oeltayeb.com · Jamf + Intune Toolkit

Checklist

Jamf Pro to Intune migration checklist

Based on the article: Migrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan · 6 min read

Consolidating Apple devices from Jamf Pro into Intune is mostly a planning exercise: work out what each Jamf object becomes in Intune, move devices to the new MDM server in Apple Business, and decide device by device whether Apple's new migration flow or a wipe gets them there. In this post I'll lay out the mapping, the cut-over steps, the FileVault, Activation Lock and app-licence traps, and the enrollment errors you'll see when something is left behind.

How it works: three paths

DevicePath to IntuneUser impact
ADE-enrolled, iOS/iPadOS/macOS 26 or laterReassign in Apple Business and use Apple's migration flow with an enrollment deadlinePrompt to migrate; when the deadline is enforced, an iPhone or iPad restarts and a Mac shows a full-screen prompt that can't be dismissed
ADE-enrolled, older OSReassign in Apple Business, erase, re-enroll through Setup AssistantDevice wiped; data must be backed up or in the cloud
Enrolled manually (not ADE)Remove Jamf management, enroll with Company PortalUser-driven re-enrollment
  • Apple lets iPhones and iPads keep managed apps and their data during migration if the new service delivers the apps before it sends the DeviceConfigured command, and the old service must not send app-removal commands during unenrollment.

Checklist

  1. 1

    Inventory Jamf Pro and map it to Intune

    Jamf ProIntune equivalent
    Configuration profilesSettings catalog (including Apple declarative configurations) or a custom profile with the exported .mobileconfig
    Policies running scriptsmacOS shell scripts
    Extension attributesCustom attributes for macOS (a shell script that returns a value)
    Packages and Self Service itemsPKG/DMG apps, required or available in Company Portal
    Smart groupsEntra dynamic groups and Intune assignment filters
    PreStage enrollmentsADE enrollment policies
    Device Compliance smart groupsNative Intune compliance policies
    Software update blueprintsDDM software update settings
    FileVault escrowIntune FileVault policy
    Jamf ConnectPlatform SSO (or keep Jamf Connect as an app)

    Export the inventory from Jamf Pro first, then decide what to retire: a migration is the cheapest moment to drop old profiles and scripts nobody can explain.

  2. 2

    Prepare Intune and Apple Business

    • Upload an Apple MDM push certificate to Intune.
    • Create an enrollment program token: in Intune, go to Devices › Device onboarding › Enrollment, select the Apple mobile tab and open Enrollment program tokens, add a token, download the public key, create a new MDM server in Apple Business with it, then upload the server token to Intune.
    • Create ADE enrollment policies under the token's Enrollment policies page. Microsoft says the older Profiles experience will eventually be retired.
    • Plan app licences. Apps and Books licences belong to a location's content token, not to the MDM. Apple's migration guidance is to remove the content token from Jamf Pro, then create a new content token for the same location and upload it to Intune; the alternative is giving Intune its own location and licences. Avoid two MDMs managing one token. See VPP tokens in Intune.
    • Build and test every policy, app and compliance rule on lab devices before production devices arrive.
  3. 3

    Reassign devices and cut over

    • In Apple Business, change the assigned device management service for the pilot devices from the Jamf Pro server to the Intune server. Update the default assignment per device type so new purchases go to Intune.
    • In Intune, sync the token (Devices › Sync on the token). A full sync can run at most once every seven days. Then assign the enrollment policy to the devices.
    • OS 26 devices: set the enrollment deadline in Apple Business (the admin's role needs permission to view, add and delete device management services) and tell users what they'll see. On a Mac, every user gets the prompt; depending on the new service, the user who completes it becomes the managed user, or the Mac has none.
    • Older devices: back up user data, erase the device, and let Setup Assistant enroll it in Intune. Microsoft's ADE guidance expects new or wiped devices.
    • Remove migrated devices from the Jamf Device Compliance scope and clean up stale device records in Entra ID afterwards.

    Watch out: before any device leaves Jamf Pro, handle the two locks. FileVault: keep the Jamf-escrowed recovery keys until Intune holds a new one; Apple notes that the new service, if it supports this, can rotate the personal recovery key using a bootstrap token. Activation Lock: before erasing a device, record its bypass code or clear the lock. With Apple's migration flow, Apple removes the existing lock and invalidates its bypass codes; if the migration fails, the lock is turned back on and only an Apple Business Organization Administrator can remove it.

  4. 4

    Pilot and keep a rollback

    Pilot each combination you own: Mac and iPhone, supervised and unsupervised, every OS version and the main user roles. Keep Jamf Pro running and its records intact until the last device lands in Intune.

Verify

  • Apple Business shows the Intune server for the device, and the Intune token lists it with an enrollment policy.
  • The Intune device record shows ADE enrollment, supervision where expected, a compliant state and the required apps.
  • On Macs, the FileVault recovery key is escrowed in Intune.
  • The user's Entra sign-in log shows the device as compliant and managed by Intune.

Microsoft Learn references