Enroll macOS devices in Jamf Pro for Microsoft Defender for Endpoint

Enroll macOS devices in Jamf Pro so Jamf Pro can deliver the configuration profiles and deployment policies required by Microsoft Defender for Endpoint. You can use invitation-based Device Enrollment or Automated Device Enrollment with a computer PreStage.

Jamf Pro is a separate product that isn't part of Defender for Endpoint and isn't included with Defender for Endpoint subscriptions. To use these procedures, your organization needs a separate Jamf Pro subscription. For product and subscription information, see Jamf Pro. If your organization doesn't use Jamf Pro, you can deploy Defender for Endpoint with Microsoft Intune or use another MDM solution.

Important

Microsoft provides information about Jamf Pro to support integration scenarios but doesn't provide troubleshooting support for this third-party product. For issues specific to Jamf Pro, contact Jamf support.

Prerequisites

Before you enroll macOS devices, make sure you meet the following requirements:

• Review the Defender for Endpoint on macOS prerequisites.
• Set up computer groups in Jamf Pro.
• Deploy and configure Defender for Endpoint on macOS with Jamf Pro.
• Verify that your Jamf Pro account has permission to configure enrollment and assign computers to the appropriate groups or PreStage enrollment.

Choose an enrollment method

Jamf Pro supports several enrollment methods. The Defender for Endpoint deployment series covers these two methods:

• Enrollment invitations for user-initiated Device Enrollment.
• Automated Device Enrollment that uses a computer PreStage.

Choose the enrollment method that meets your organization's device ownership and deployment requirements.

Enroll devices by using enrollment invitations

Jamf Pro Device Enrollment is intended for institutionally owned Mac computers that aren't eligible for Automated Device Enrollment. An enrollment invitation gives users email access to the enrollment portal and lets you control options such as expiration, sign-in requirements, and the number of times an invitation can be used.

Use the current Jamf Pro documentation to configure and complete invitation-based enrollment:

• Review Device Enrollment for Computers.
• Configure the User-Initiated Enrollment settings.
• Follow Sending a Computer Enrollment Invitation via Email.
• Provide users with the Device Enrollment Experience for Computers.

Enroll devices by using Automated Device Enrollment

Automated Device Enrollment is commonly used for organization-owned Mac computers and enrolls them during initial setup. Jamf Pro uses a computer PreStage enrollment to define the enrollment experience and the devices in scope.

Use the current Jamf Pro documentation to configure Automated Device Enrollment:

• Review Automated Device Enrollment for Computers, including the required integration with Apple Business Manager or Apple School Manager.
• Review how Computer PreStage Enrollments define settings and scope.
• Follow Creating or Editing a Computer PreStage Enrollment.

Confirm device enrollment

Enrollment screens and required user actions vary by the macOS version and your Jamf Pro enrollment settings. Follow the current Jamf documentation for the selected enrollment method instead of relying on a fixed sequence of screens.

After enrollment is complete, verify in Jamf Pro that each Mac is enrolled, is assigned to the intended computer group or PreStage enrollment, and receives the Defender for Endpoint configuration profiles and deployment policy.