Further investigated and discovered the following in Intune:
(Hint shows following message: "This will control if new enrollments for macOS are guided to Intune or Jamf by default.")
In our case, "All Users" are included as default and so all Mac devices are forced to enroll in Jamf (which we don't want).
So it looks, we could control this with Azure AD groups (include or exclude). But the question is, what happens, if a user does use a full managed Mac device (enrolled in Jamf) and wants to register his private Mac (BYOD) in Intune too? In the latter case, no Jamf enrollment is desired. (But as the same user account is used for the registration, a user based AD group could not fix this. Only a device group could handle this.)
Does anybody have more experience in this area?
I could be entirely off track with this post, so let me know if it has any bearing on what you’re trying to accomplish. We run a similar hybrid azure setup with Intune and conditional access policies and SSO; however, our Jamf Pro instance is cloud based. We also utilize LDAP authentication for user enrollment and disable the enrollment of personal devices through in JAMF via Settings > Global Management > User-Initiated Enrollment> Access.
For new corporate devices enrolling in jamf MDM, we either send the user an email link or kick off MDM by scoping the device in DEP. There are enrollment policies in place that execute and deletes any existing company portal app and installs the older version (1.16) that we’ve found to be more reliable. A few steps down the line it launches the conditional access enrollment part to get the integration with azure/intune worked out.
For BYOD, we just have to download a copy of company portal from Microsoft and tell it to bind. I have had an associate that's reported trouble enrolling with a BYOD device, but the screenshots provided in this post don't match the ones he'd provided.
Just to be sure I wasn’t taking crazy pills, I enrolled a virtual machine with a DEP enabled serial number in Jamf MDM, bound it with Jamf's azure integration after our policy installed Company Portal 1.16 and tested the function of our office applications successfully. Then I restored the machine via snapshot back to its pre-DEP state and cleared it out of azure/intune/jamf. I unscoped it from DEP to behave like a normal BYOD machine, pulled up the "Enroll my Mac" link in safari that you can find on Microsoft's doc page https://docs.microsoft.com/en-us/intune-user-help/enroll-your-device-in-intune-macos-cp and that linked prompted me to download the app from Microsoft’s page. Installed company portal 2.2 and bound it just like any other BYOD device.
Success/Failure will depend on your machine setup process as well as whether a machine already has previously existing objects in both azure AD as well as the Intune portion of azure under devices. There are a lot of stale objects in azure and cleanup is not enabled as a default. Additionally we’re finding the need to search for and delete the same machines by serial number as well as their old hostname in some cases up to 3 times before they will completely be removed.
