A Practical Guide to Intune and Jamf Co-Management

When your organization manages Apple devices at scale, you quickly run into a familiar trade-off: you want the Apple-native depth and admin-friendly controls of Jamf, but you also need Microsoft Intunes powerful identity, compliance, and Conditional Access features. Co-management bridges that gap, letting each platform do what it does best while giving users a seamless, secure experience.

Table of Contents

• What Is Co-Management?
• Why Intune and Jamf Together
• Prerequisites and Planning
• Architecture Overview
• Step-by-Step Implementation
• Policy and Compliance Strategy
• App and Patch Management
• User Experience and Support
• Governance, RBAC, and Security
• Monitoring and Reporting
• Common Pitfalls and How to Avoid Them
• Cost, Licensing, and ROI
• Conclusion
• Frequently Asked Questions

What Is Co-Management?

Co-management is an operating model where two complementary systems share responsibility for device lifecycle and security without duplicating effort. In the Apple ecosystem, Jamf Pro typically handles Apple-first managementprofiles, scripts, inventory, and software deploymentwhile Microsoft Intune leverages identity, compliance evaluation, and Conditional Access. Together, they create a secure, scalable control plane.

The goal is not to run identical policies in two places. Instead, you assign clear ownership: Jamf drives device state; Intune reads that state to decide whether a device is compliant and allowed to access company resources. This alignment simplifies audits, reduces friction, and improves user experience.

Why Intune and Jamf Together

Each platform has strengths that, when integrated, deliver more than the sum of their parts:

• Jamf Pro depth on Apple: Robust support for macOS and iOS/iPadOS, granular configuration profiles, scripts, extension attributes, and Self Service.
• Intune + Microsoft Entra ID: Enterprise-grade identity, Conditional Access, and unified compliance signals across apps and platforms.
• Security posture: Jamf enforces hardening (e.g., FileVault, Gatekeeper), while Intune gates access to data based on Jamf-reported compliance.
• Scale and reporting: Combine Jamfs Apple-focused inventory with Intunes tenant-wide insights for leadership dashboards and audits.

The result is a model that satisfies Security, IT, and end users: hardened devices, data-driven access control, and minimal disruption to daily work.

Prerequisites and Planning

Before you start, confirm the following prerequisites and decisions:

• Licensing: Microsoft Intune (or EMS/Microsoft 365 plans that include Intune) and Jamf Pro licenses.
• Identity: Microsoft Entra ID (formerly Azure AD) as your identity provider. Ensure user accounts and groups are synchronized and normalized.
• Apple Business Manager (ABM): For Automated Device Enrollment (ADE) and app licensing; link ABM to Jamf Pro.
• Networking: Allow-list Jamf Cloud/On-prem and Microsoft endpoints; confirm firewalls and proxies support required URLs and modern TLS.
• Supported OS: Confirm minimum macOS and iOS/iPadOS versions supported by both platforms and your security baselines.
• RBAC & Change Control: Define roles across Security, Identity, and Endpoint teams; establish a change advisory process.
• Pilot Cohorts: Identify a small, diverse pilot group and test devices to validate end-to-end flows.

Document a responsibility matrix up front to prevent policy overlaps. Keep it simple: Jamf manages device state; Intune reads and enforces Conditional Access based on that state.

Architecture Overview

At a high level, the flow looks like this:

1. Enrollment & Management: Devices are enrolled and managed in Jamf Pro (often via ADE from Apple Business Manager).
2. Registration: The device is registered with Microsoft Entra ID/Intune (typically via the Company Portal app sign-in or guided registration flow).
3. Compliance Sharing: Jamf evaluates device posture (hardening, encryption, OS version, etc.) and shares compliance signals with Intune using the partner device compliance integration.
4. Conditional Access: Intune/Entra ID uses the shared compliance status to allow or block access to apps (e.g., Microsoft 365) via Conditional Access policies.

Two key integrations make this possible: the Jamf Pro integration with Intune device compliance partners, and Conditional Access in Entra ID. For reference, see Microsofts documentation on partner compliance for Jamf and Jamfs Conditional Access guides:

• Microsoft: Partner device compliance with Jamf Pro
• Jamf: Conditional Access integration overview
• Apple Business Manager

Step-by-Step Implementation

1) Design the Ownership Model

• Jamf: Enrollment, profiles, scripts, FileVault, OS posture, native app deployment, Self Service.
• Intune/Entra ID: Device registration, partner compliance ingestion, Conditional Access, high-level reporting.

Tip: Write a one-page RACI so every team knows who does what from day one.

2) Prepare Identity and Groups

• Create Entra ID security groups for pilots and production (e.g., CA-Pilot-Mac, CA-Prod-Apple).
• Confirm MFA, SSO, and sign-in policies align with your rollout plan.

3) Connect Jamf Pro to Intune

1. In Jamf Pro, configure the Microsoft Intune device compliance integration and authenticate with Entra ID.
2. Grant required API permissions and verify the connection health.
3. Document the tenant IDs and app registrations for troubleshooting.

4) Enable Device Registration

• Deploy the Microsoft Company Portal app via Jamf to target devices.
• Guide users (or automate where possible) to sign in and complete device registration so Intune can correlate compliance.

5) Create Intune Compliance Policies

• Create a macOS (and optionally iOS/iPadOS) compliance policy that relies on partner compliance data from Jamf.
• Set a grace period for when partner compliance data is considered stale and mark devices noncompliant if it expires.

6) Configure Conditional Access

• Create policies for key cloud apps (e.g., Exchange Online, SharePoint, Teams) with the grant control Require device to be marked as compliant.
• Scope to pilot groups, then progressively expand. Include break-glass accounts excluded from CA.

7) Validate End-to-End

• Check a pilot device: Jamf inventory shows compliance; Intune device record appears registered; CA allows access when compliant and blocks when not.
• Test scenarios: FileVault off, outdated OS, or missing registration to confirm expected blocks and messaging.

8) Roll Out in Waves

• Expand group targeting and communications.
• Monitor help desk cases and adjust policies or user guidance as needed.

Policy and Compliance Strategy

Define the Split

• Jamf Pro (Device State): FileVault, Gatekeeper, firewall, System Settings restrictions, password policies, OS version, configuration profiles, scripts.
• Intune (Access Control): Reads partner compliance from Jamf and enforces Conditional Access to apps and data.

Model Compliance in Jamf

• Use Smart Groups that represent compliance logic (e.g., Compliant-Mac, Noncompliant-OS-Version).
• Map those signals to the Intune integration so the correct state is exported.
• Keep criteria clear and auditableavoid ambiguous rules that are hard to troubleshoot.

Tune in Intune

• Set compliance validity periods (e.g., mark noncompliant if no update from Jamf in X days).
• Align user notifications with your support model: clear steps to regain compliance.

App and Patch Management

macOS

• Distribute apps via Jamf (Self Service, policies, or VPP/ABM-managed distribution).
• Use Jamf patch policies or third-party feeds to track versions and remediate.
• For Microsoft apps (e.g., Office), rely on Microsoft AutoUpdate (MAU); manage channel and deferrals via configuration profiles.

iOS/iPadOS

• Use ABM-managed licenses and Jamf for silent installs and updates where possible.
• Segment required vs. optional apps; ensure critical security apps install early in the lifecycle.

Version Guardrails

• Set minimum OS versions in Jamf to reduce risk; tie those baselines to compliance signals sent to Intune.
• Communicate upcoming version requirements to reduce surprise lockouts under Conditional Access.

User Experience and Support

Enrollment Journeys

• Zero-touch: ADE assigns devices to Jamf; first-boot enrollment runs; required apps and profiles install.
• Registration: Company Portal prompts sign-in; device registers with Entra ID for compliance correlation.

Self-Service and Guidance

• Promote Jamf Self Service for optional apps and troubleshooting scripts.
• Provide a one-page checklist to resolve common noncompliance (e.g., enable FileVault, update OS).

Help Desk Playbooks

• Create decision trees: Is the device registered? What is Jamf compliance? How does CA apply?
• Grant limited, audited rights for frontline staff to re-run policies or trigger inventory updates.

Governance, RBAC, and Security

• RBAC: In Jamf, limit who can edit production policies; in Intune/Entra ID, tightly control Conditional Access and app assignments.
• Secrets and Integrations: Store credentials for connectors in a secure vault; rotate regularly.
• Change Management: Pilot every change; attach rollback plans; document approvals.
• Data Privacy: Be transparent about data collected by each system and honor regional requirements.

Monitoring and Reporting

Operational Dashboards

• Jamf: Smart Groups for Noncompliant, FileVault Off, OS Out-of-Date; policy failure trends.
• Intune/Entra ID: Device compliance by partner, Conditional Access sign-in logs, blocked attempts by reason.

KPIs to Track

• Percentage of devices successfully registered with Entra ID.
• Compliance rate (overall and by business unit).
• Mean time to remediate noncompliance.
• Conditional Access block rate (and false positives).

Automation

• Trigger Jamf policies based on Smart Group changes (e.g., auto-remediate FileVault).
• Use Intune Graph APIs or Log Analytics to alert on registration gaps or stale compliance data.

Common Pitfalls and How to Avoid Them

• Dual enforcement: Applying the same restriction in both Jamf and Intune can conflict. Keep ownership clear.
• Missing registration: Device managed by Jamf but not registered with Entra ID wont satisfy Conditional Access. Make registration part of onboarding.
• Stale compliance: If Jamf stops sending updates, Intune may mark devices noncompliant. Set reasonable grace periods and monitor connector health.
• Overreliance on scripts: Prefer configuration profiles and native frameworks for stability and transparency.
• Communication gaps: Users blocked by CA without clear instructions flood the help desk. Provide concise, actionable guidance in notifications.

Cost, Licensing, and ROI

Licensing typically includes Jamf Pro per-device or per-user licensing and Microsoft Intune through standalone or Microsoft 365/EMS bundles. Budget for initial integration effort and ongoing operations (monitoring, updates, and support). The return on investment arrives through:

• Risk reduction: Hardened devices plus Conditional Access mitigate data leakage and credential abuse.
• Operational efficiency: Clear ownership reduces policy duplication and troubleshooting time.
• User productivity: Zero-touch enrollment and Self Service minimize downtime.

Quantify value by tracking incident reductions, faster audits, and fewer manual remediation tasks.

Conclusion

Integrating Intune and Jamf gives you the best of both worlds: Apple-native management depth paired with identity-driven access control. Start with a clear split of responsibilities, connect Jamfs compliance signals to Intune, and enforce Conditional Access consistently. Pilot carefully, monitor continuously, and iterate your baselines as the platform evolves.

The payoff is a secure, scalable, and user-friendly environment that meets the needs of Security, IT, and the businesswithout compromise.

Frequently Asked Questions

Do I still need the Microsoft Company Portal app?

In most environments, yes. Company Portal (or a guided registration flow) registers the Jamf-managed device with Entra ID so Intune can correlate compliance and Conditional Access can work.

Can I manage iOS and macOS the same way in co-management?

The principles are the same, but details differ. macOS often uses profiles, scripts, and MAU for Microsoft apps; iOS relies heavily on MDM profiles and ABM-managed app distribution. Validate each platform separately.

What if a device is compliant in Jamf but still blocked by Conditional Access?

Check that the device is registered, the Jamf-Intune connector is healthy, partner compliance data is current, and the Conditional Access policy scoping matches the user and app.

Who should own policies: Security, Identity, or Endpoint?

Security defines requirements; Endpoint (Jamf) implements device state; Identity (Intune/Entra ID) enforces Conditional Access. Use a shared RACI and change control to keep alignment.