Mac blocked by Conditional Access checklist

Symptoms to confirm

Password and MFA succeed, then Outlook, Teams or a Microsoft 365 web app refuses access.

AADSTS53000: Device is not in required device state: compliant.

Device is not in required device state: {state}. Conditional Access policy requires a compliant device, and the device is not compliant. The user must enroll their device with an approved MDM provider like Intune.

• A keychain prompt when a Microsoft app opens, such as Microsoft Teams wants to sign using key "Microsoft Workplace Join Key" in your keychain. Allow works once, Always Allow remembers the choice for that app only, and Deny stops the sign-in.
• AADSTS53001 (DeviceNotDomainJoined) instead of 53000: the policy demands a Microsoft Entra hybrid joined device, which a Mac can never be.

Likely causes

Compliance travels along a chain, and AADSTS53000 means one link is broken:

• Registration. The user registers the Mac with the Jamf Self Service policy, which creates a Microsoft Entra registered device. Company Portal on its own fails with AccountNotOnboarded.
• Compliance reporting. Jamf decides compliance with its Applicable and Compliance smart groups and sends the management and compliance state through the Jamf Device Compliance connector in Intune to Entra ID. New registrations start as not compliant and update when Compliance group membership changes. The user needs an Intune licence and membership of the connector's Entra group.
• Device identity. The browser or app must present the device. A private window, disabled cookies, a signed-out Edge profile, Chrome without Microsoft's extension or a denied keychain prompt make a compliant Mac look unknown.
• The right object. After a re-registration, the sign-in can present a device ID that isn't the one Jamf reports as compliant.

Checklist

1. 1

   Read the failed sign-in

   In the Microsoft Entra admin center, open Entra ID › Monitoring & health › Sign-in logs, filter by user, time and status Failure, and open the event. The Conditional Access tab names the failing policy; Device info tells you where to go next:

   Device info shows	Meaning	Go to
   No device ID	The client didn't present the device	Step 4
   A device ID, but Compliant and Managed aren't Yes	Registered; compliance hasn't arrived	Steps 2–3
   A device ID that isn't the Mac's current object	Stale or duplicate registration	Step 5
   Compliant Yes, still blocked	Another grant control failed	Step 6

2. 2

   Check the device object

   Under Devices › All devices in the Entra admin center, search for the Mac and check Compliant (Yes, No or N/A), the join type and the device ID. Microsoft Graph PowerShell shows duplicates quickly:

   powershell

   Connect-MgGraph -Scopes "Device.Read.All"
   Get-MgDevice -Filter "displayName eq 'MBP-JSMITH'" -All |
     Select-Object DisplayName, DeviceId, IsCompliant, TrustType,
       RegistrationDateTime, ApproximateLastSignInDateTime

3. 3

   Fix compliance reporting

   • In Jamf Pro, confirm the computer is in both the Applicable and Compliance groups, and that the criterion Device Compliance Integration - Registration Status returns Registered. An inventory-age criterion such as Last Inventory Update drops Macs that stop submitting inventory.
   • Run sudo jamf recon on the Mac; a change in Compliance membership is what triggers the update to Entra ID.
   • In Intune, Tenant administration › Connectors and tokens › Partner compliance management should show the macOS Jamf Device Compliance entry with Partner Status Active, assigned to a group containing the user.
   • Test the registration with the command Microsoft documents, as the signed-in user:
   bash

   /usr/local/jamf/bin/jamfaad gatherAADInfo

   No prompt plus Microsoft Entra ID acquired for macOS user and the user name means the registration is good. A prompt that completes suggests the first attempt failed, so recheck after the next compliance update.

4. 4

   Make browsers and apps present the device

   Client on macOS	What device-based Conditional Access needs
   Microsoft Edge	The user signed in to the Edge profile with the work account (Edge 85 and later).
   Google Chrome	On Macs using the Microsoft Enterprise SSO plug-in, the Microsoft Single Sign On extension (ppnbnpeolgkicgegkbkbjmhlideopiji), force-installed with Chrome's ExtensionInstallForcelist policy.
   Safari	Supported on a managed device. As Microsoft moves device keys from the keychain to the Secure Enclave, non-MSAL apps, Safari included, need the Enterprise SSO plug-in enabled.
   Firefox 133 or later	The Enterprise SSO plug-in installed and configured.

   Any private window or disabled cookies defeats the check. If the browser asks for a certificate, the user must pick the one provisioned at registration.

5. 5

   Clean up stale registrations

   If the sign-in presents a device ID that isn't the compliant object, the Mac is using an older registration. Remove it on the Mac, re-run the Self Service policy, wait for the compliance update, and only then delete the orphaned object in Entra ID.

6. 6

   Correct the policy

   • If Require Microsoft Entra hybrid joined device is the only grant control applying to macOS, Macs fail with 53001. Scope it to Windows, or pair it with the compliant-device control under Require one of the selected controls.
   • Exclude the User registration app for Device Compliance, created by Jamf's wizard, from compliant-device policies, or unregistered Macs can't register. For the 2026 baseline-scopes change, see the Device Compliance setup guide.

Verify

• A new sign-in in a normal window shows the policy as Success, with Device info listing the Entra object's device ID and Compliant and Managed set to Yes.
• Devices › All devices shows a single object for the Mac, Compliant Yes, and Jamf Pro shows it Registered and in the Compliance group.
• What If under Entra ID › Conditional Access › Policies confirms which policies apply to macOS; it doesn't evaluate real compliance, so pair it with the sign-in log.

Prevent it next time

• Register only from Self Service, never from Company Portal alone.
• Deploy Edge sign-in, the Chrome extension and the Enterprise SSO plug-in from Jamf before enforcing.
• Keep a smart group of Applicable Macs that aren't Registered, and match inventory-based criteria to how often Macs report.
• Pilot in report-only mode (What If and report-only); the general playbook is AADSTS53000 vs AADSTS53003.