Jamf Pro Device Compliance setup checklist

Before you start

• Jamf Pro version. Jamf lists 10.43.0 or later for macOS in Jamf Cloud and 11.6.0 or later on-premises (11.7.1 for government environments). Tenants affected by Microsoft's 2026 baseline scopes change need 11.32.1 or later (Step 6).
• Cloud Services connection enabled in Jamf Pro. It's on by default in most Jamf Cloud instances; on-premises servers must turn it on.
• Licences: Microsoft Entra ID P1 (for Conditional Access) and Microsoft Intune for the users.
• Admin accounts: a Jamf Pro account with device compliance privileges; a Global Administrator for the wizard's two consent prompts; Intune Administrator or narrower roles (Groups, Conditional Access and Application Administrator) for the rest.
• On the Macs: local or mobile accounts (network accounts aren't supported), the latest Self Service, a supported Company Portal, and a configured Microsoft SSO extension or Platform SSO, which Jamf now lists as a requirement.

Checklist

1. 1

   Create the Applicable and Compliance smart groups

   Device Compliance is driven by two computer smart groups. Create them in Jamf Pro under Computers › Smart Computer Groups › New:

   Group	What it means	Example criteria (Microsoft's walkthrough)
   Applicable, e.g. Jamf-Intune Applicable	Macs that must register and report compliance	Application Title is CompanyPortal.app
   Compliance, e.g. Jamf-Intune Compliance	Macs that meet your standard: membership = compliant	Last Inventory Update less than 2 days ago, and Application Title is CompanyPortal.app, and FileVault 2 is All Partitions Encrypted

2. 2

   Deploy Company Portal

   Registration needs Company Portal installed, even though users shouldn't open it themselves. In Computers › Mac Apps › New, choose Jamf App Catalog, add Microsoft Intune Company Portal, target All Managed Clients with Install Automatically, enable Install supporting configuration profiles, switch on Deploy and save.

3. 3

   Create the Self Service registration policy

   • In Computers › Policies › New, give the policy a clear name such as Register with Microsoft Entra ID and keep it enabled.
   • In the Microsoft Device Compliance payload, enable Register computers with Microsoft Entra ID.
   • On the Scope tab, target the Applicable smart group.
   • On the Self Service tab, make the policy available, set a button name and a short description, and enable Ensure that users view the description.

   Create the groups and this policy before you connect to Intune: the wizard in Step 5 asks for both groups.

4. 4

   Create the Entra user group

   In the Microsoft Entra admin center, open Groups › All groups › New group and create a security group (dynamic is recommended, static works) with the users of Jamf-managed Macs. The Intune connector is assigned to it.

5. 5

   Connect Jamf Pro to Intune

   • In Jamf Pro, open Settings › Global › Device Compliance and select Edit. Tick the macOS platform, choose your Compliance group and Applicable group, turn on the switch at the top right and save.
   • Complete the two Microsoft sign-in prompts with a Global Administrator. The first creates the Cloud Connector for Device Compliance app in Entra ID; the second creates the User registration app for Device Compliance.
   • A Configure Compliance Partner dialog opens; its button takes you to the Intune admin center.
   • In Intune, go to Tenant administration › Connectors and tokens › Partner compliance management › Add compliance partner. Pick Jamf Device Compliance, platform macOS, and assign the Entra user group from Step 4. Don't choose Add all users; Microsoft notes that it inhibits the connection.
   • Create it, select Confirm in the Jamf tab, then refresh the Intune page.

   Good looks like this: the macOS Jamf Device Compliance entry shows a Partner Status of Active.

6. 6

   Add Conditional Access without blocking registration

   Registration is itself a sign-in, so a policy demanding a compliant device can block the step that makes the Mac compliant. Jamf's guidance: exclude the User Registration app for Device Compliance from every all-resources policy that requires compliance, MFA or other user interaction.

   • Users: a pilot group of Mac users first.
   • Target resources: All resources, excluding the User Registration app.
   • Conditions › Device platforms: macOS.
   • Grant: Require device to be marked as compliant.
   • Enable policy: Report-only until the sign-in logs look right. See What If and report-only mode.
   xml

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
     <key>microsoftCAScopes</key>
     <array>
       <string>api://b03c10a8-71c7-45f9-b44a-3335ab76e970/JamfDeviceComplianceRegister</string>
     </array>
   </dict>
   </plist>

   +1 more in the full article.

Verify

• On a pilot Mac, run the Self Service policy, sign in and allow the keychain prompt with the Mac password.
• In Terminal, as that user, run the command below. Healthy output is Microsoft Entra ID acquired for macOS user ... with no sign-in prompt.
• Entra ID › Devices › All devices lists the Mac as managed by Microsoft Intune. It starts as not compliant and flips to compliant once the Compliance group includes it. It won't appear in Intune's own device list; that's expected.
• In the Entra sign-in logs, the pilot user's sign-ins from the Mac show the device as compliant and managed, and the report-only policy would have been satisfied.

/usr/local/jamf/bin/jamfaad gatherAADInfo

Tips & gotchas

• Users must register from Self Service. Opening Company Portal directly ends with AccountNotOnboarded; see Mac registration errors.
• If gatherAADInfo prompts and fails, or Entra ID still shows N/A after an hour, check Compliance group membership and that the user is in the connector's group.
• Still on the old Settings › Global › Conditional Access integration? Don't build a second setup beside it; follow the migration guide.
• Connector trouble: partner connector errors. Sign-in blocks: Mac blocked by Conditional Access.