Manually Configure the Connection Between Jamf Pro and Microsoft Intune

Manually configuring the connection between Jamf Pro and Microsoft Intune involves the following steps:

  1. Create a new application for Jamf Pro in Microsoft Azure.

  2. Configure Microsoft Intune to allow the Jamf Pro integration.

  3. Configure the macOS Intune Integration setting in Jamf Pro.

Important: Do not attempt to use the manual connection method to connect multiple Jamf Pro instances to a single Azure AD tenant. In addition, the manual connection method should not be used in conjunction with the Cloud Connector. This will prevent the Intune Integration from working correctly.

Note: When configuring the connection between Jamf Pro and Microsoft Intune, you must use the Microsoft Azure website (portal.azure.com) and not the Microsoft Azure portal desktop app.

Note: Due to changes on the Microsoft API backend permissions, changes are needed for the Microsoft and Jamf integration. Refer to Support Tip: Intune service discovery API endpoint will require specific permissions for more information from the Intune team at Microsoft.

The permission requirements for the Jamf integration enterprise apps were made in collaboration with Microsoft.

Step 1: Create a new application for Jamf Pro in Microsoft Azure

  1. Open Azure Active Directory, and navigate to App registrations.

  2. Click New registration.

    1. Enter a display name for the Jamf Pro application.

    2. Under Supported account types, select which accounts can use the application.

    3. Specify your Jamf Pro URL as the Redirect URL.

    4. Click Register.

  3. Select the newly created application, copy the value from the Application (client) ID field and paste it to another location.

    Note: The Application ID is required to configure the Compliance Connector in Intune and for configuring the macOS Intune Integration setting in Jamf Pro.

  4. Navigate to Certificates & secrets, and click New client secret.

  5. Give the Client Secret a description and select an expiration option. Once a new secret has been added, copy the value for the secret and paste it to another location.

    Important: The Client Secret value is required to configure the macOS Intune Integration setting in Jamf Pro. The value for the secret is shown only once after the secret is added. If the Client Secret expires, you must add a new Client Secret in Microsoft Azure, and then update your macOS Intune Integration configuration in Jamf Pro. Microsoft Azure allows you to have both the old secret and new secret active to prevent service disruptions.

  6. Navigate to API permissions.

    1. Remove all permissions, including the default permissions.

    2. Click Add a permission.

    3. Navigate to APIs my organization uses. Search for and click Microsoft Intune API. Click Application permissions, and then select update_device_attributes.

    4. Under Microsoft Graph, click Application permissions, and then select Application.Read.All.

    5. Click Add permissions.

    6. Navigate to APIs my organization uses. Search for and click Windows Azure Active Directory. Click Application permissions, and then select Application.Read.All.

    7. Click Add permissions.

    8. Click the Grant admin consent for your organization button, and then click Yes.

Step 2: Configure Microsoft Intune to allow the Jamf Pro integration

  1. In the Microsoft Azure portal, navigate to Microsoft Intune > Device Compliance > Partner device management.

  2. Enable the Compliance Connector for Jamf by pasting the value you copied from the Application ID field into the Jamf Azure Active Directory App ID field.

  3. Click Save.

Step 3: Configure the macOS Intune Integration setting in Jamf Pro

  1. In Jamf Pro, navigate to Settings > Global Management.

  2. Click Conditional Access images/download/attachments/81552637/conditional_access.png .

  3. Navigate to the macOS Intune Integration tab, and then click Edit.

  4. Select the Enable Intune Integration for macOS checkbox.
    When this setting is enabled, Jamf Pro sends inventory updates to Microsoft Intune. Clear the selection if you want to disable the connection but save your configuration.

  5. (Cloud-hosted instances only) Select "Manual" under Connection Type.

    Note: This setting does not display for instances hosted on-premise.

  6. From the Sovereign Cloud pop-up menu, select the location of your Sovereign Cloud from Microsoft.

  7. Click Open administrator consent URL, and follow the onscreen instructions to allow the Jamf Native macOS Connector app to be added to your Azure AD tenant.

  8. Add the Azure AD Tenant Name from Microsoft Azure.

  9. Add the Application ID and Client Secret (previously called Application Key) for the Jamf Pro application from Microsoft Azure.

  10. Select one of the following landing page options for computers that are not recognized by Microsoft Azure:

    • The Default Jamf Pro Device Registration page

      Note: Depending on the state of the computer, this option redirects users to either the Jamf Pro device enrollment portal (to enroll with Jamf Pro) or the Company Portal app (to register with Azure AD).

    • The Access Denied page

    • A custom webpage

  11. Click Save.
    Jamf Pro will test the configuration and report the success or failure of the connection.

Copyright     Privacy Policy     Terms of Use     Security
© copyright 2002-2021 Jamf. All rights reserved.