oeltayeb.com · Jamf + Intune Toolkit

Checklist

Mac registration (Company Portal / jamfAAD) checklist

Based on the article: Mac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors · 6 min read

When a Jamf-managed Mac won't register with Microsoft Entra ID, Conditional Access treats it as an unknown device and Microsoft 365 access stops. The fault can sit in Self Service, jamfAAD, Company Portal, the keychain or Entra ID. In this post I'll map the registration flow, show where each piece logs, match the messages people actually see to their causes, and walk through a clean re-registration.

Symptoms to confirm

  • Company Portal shows Account not onboarded (Microsoft's admin guidance calls it AccountNotOnboarded) or Device is already enrolled.
  • A Company Portal pop-up reads Invalid command line input Registration-only command line flag (-r) can only be used when partner management is enabled in Intune. Please contact your IT admin.
  • The Company Portal log contains Portal launched without WPJ only arg while account is under partner management.
  • Keychain prompts like these appear during registration or when apps open:
JamfAAD wants to access key "Microsoft Workplace Join Key" in your keychain.
To allow this, enter the "login" keychain password

Microsoft Teams wants to sign using key "Microsoft Workplace Join Key" in your keychain.
  • Registration seems to work, but Entra ID still shows N/A or not compliant after an hour, or one Mac has several device objects.

Likely causes

Message or symptomCauseFix
Account not onboarded, Portal launched without WPJ only arg...Company Portal was opened directly instead of from Self Service, so it skipped the Jamf connectionQuit Company Portal and run the Self Service policy. If the Mac enrolled in Intune this way, remove it from Intune first.
Device is already enrolled, duplicate devicesAn earlier Intune enrollment was never removed, or the user tried several timesClean up (fix step 4)
Registration-only command line flag (-r)...Microsoft documents it for the legacy macOS Intune integration: Jamf Pro has told Intune that the integration is turned offOn a legacy setup, re-enable the integration in Jamf Pro (or finish the migration). On Device Compliance, the equivalent checks are that macOS is enabled in Settings › Global › Device Compliance and the partner is Active
JamfAAD wants to access key...Expected: jamfAAD needs the workplace join key. Deny or a wrong password stops registration.Rerun, enter the Mac login password, select Allow
... wants to sign using key "Microsoft Workplace Join Key"An app asking to use the registration keyEnter the password and select Always Allow; each app asks separately
Sign-in during registration demands MFA or a compliant deviceA Conditional Access policy doesn't exclude the User registration app, or the 2026 baseline scopes enforcementAdd the exclusion; Jamf Pro 11.32.1+ and the scope profile from the setup guide
Entra ID stays at N/AIncomplete device record, Mac not in the Compliance group, or user not in the connector's groupFix step 3

Checklist

  1. 1

    Check the plumbing

    Confirm the Intune partner is Active and assigned to a group containing the user, Jamf Pro has macOS enabled with the right groups, the Mac is in the Applicable group with Company Portal installed, and the user has a local or mobile account (network accounts aren't supported).

  2. 2

    Rerun registration the supported way

    Quit Company Portal, run the registration policy from Self Service, sign in, and allow the keychain prompt with the Mac password.

  3. 3

    Ask jamfAAD what it knows

    Run as the signed-in user:

    bash
    /usr/local/jamf/bin/jamfaad gatherAADInfo
security dump-keychain ~/Library/Keychains/login.keychain-db | grep MS-ORGANIZATION-ACCESS
    • Microsoft Entra ID acquired for macOS user ... with no prompt: registration is fine, so look at Compliance group membership and the connector assignment.
    • A prompt that completes cleanly: the first attempt probably failed on the user side.
    • A prompt that ends in an error: read the user's Entra sign-in log entry for the error code (see Mac blocked by Conditional Access), then the jamfAAD log.
    • No MS-ORGANIZATION-ACCESS match: there's no registration in this user's keychain (Jamf's migration script uses the same test). Rerun the policy.
  4. 4

    Clean up a stale or duplicate registration

    • Delete the Mac's old device objects in Entra ID, and have the user remove old instances of the Mac on the Company Portal website (portal.manage.microsoft.com).
    • In Keychain Access (login keychain), delete the registration items Microsoft lists: Microsoft Workplace Join Key and Microsoft Session Transport Key (public and private), the certificate issued by MS-Organization-Access, the application passwords com.microsoft.workplacejoin.thumbprint and com.microsoft.workplacejoin.registeredUserPrincipalName, and identity preferences for https://enterpriseregistration.windows.net. Leave Jamf's own public and private key alone: Microsoft warns that removing it breaks enrollment.
    • Restart, then run the Self Service policy again.

    If that isn't enough, Microsoft documents a full reset: remove the MDM profile and the Jamf framework in Terminal, delete the Jamf Pro inventory record and the Entra device, remove the Company Portal, Self Service and jamfAAD files it lists, uninstall Company Portal, wait at least 30 minutes, re-enroll in Jamf Pro and register again.

Verify

  • gatherAADInfo returns Microsoft Entra ID acquired for macOS user ... without prompting.
  • Entra ID has exactly one device object for the Mac, owned by the right user and marked compliant once the Mac is in the Compliance smart group. It starts as not compliant; that's normal.
  • A fresh Microsoft 365 sign-in shows the device ID and compliant state in the Entra sign-in log.

Prevent it next time

  • Tell users to register only from Self Service and to approve the keychain prompt with their Mac password.
  • Keep the User registration app excluded from Conditional Access, and read the 2026 baseline scopes change.
  • When you wipe or reassign a Mac, delete its Entra device object too; see duplicate device objects in Entra ID.
  • Keep Company Portal current through the Jamf App Catalog.

Microsoft Learn references