Jamf Pro 11.26: validate Entra enrolment and Platform SSO
Jamf Pro 11.26 adds automatic Mac registration with Microsoft Entra when Simplified Setup for Platform SSO is selected in a PreStage. Treat the capability as a complete identity journey, not merely an MDM checkbox.
1. The documented change
Jamf says that, on macOS 26 or later, a Mac is automatically registered with its Microsoft Entra device-compliance integration during enrolment when Simplified Setup for Platform Single Sign-on is enabled in the PreStage General payload. Jamf also specifies that a Microsoft Company Portal version that supports this journey is required for full functionality.
2. Define the pilot before the PreStage
Select a pilot group with a consistent identity configuration. Record macOS version, PreStage, Platform SSO profile, Company Portal version, expected Entra group and support owner. Keep this record free of passwords, tokens and unnecessary personal data.
Confirm that the device is assigned to the correct MDM server in Apple Business Manager first. For Apple enterprise Belgium and Apple enterprise France projects, this links purchase, assignment, MDM and identity from the first startup.
3. Test end-to-end enrolment
On an authorised test Mac, document the start and end of Setup Assistant, MDM enrolment, expected Entra registration and access to planned resources. Then run a controlled negative test: an unauthorised configuration or user must not receive the same access level. MDM and identity owners should review the results.
4. Prepare recovery and support
Document a fallback route for cases in which Company Portal or Entra registration does not complete the journey. Do not permanently bypass the issue with a privileged local account. The support record should name the handoff, required evidence and the decision to retry or escalate.
5. Roll out in waves
After approval, expand by group and monitor enrolment failures, support requests and compliance gaps. A single successful Mac does not demonstrate fleet-wide compliance: versions, networks, identity profiles and populations must remain explicit in the rollout plan.
6. Underside analysis: automation is still a control to evidence
The announced simplification can remove a user action during enrolment, but it does not replace Entra governance, business-app testing or MDM operations. A sound closure criterion is a verified chain from Apple Business Manager through PreStage and Jamf to identity and support.
Enrollment SSO on Mac · Managing the fleet with Jamf
Recommendation: qualify automatic registration with a pilot group, an expected result, a refusal scenario and a recovery procedure. Underside supports organisations in Belgium, France and Europe with Apple deployment, identity and MDM.
Plan your Platform SSO pilotSource: Jamf Pro 11.26 — Device Compliance with Microsoft Entra.