We haven’t switched over from version 2 as of yet, but we’re pretty happy with it.  If you are not an identity and access management (IAM) person (I am not, I’m a macOS/iOS propellerhead and shade tree developer) then you will want to get them involved.  We are an Okta shop for IdP, and fortunately there is a sweetheart arrangement between Apple and Okta (or at least there was, you never know with relationships) so Okta works pretty well with Jamf Connect.

Now, having said all that, and hoping not to draw fire since this is a Jamf community, depending on your use case, the advancements in single sign-on (SSO) in macOS 2026 might be enough to get you where you need to go.  We just read the Jamf Connect guide, got together with our IAM people, and it all came together.

It can be done on your own, BUT, If you have the option to work with Jamf, I would advise taking it. 
 

I worked with my Azure guy very extensively and we did it ourselves, but there were some things that just not clear at the time that are much better now.

My advice to you is to have a good solid plan for how you are getting Wi-Fi at the login window. I have deployed Jamf Connect and still have some hiccups relating to that because our 802.1X WiFi is not properly using EAP-TLS and proper certificates. In our case, I know exactly why that is, but Someone stumbling onto a new Jamf Connect deployment may not. Also be ready for a culture shock if plan on requiring two factor tokens to do ordinary Mac logins.