Jamf to Intune Migration: Inventory, Enrollment, Policy Parity and Rollback

A Jamf to Intune migration moves your Macs from Jamf management to Microsoft Intune without losing encryption, applications or access rules on the way. The work is an inventory of what Jamf does today, a decision about how each Mac will enroll, a rebuilt set of policies and apps, a pilot group, a rollback plan and a written acceptance check. Expect hands-on time per Mac; this is not a switch you flip.

This guide is for a business that has decided to consolidate on Intune, usually because it already pays for Microsoft 365 Business Premium and runs Windows there too. If you are still weighing the two tools, read our comparison of Intune vs Jamf for a small business first. If the decision is made, our Intune management service scopes and runs the move described here.

What does a Jamf to Intune migration involve?

Jamf and Intune are both mobile device management (MDM) services, but a Mac can hold only one MDM enrollment at a time. Moving means removing Jamf's management profile and enrolling the Mac in Intune, then making sure Intune delivers what Jamf used to: configuration profiles, scripts, applications, FileVault encryption, software update rules and the compliance signal that your Conditional Access policies read. Each of those pieces is rebuilt, not copied. There is no Microsoft tool that imports a Jamf configuration.

Microsoft documents the macOS enrollment methods Intune supports: personal (BYOD) enrollment through the Company Portal app, and for company-owned Macs, Apple Automated Device Enrollment, device enrollment manager and direct enrollment (Set up enrollment for macOS devices, Microsoft Learn, checked on November 7, 2026). Which path each Mac can take decides most of the project effort, so the inventory comes first.

Step 1: Inventory what Jamf does today

Export, do not recall from memory. Pull these lists from Jamf before any design work:

1. Devices. Every Mac with model, macOS version, serial number, assigned user, whether it was enrolled through Automated Device Enrollment or by a user, and its last check-in. Macs that have not checked in for months are a cleanup decision, not a migration item.
2. Configuration profiles. Wi-Fi, VPN, certificates, FileVault, firewall, login window, restrictions, privacy preferences (PPPC), kernel and system extension approvals, notification settings and anything scoped to a Smart Group.
3. Policies and scripts. What each script does, how often it runs, what it depends on and who wrote it. Shell scripts generally port; the scheduling and scoping logic around them does not port automatically.
4. Applications. Packages Jamf installs, apps bought through Apps and Books in Apple Business Manager, Self Service items and the versions users actually have.
5. Identity and security add-ons. Jamf Connect, Jamf Protect or any other agent that signs users in, enforces passwords or watches the endpoint. These need a named replacement or a decision to keep them.
6. Groups and scoping. Smart Groups and static groups, with the criteria behind each, so the equivalent Intune groups and filters can be built.
7. Escrowed secrets. FileVault recovery keys, bootstrap tokens and certificates that Jamf holds today.

Record an owner for each item: the person who can say whether it is still needed. A quarter of most Jamf inventories turns out to be settings nobody can explain, and migrating them unexamined wastes the pilot.

Who owns Apple Business Manager, and what are the enrollment constraints?

Apple Business Manager (ABM) is the Apple portal that holds your company-owned device records and your Apps and Books purchases. Find out who the account administrator is and whether the business, or a previous IT provider, controls it. Intune connects to ABM through an enrollment program token, and Microsoft's setup steps have you assign the Macs to Intune's device management service in the Apple portal (which Apple now calls Apple Business) and keep a record of the organization Apple ID that created the token, because the token is renewed yearly with that account (Set up a macOS ADE token in Intune, Microsoft Learn, checked on November 7, 2026). Macs currently assigned to Jamf's management service in that portal have to be reassigned before they can enroll in Intune through Automated Device Enrollment. Without ABM access, that path is not available to you.

Microsoft's prerequisites for macOS Automated Device Enrollment are specific. The device requirement is "New or wiped macOS devices purchased through Apple Business or Apple School Manager," and Microsoft's tip is blunt: "Automated device enrollment applies device configurations that a device user may not be able to remove. Wipe all devices prior to enrollment to return them to an out-of-box state" (Set up automated device enrollment for macOS, Microsoft Learn, checked on November 7, 2026). The same page notes that Intune ended support for the Setup Assistant (legacy) authentication method with its October 2026 service release, so new enrollment policies use Setup Assistant with modern authentication, where the user signs in to the Company Portal app to finish registering the Mac in Microsoft Entra ID.

That leaves two realistic paths for a Mac that is already in use:

Path	When it applies	What it costs you
Erase and re-enroll through Automated Device Enrollment	The Mac is in ABM and you want supervised, locked enrollment with Setup Assistant control	A full wipe per Mac, so user data must be backed up and restored and the user loses part of a day
Enroll in place through the Company Portal (user-approved enrollment)	The Mac is not in ABM, or a wipe is not acceptable	A user action on each Mac; Microsoft says user-approved enrollment "provides the same level of control as supervised macOS devices enrolled using Automated Device Enrollment or Apple Configurator" and that Intune turns on supervision for user-approved devices running macOS 11 and later

Two details matter for either path. Microsoft states that "All Mac enrollments in Intune are considered user-approved," and that a bootstrap token, which lets non-admin users approve software updates and system extensions, is available on supervised Macs and Macs enrolled through Automated Device Enrollment (Microsoft Learn, checked on November 7, 2026). Which path fits your Macs is an engineering decision made against the inventory, and the plan should state it per device group before anyone removes a Jamf profile.

How do you reach application and security-policy parity?

Parity means every control that mattered in Jamf has a tested equivalent in Intune before the Mac leaves Jamf. Build a mapping table from the inventory and have the owner of each row sign it off:

Jamf object	Intune equivalent to build and test	Watch for
Configuration profiles	Settings catalog and device configuration profiles	Custom profiles that reference Jamf-specific identifiers or certificates
Policies and scripts	Shell scripts with a schedule and assignment	Scripts that assumed Jamf's binary or inventory attributes
Packages and Self Service	Managed apps (PKG and DMG), Apps and Books assignments from ABM, and the Company Portal as the self-service catalog	Apps licensed per device in Apps and Books have to be reassigned to the Intune token
Smart Groups	Microsoft Entra dynamic groups and Intune assignment filters	Criteria based on Jamf extension attributes have no direct equivalent
FileVault settings and escrowed keys	Intune FileVault policy with recovery key escrow	Keys Jamf holds do not move with the Mac; confirm how each Mac's key is rotated and escrowed into Intune before Jamf is retired
Jamf Connect or other sign-in agents	Platform SSO and local account policies, or a kept third-party agent	Local account passwords and secure token ownership
Jamf Protect or other endpoint agents	The endpoint protection agent your security stack already uses, deployed and verified from Intune	System extension and full-disk-access approvals must be in place before the agent installs
Compliance signal to Conditional Access	Intune compliance policy for macOS	Jamf's Device Compliance integration stops reporting once the Mac leaves Jamf; the Intune policy must be live first

Treat anything you cannot map as an open decision with a name on it. The usual list: a login script that only one person understands, a printer deployment, and an application the vendor packaged for Jamf only.

How should the pilot group run?

Pick five to ten Macs that represent the fleet: at least one from each department, one older model, one Mac that was never in ABM, and one belonging to someone who will complain early and precisely. Run the pilot in this order:

1. Build and assign every Intune policy and app to a pilot group while the Macs are still in Jamf.
2. Back up the pilot users' data, then enroll each Mac by the path the plan assigns to it.
3. Remove the Jamf management profile only after Intune shows the Mac as enrolled and compliant.
4. Work through the acceptance table below with the user present, and record every gap.
5. Fix the gaps in the Intune configuration, then repeat on a second small group before scheduling the rest.

Give the pilot two weeks, not two days. Software update behavior, certificate renewals and Conditional Access prompts show up over a cycle of normal use, not in the first hour.

What is the rollback plan?

Rollback is only possible while Jamf still exists. Keep the Jamf subscription and server access until the last Mac has passed acceptance, keep the exported Jamf configuration where the project team can read it, and do not release Apps and Books licenses from the Jamf token until the Intune assignments are proven. For a Mac enrolled in place through the Company Portal, rollback means removing the Intune profile and re-enrolling in Jamf, which the Jamf administrator should rehearse on one pilot Mac. For a Mac that was wiped for Automated Device Enrollment, there is no quick rollback: the device would have to be wiped again and rebuilt in Jamf, so that path should only be used once the Intune configuration has passed the pilot.

What counts as user acceptance?

Acceptance is a short, repeatable test on each migrated Mac, signed by the user or their manager:

Check	Pass condition
Sign-in and encryption	The user signs in, FileVault is on and the recovery key is escrowed in Intune
Compliance and access	The Mac shows as compliant in Intune and the user can open email and Teams under your Conditional Access rules
Applications	Every app on the mapping table for that user's role is installed and opens
Network and printing	Office Wi-Fi, VPN and printers work without the user entering settings
Security agent	The endpoint protection agent reports in from the Mac
Updates	The software update policy applies and the user can approve an update without an admin
Jamf removed	No Jamf profile or binary remains, and the Mac no longer appears as active in Jamf

Frequently asked questions

How long does a Jamf to Intune migration take?

It depends on the number of Macs, how many need a wipe, how many Jamf scripts and apps have to be rebuilt and how many users can be scheduled per week. For a small business, the inventory and Intune build usually take longer than the device moves. Plan it as a project with a pilot and waves rather than a weekend.

Can we migrate from Jamf to Intune without wiping the Macs?

Microsoft's documented route for a Mac that stays in use is enrollment through the Company Portal app, which Microsoft describes as user-approved enrollment with the same level of control as a supervised, automatically enrolled Mac. Automated Device Enrollment requires a new or wiped Mac that is in Apple Business Manager. Which route your Macs can take is confirmed during the inventory.

Do we need Apple Business Manager to use Intune for Macs?

Not for enrollment through the Company Portal, but you need it for Automated Device Enrollment and for assigning Apps and Books licenses to the Intune token. If a previous provider holds the ABM account, recover it before the project starts.

Does Intune do everything Jamf does?

No. Intune covers configuration, compliance, apps, scripts, FileVault and updates for the Macs a typical office runs, and our Intune vs Jamf comparison explains where Jamf goes deeper. The mapping table in this guide is where the gaps become visible, and each gap needs a decision before the Mac leaves Jamf.

Where is the public Jamf to Intune migration tooling?

There are community scripts on GitHub that export Jamf objects or help rebuild them in Intune. They are useful as accelerators and are not supported by Microsoft or Jamf, so test anything they produce in the pilot and keep a person accountable for the result.

Scope the move with NetSys

Bring your Mac count, your Jamf inventory exports and your Microsoft 365 plan to an Intune management review. NetSys can confirm the enrollment path for each group of Macs, build and test the Intune policies and run the pilot and waves, and the Macs can stay under managed Intune afterward on a month-to-month agreement.

Sources

Checked on November 7, 2026.

• Set up enrollment for macOS devices, Microsoft Learn: enrollment methods, user-approved enrollment and bootstrap tokens.
• Set up automated device enrollment (ADE) for macOS, Microsoft Learn: prerequisites, the wipe guidance and the retirement of Setup Assistant (legacy) authentication.
• Set up a macOS ADE token in Intune, Microsoft Learn: the enrollment program token, device assignment in Apple Business and yearly renewal.