Jamf/InTune macOS Device Compliance - Mac not being added to InTune

@sakul The Device Compliance integration should only add your Mac to Azure AD, unlike the Conditional Access integration which added a record in both Azure AD and Intune.

I see.

Why am I not getting any compliance information in Azure? It just says "N/A" under "Compliant" and MDM is "None".

@sakul Does Jamf Pro show your Device compliance connection status is verified and you have the macOS platform enabled as shown below? 

I found the issue! It was a very dump mistake on my part.

I had the "Applicable Group" and "Compliance Group" fields mixed up 🤦‍

To my justification, all documentation I've seen, first describes the "Applicable Group" and then the "Compliance Group", while the Jamf settings page has them the other way around. So if you're not paying attention, you might mix them up. I think the order as documented makes more sense.

Hi @sakul 

I'm glad that you managed to find a solution to your problem.

I recently started using Jamf Pro (migrating from MS Intune) and currently, I'm setting the PCM device compliance feature.

The thing I couldn't figure out is, after I read the technical page you shared, only computers that are members of Compliance Group are synced to Intune and they are automatically set as "compliant" in Intune? Jamf decides who is compliant and who is not according to group membership? 

Not sure I understand the new flow...

Currently, in Azure AD, I have conditional access policies set which work fine with Intune registered MacOS devices. Are those policies will be relevant after I move all devices to Jamf?

Thanks!

@pTmichaelm With the old Conditional Access Jamf Pro/Intune integration the compliance evaluation was mad in Intune based on the inventory data that Jamf Pro provided for enrolled devices. With the new Device Compliance integration a Jamf Pro Smart Group is used to determine compliance and Intune will receive a report of compliant devices.

Thank you for clearing it out.

So basically I've done everything as instructed, the connection between Jamf and Azure is set successfully but I cannot see the devices in Azure. On my Mac for instance, in the Company Portal app, I see that the device is not managed (screenshot attached), what am I missing?

I thought I can share how we have done it (it's working but not really and it's getting frustrating, to be honest). We had issues as well in the beginning and we also mixed up the two smart groups at first meaning:

"Compliance Group Smart computer group Jamf Pro will use to calculate device compliance." - The smart group that is connected to this one is the one that tells Jamf that these devices are Compliant and members here will make it so in Azure compliant is "Yes". So if the device is not a member of this smart group the compliance status will show "No".
So this smart group is where you wanna set certain criteria, for example Firewall needs to be ON, just one example to meet criteria to be a member of this group and count as being compliant "Yes".

"Applicable Group Smart group containing all computers Jamf Pro uses to send a compliance status to Microsoft Intune. This also makes the Register button available in Self Service." - Computer members of this smart group is what tells Jamf to send status to Azure.

Now, remember you don't find the device object in Intune (meaning endpoint.microsoft.com) the devices that has registered with Company Portal are only showing up in Azure AD under devices and that's were you will see the compliance status as well (Yes or No).

When we at first were registering devices with Company Portal we had issues. We were getting the message "You're all set!" and the device was showing up in Azure AD under devices BUT on MDM it was saying "None" and Compliant "N/A".

We later figured out, via other posts here in Jamf community, that if you add in the policy where you are running the payload "Microsoft Device Compliance - Register computers with Azure Active Directory"

A "File and Processes" payload and "Execute Command" you run "jamf manage", so that basically "jamf manage" runs before registration.

After doing this, device registration to Azure was working every time. Devices were showing up in Azure showing MDM "Microsoft Intune" and also the Compliance status Yes/No

The reason it wasn't working before running "jamf manage" was because the jamfAAD authentication never popped up, meaning this part:

That authentication needs to be done. When that is done it also creates a .plist file called jamfAAD.plist and it's location is under users folder: "/Users/$loggedInUser/Library/Preferences/com.jamf.management.jamfAAD.plist"
If that has been created then you know the jamfAAD authentication was done correctly.
I can add that we automated the jamfAAD authentication as well by adding a configuration profile (CP) with this .plist settings:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>useWKWebView</key>
<true/>
</dict>
</plist>

Can also advice to create a CP for Microsoft Enterprise SSO for company portal:
https://learn.microsoft.com/en-us/mem/intune/configuration/use-enterprise-sso-plug-in-macos-with-intune?tabs=prereq-jamf-pro%2Ccreate-profile-jamf-pro

But... we are actually now facing a really strange issue. We had 4 test computers before running in production, i had 1 virtual machine and 3 physical machines and when testing with them it works great. But we just had all the users registering their devices, the registration part is working fine, the users are members of the smart group that tells Jamf to send status Compliant Yes to Azure but... all of them are show Compliant No. We have no clue why, our test machines are working even after reinstalling them and re registering them, if anyone is experiencing similar issues, please let us know how you solved it!

I thought I can share how we have done it (it's working but not really and it's getting frustrating, to be honest). We had issues as well in the beginning and we also mixed up the two smart groups at first meaning:

"Compliance Group Smart computer group Jamf Pro will use to calculate device compliance." - The smart group that is connected to this one is the one that tells Jamf that these devices are Compliant and members here will make it so in Azure compliant is "Yes". So if the device is not a member of this smart group the compliance status will show "No".
So this smart group is where you wanna set certain criteria, for example Firewall needs to be ON, just one example to meet criteria to be a member of this group and count as being compliant "Yes".

"Applicable Group Smart group containing all computers Jamf Pro uses to send a compliance status to Microsoft Intune. This also makes the Register button available in Self Service." - Computer members of this smart group is what tells Jamf to send status to Azure.

Now, remember you don't find the device object in Intune (meaning endpoint.microsoft.com) the devices that has registered with Company Portal are only showing up in Azure AD under devices and that's were you will see the compliance status as well (Yes or No).

When we at first were registering devices with Company Portal we had issues. We were getting the message "You're all set!" and the device was showing up in Azure AD under devices BUT on MDM it was saying "None" and Compliant "N/A".

We later figured out, via other posts here in Jamf community, that if you add in the policy where you are running the payload "Microsoft Device Compliance - Register computers with Azure Active Directory"

A "File and Processes" payload and "Execute Command" you run "jamf manage", so that basically "jamf manage" runs before registration.

After doing this, device registration to Azure was working every time. Devices were showing up in Azure showing MDM "Microsoft Intune" and also the Compliance status Yes/No

The reason it wasn't working before running "jamf manage" was because the jamfAAD authentication never popped up, meaning this part:

That authentication needs to be done. When that is done it also creates a .plist file called jamfAAD.plist and it's location is under users folder: "/Users/$loggedInUser/Library/Preferences/com.jamf.management.jamfAAD.plist"
If that has been created then you know the jamfAAD authentication was done correctly.
I can add that we automated the jamfAAD authentication as well by adding a configuration profile (CP) with this .plist settings:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>useWKWebView</key>
<true/>
</dict>
</plist>

Can also advice to create a CP for Microsoft Enterprise SSO for company portal:
https://learn.microsoft.com/en-us/mem/intune/configuration/use-enterprise-sso-plug-in-macos-with-intune?tabs=prereq-jamf-pro%2Ccreate-profile-jamf-pro

But... we are actually now facing a really strange issue. We had 4 test computers before running in production, i had 1 virtual machine and 3 physical machines and when testing with them it works great. But we just had all the users registering their devices, the registration part is working fine, the users are members of the smart group that tells Jamf to send status Compliant Yes to Azure but... all of them are show Compliant No. We have no clue why, our test machines are working even after reinstalling them and re registering them, if anyone is experiencing similar issues, please let us know how you solved it!

Hi @nadsad,

All of the above steps are correct. One thing if you have not checked yet.

Go to Microsoft Intune Admin Center —> Tenant Administration —> Partner Compliance Management —> Select Jamf Device Compliance —> Go to Properties —> Check if the user that you are trying to enrol with intune is present in the AD Group mentioned in Included Groups.

I have the same issue, only 1 out of 7 macs are showing as compliant. Any further suggestions?

I'm facing something different.

(Test) Device is showed in Azure AD but marked as compliant whilst it never was (on purpose). I already checked the smart groups without founding any issues, the "Compliance verified" smart group has 0 devices and the monitoring one has the test device.

Also, I noticed that "Registered" and "Activity" date and time columns in Azure AD are showing the same values, is the "Activity" suppose to update instead?