Consolidating Apple devices from Jamf Pro into Intune is mostly a planning exercise: work out what each Jamf object becomes in Intune, move devices to the new MDM server in Apple Business, and decide device by device whether Apple's new migration flow or a wipe gets them there. In this post I'll lay out the mapping, the cut-over steps, the FileVault, Activation Lock and app-licence traps, and the enrollment errors you'll see when something is left behind.
Errors this guide fixes
Profile Installation Failed. The new MDM payload does not match the old payload.iPhone/iPad enrollmentProfile Installation Failed. Connection to the server could not be established.iPhone/iPad enrollmentNoEnrollmentPolicy (No enrollment policy found)iOS/iPadOS enrollmentAccess deniedIntune ADE token sync+1 more guideExpired or invalid tokenIntune ADE token sync+1 more guideTerms and conditions not acceptedIntune ADE token sync+1 more guide
Note: Apple has replaced Apple Business Manager with Apple Business, and Microsoft Learn's ADE setup pages use the new name (some troubleshooting pages still say Apple Business Manager). With iOS 26, iPadOS 26 and macOS 26, Apple supports migrating devices enrolled through Automated Device Enrollment (ADE) to another device management service without erasing them. Check Apple's and Microsoft's current documentation before you plan around it.
How it works: three paths#
| Device | Path to Intune | User impact |
|---|---|---|
| ADE-enrolled, iOS/iPadOS/macOS 26 or later | Reassign in Apple Business and use Apple's migration flow with an enrollment deadline | Prompt to migrate; when the deadline is enforced, an iPhone or iPad restarts and a Mac shows a full-screen prompt that can't be dismissed |
| ADE-enrolled, older OS | Reassign in Apple Business, erase, re-enroll through Setup Assistant | Device wiped; data must be backed up or in the cloud |
| Enrolled manually (not ADE) | Remove Jamf management, enroll with Company Portal | User-driven re-enrollment |
Apple lets iPhones and iPads keep managed apps and their data during migration if the new service delivers the apps before it sends the DeviceConfigured command, and the old service must not send app-removal commands during unenrollment. Apple excludes Shared iPad and devices set up for Return to Service with app preservation, and devices added with Apple Configurator must be past their 30-day provisional period. Admins report using this flow to move devices into Intune; prove it on a pilot before you build the timeline around it.
Step 1: Inventory Jamf Pro and map it to Intune#
| Jamf Pro | Intune equivalent |
|---|---|
| Configuration profiles | Settings catalog (including Apple declarative configurations) or a custom profile with the exported .mobileconfig |
| Policies running scripts | macOS shell scripts |
| Extension attributes | Custom attributes for macOS (a shell script that returns a value) |
| Packages and Self Service items | PKG/DMG apps, required or available in Company Portal |
| Smart groups | Entra dynamic groups and Intune assignment filters |
| PreStage enrollments | ADE enrollment policies |
| Device Compliance smart groups | Native Intune compliance policies |
| Software update blueprints | DDM software update settings |
| FileVault escrow | Intune FileVault policy |
| Jamf Connect | Platform SSO (or keep Jamf Connect as an app) |
Export the inventory from Jamf Pro first, then decide what to retire: a migration is the cheapest moment to drop old profiles and scripts nobody can explain.
Step 2: Prepare Intune and Apple Business#
- Upload an Apple MDM push certificate to Intune.
- Create an enrollment program token: in Intune, go to Devices › Device onboarding › Enrollment, select the Apple mobile tab and open Enrollment program tokens, add a token, download the public key, create a new MDM server in Apple Business with it, then upload the server token to Intune.
- Create ADE enrollment policies under the token's Enrollment policies page. Microsoft says the older Profiles experience will eventually be retired.
- Plan app licences. Apps and Books licences belong to a location's content token, not to the MDM. Apple's migration guidance is to remove the content token from Jamf Pro, then create a new content token for the same location and upload it to Intune; the alternative is giving Intune its own location and licences. Avoid two MDMs managing one token. See VPP tokens in Intune.
- Build and test every policy, app and compliance rule on lab devices before production devices arrive.
Step 3: Reassign devices and cut over#
- In Apple Business, change the assigned device management service for the pilot devices from the Jamf Pro server to the Intune server. Update the default assignment per device type so new purchases go to Intune.
- In Intune, sync the token (Devices › Sync on the token). A full sync can run at most once every seven days. Then assign the enrollment policy to the devices.
- OS 26 devices: set the enrollment deadline in Apple Business (the admin's role needs permission to view, add and delete device management services) and tell users what they'll see. On a Mac, every user gets the prompt; depending on the new service, the user who completes it becomes the managed user, or the Mac has none.
- Older devices: back up user data, erase the device, and let Setup Assistant enroll it in Intune. Microsoft's ADE guidance expects new or wiped devices.
- Remove migrated devices from the Jamf Device Compliance scope and clean up stale device records in Entra ID afterwards.
Watch out: before any device leaves Jamf Pro, handle the two locks. FileVault: keep the Jamf-escrowed recovery keys until Intune holds a new one; Apple notes that the new service, if it supports this, can rotate the personal recovery key using a bootstrap token. Activation Lock: before erasing a device, record its bypass code or clear the lock. With Apple's migration flow, Apple removes the existing lock and invalidates its bypass codes; if the migration fails, the lock is turned back on and only an Apple Business Organization Administrator can remove it.
Step 4: Pilot and keep a rollback#
Pilot each combination you own: Mac and iPhone, supervised and unsupervised, every OS version and the main user roles. Keep Jamf Pro running and its records intact until the last device lands in Intune. Rollback for an ADE device is the same move in reverse (reassign it to the Jamf Pro server) plus a re-enrollment, so don't delete the Jamf Pro MDM server in Apple Business early.
Verify#
- Apple Business shows the Intune server for the device, and the Intune token lists it with an enrollment policy.
- The Intune device record shows ADE enrollment, supervision where expected, a compliant state and the required apps.
- On Macs, the FileVault recovery key is escrowed in Intune.
- The user's Entra sign-in log shows the device as compliant and managed by Intune.
Errors you may see during re-enrollment#
| Error | Cause | Fix |
|---|---|---|
Profile Installation Failed. The new MDM payload does not match the old payload. | A management profile is still installed | Remove it in Settings › General › VPN & Device Management, or erase an ADE device |
Profile Installation Failed. Connection to the server could not be established. | Device still enrolled in another MDM, restrictions blocking personal devices, a previous user not removed, or no Intune licence | Remove the old management profile; check restrictions and licence; retry from the Company Portal website in Safari |
NoEnrollmentPolicy (No enrollment policy found) | APNs certificate missing, invalid or expired, or the platform not enabled | Renew the push certificate; check platform settings |
Access denied (token sync) | Intune can no longer talk to Apple, for example the server was removed from Apple Business | Check the MDM server list and token |
Expired or invalid token | Token expired, revoked or malformed | Renew the token |
Terms and conditions not accepted | New Apple terms waiting in Apple Business | Accept them, then sync |
More codes are in the Apple enrollment errors quick reference, and devices missing from the token are covered in ADE devices not syncing.
References#
- Migrate managed devices to another device management service (Apple Platform Deployment)
- Set up automated device enrollment for iOS/iPadOS (Microsoft Learn)
- Troubleshooting iOS/iPadOS device enrollment errors in Microsoft Intune (Microsoft Learn)
- Troubleshooting profile installation failed errors on iOS or iPadOS devices (Microsoft Learn)
