Migrating from the legacy Jamf macOS Intune integration to Jamf Pro Device Compliance

Jamf Pro's original macOS integration with Intune, configured under Settings › Global › Conditional Access, was built on a Microsoft API that has been retired. Device Compliance replaces it and changes where compliance is decided. In this post I'll explain what changes for admins and users, give an order of operations that keeps Conditional Access from locking people out, walk through Jamf's migration script, and cover verification and rollback.

What changes#

The biggest change is ownership: your Intune macOS compliance policies stop deciding anything for Jamf Macs, so their rules must be rebuilt as Jamf smart group criteria. For users the change is small. Jamf's migration script reuses the existing registration: if it finds the workplace join certificate (issued by MS-ORGANIZATION-ACCESS) in the user's login keychain, it runs Jamf's gatherAADInfo command as that user, which can require them to sign in. If not, it stops with no WPJ key found and that user registers from scratch.

Before you start#

• Jamf Pro 11.5.0 or later for Jamf's script-based user migration, the Cloud Services connection enabled, and the other Device Compliance requirements (see the setup guide).
• An export of the settings in your Intune macOS compliance policies (encryption, OS version, password rules) to translate into smart group criteria.
• A list of Conditional Access policies that require a compliant device for Mac users.
• A Global Administrator for the consent prompts, an Entra user group of Jamf Mac users, and a short message telling users they'll run one Self Service item and may have to sign in.

Step-by-step migration#

1. Build the groups and the registration policy#

Create the Applicable and Compliance computer smart groups and the Self Service registration policy as described in the setup guide. Make sure the Applicable group includes every Mac that will migrate, because Jamf scopes the migration script to it. Put your translated Intune rules into the Compliance group.

2. Protect sign-ins for the migration window#

Set Mac-only policies that require a compliant device to Report-only. For policies shared with Windows, add a temporary exclusion group of Mac users instead and empty it as Macs are verified. See What If and report-only mode.

3. Switch the integration in one sitting#

1. In the Intune admin center, open Tenant administration › Connectors and tokens › Partner device management, remove the groups containing the users you're migrating from Included groups and save. Jamf notes that users can't be scoped to both Partner Device Management and Partner Compliance Management while their computers register.
2. In Jamf Pro, open Settings › Global › Conditional access, select Edit, clear Enable Intune Integration for macOS and save. Jamf notes that Intune then allows a 60-day grace period before marking the registered computers as noncompliant in Entra ID.
3. Immediately configure Settings › Global › Device Compliance: enable macOS, pick the two smart groups, save and complete both Global Administrator consent prompts.
4. In the Intune admin center, Tenant administration › Connectors and tokens › Partner compliance management › Add compliance partner: Jamf Device Compliance, platform macOS, assigned to your Entra user group (not Add all users). Confirm in Jamf and refresh until the partner shows Active.

4. Exclude the User registration app#

Exclude the new User registration app for Device Compliance from Conditional Access policies aimed at all resources that require compliance, MFA or other user interaction. If your tenant has the 2026 baseline scopes enforcement, also apply Jamf's scope profile (Jamf Pro 11.32.1 or later), described in the setup guide.

5. Deploy Jamf's migration script through Self Service#

1. In Jamf Pro, go to Settings › Computer management › Scripts › New and paste the script from Jamf's guide.
2. In Computers › Policies › New, select no triggers, add the script, scope the policy to the Applicable group and make it available in Self Service.
3. Ask users to run it while logged in; it needs their session and may ask for credentials. Jamf Support can discuss options if you need a migration without user interaction.

6. Catch the stragglers#

Policy logs that end with no WPJ key found mean the user has no registration: ask them to run the normal registration policy. For broken or duplicate registrations, follow the registration troubleshooting guide.

7. Retire the old pieces#

Once every Mac reports through Device Compliance, unassign Intune macOS compliance policies that existed only for Jamf Macs (keep those for Intune-enrolled Macs), and review the legacy Entra app for removal. Then move the report-only policies back to On, one ring at a time.

Verify#

• Intune shows the macOS Jamf Device Compliance partner as Active.
• On a migrated Mac, as the user, the command below returns Microsoft Entra ID acquired for macOS user ... without a prompt.
• The Mac's Entra device object turns compliant once the Mac is in the Compliance smart group.
• Sign-in logs for migrated users show the compliant-device policy would have been satisfied in report-only. Only then switch it back on.

/usr/local/jamf/bin/jamfaad gatherAADInfo

To track progress, build the two smart computer groups Jamf recommends. Not yet migrated: Conditional Access Inventory State is Activated or Unresponsive, and Device Compliance Integration - Registration Status is Not Registered. Migrated: Device Compliance Integration - Registration Status is Registered. Jamf counts a Mac as migrated once the script has collected its JamfAAD information and sent it to Jamf Pro.

Rollback plan#

• There's no going back to the legacy integration: its API is past the removal date, and Jamf advises against re-enabling Conditional Access once migration has started.
• Your rollback lever is Conditional Access. Return the Mac policy to Report-only or add affected users to the exclusion group; access comes back while you fix registration.
• Keep the registration policy and the migration script in Self Service until the last Mac is done, and keep a list of who has completed.

Tips & gotchas#

• An Applicable group that's too narrow is the classic reason Macs never migrate.
• Users who open Company Portal directly get AccountNotOnboarded; registration must start in Self Service.
• Network accounts aren't supported by the macOS integration; users need local or mobile accounts.
• For the wider picture, see how the Jamf and Intune integrations fit together.

References#

• Integrate Jamf Pro with Microsoft Intune to report device compliance to Microsoft Entra ID (Microsoft Learn)
• Migrating from macOS Conditional Access to macOS Device Compliance (Jamf Learning Hub)
• Deploying a Script to Migrate Users from Conditional Access to Device Compliance (Jamf Learning Hub)