NoMad replacement

I’d look at XCreds to see if it would meet your needs. 

Thanks, I will give it a go.

Wait, we use ADFS and have JAMF Connect - where is the hold up? Care to post your cleansed JC config? Are you also leveraging ADDS?

The integration isn’t with ADFS, it’s with purely Entra. Where are you stuck?  

https://learn.jamf.com/r/en-US/jamf-connect-documentation-current/Federated_Integrations

xCreds operates in the same capacity (albeit a little bit more clunky) as JAMF Connect. 

Have you considered Apple’s built-in Kerberos SSO extension?

When we were testing JAMF Connect we used ADFS as well. We did’t see any issues with it. 

We use Apple’s Kerberos SSO Extenstion. We are ADFS/Entra Hybrid.

I thought there was a more updated setup guide, but here is a user guide:
• https://www.apple.com/business/docs/site/Kerberos_Single_Sign_on_Extension_User_Guide.pdf

Platform SSO is the direction of travel now, have you investigated that?

We currently use NoMAD, but planning on going down the PSSO route once we have some infrastructure upgrades worked out (SCEP proxies etc.).

We are using Platfrom SSO with Kerberos SSO Extenstion. Until Microsoft Entra is ready for Simplified Setup for Platform SSO, we’ll still be levaraging other tech. But our organization is still legacy on some things, so Kerberos SSO extenstion will probably stick around for a bit.

In my Org, we were in the same boat. We implemented XCreds and it’s working great. We will eventually move to Jamf Connect or Platform SSO when our Entra is set up completely. 

Seeing NoMAD mentioned in 2026 still blows my mind. It has been end of life for years, and anyone relying on it today is essentially brokering credentials over unpatched and deprecated channels.

ADFS is not the blocker here. Jamf Connect does not talk to ADFS at all. It talks to Entra through OIDC. If your Connect deployment failed, the issue is almost always in the Entra app registration or the redirect URI configuration, not ADFS.

XCreds and Kerberos SSO are valid options, and Platform SSO is the long term direction, but Connect should work with Entra even in hybrid ADFS environments.

I see the frustration that the NoMad deprecation on macOS 26 has caused, especially when JAMF Connect refuses to talk to your ADFS layer. Mobile Government Services can serve as a useful reference point for aligning third‑party sync tools with Azure Entra. Since you’re already on a pure Entra integration, confirming whether AD DS is still in the loop will clarify the authentication path, and XCreds often fills the gap where Connect falls short. If you pull the sanitized JC config I can spot any remaining mismatches.

Platform SSO is the way to go. I’m migrating from Connect to it now