NoMad replacement

I’d look at XCreds to see if it would meet your needs. 

Thanks, I will give it a go.

Wait, we use ADFS and have JAMF Connect - where is the hold up? Care to post your cleansed JC config? Are you also leveraging ADDS?

The integration isn’t with ADFS, it’s with purely Entra. Where are you stuck?  

https://learn.jamf.com/r/en-US/jamf-connect-documentation-current/Federated_Integrations

xCreds operates in the same capacity (albeit a little bit more clunky) as JAMF Connect. 

Have you considered Apple’s built-in Kerberos SSO extension?

When we were testing JAMF Connect we used ADFS as well. We did’t see any issues with it. 

We use Apple’s Kerberos SSO Extenstion. We are ADFS/Entra Hybrid.

I thought there was a more updated setup guide, but here is a user guide:
• https://www.apple.com/business/docs/site/Kerberos_Single_Sign_on_Extension_User_Guide.pdf

Platform SSO is the direction of travel now, have you investigated that?

We currently use NoMAD, but planning on going down the PSSO route once we have some infrastructure upgrades worked out (SCEP proxies etc.).

We are using Platfrom SSO with Kerberos SSO Extenstion. Until Microsoft Entra is ready for Simplified Setup for Platform SSO, we’ll still be levaraging other tech. But our organization is still legacy on some things, so Kerberos SSO extenstion will probably stick around for a bit.

In my Org, we were in the same boat. We implemented XCreds and it’s working great. We will eventually move to Jamf Connect or Platform SSO when our Entra is set up completely. 

Seeing NoMAD mentioned in 2026 still blows my mind. It has been end of life for years, and anyone relying on it today is essentially brokering credentials over unpatched and deprecated channels.

ADFS is not the blocker here. Jamf Connect does not talk to ADFS at all. It talks to Entra through OIDC. If your Connect deployment failed, the issue is almost always in the Entra app registration or the redirect URI configuration, not ADFS.

XCreds and Kerberos SSO are valid options, and Platform SSO is the long term direction, but Connect should work with Entra even in hybrid ADFS environments.