App protection status report under Apps › Monitor lists the user and apps. - Sign-ins: the sign-in log shows the policy as Success for app and Edge sign-ins.
Tips and gotchas#
- Compliant, yet blocked in Safari: expected with a non-Microsoft MDM. The block shows as
AADSTS53000: Device is not in required device state: compliant.Move the user to Edge. - Wrong or missing keys: Microsoft warns that incorrect
IntuneMAMUPN,IntuneMAMOIDorIntuneMAMDeviceIDvalues can stop the policy reaching the app or deliver the wrong policy. Configure every managed Microsoft app, not just Outlook, and check what the device received before changing the policy. - Related: Jamf partner connector problems in Intune, app protection not applying to Outlook mobile and Jamf Pro and Microsoft Intune in 2026.
