Device management: Microsoft Intune and Jamf Pro

Import devices into Asset Management, with fallback models, device routing and assigned-user sync.

Who can do thisWorkspace Administrator

The Microsoft Intune and Jamf Pro connectors import the devices your MDM manages into Asset Management (AMS) as assets. Intune brings in the devices managed in Microsoft Intune; Jamf Pro brings in the Apple devices managed in Jamf. Both use the same editor. You decide which AMS model a device becomes, whether the AMS asset tag goes back to the MDM, and whether the assigned user is synced.

Note

The Integration Hub is in English only. Its buttons, fields and messages are quoted in English in these articles, in the Danish articles too, exactly as you see them in the app.

Before you start

The form tells you which access the MDM needs. It changes with the options you pick:

Intune: an Entra app with the Microsoft Graph permission DeviceManagementManagedDevices.Read.All (DeviceManagementManagedDevices.ReadWrite.All for two-way sync), admin-consented. For write-back or two-way assigned-user sync, also DeviceManagementManagedDevices.PrivilegedOperations.All and User.Read.All.
Jamf Pro: a Jamf API Role with Read Computers and Read Mobile Devices (plus Update Computers and Update Mobile Devices for two-way sync or user write-back), and an API Client.

In AMS, make sure the asset models you want devices to land on exist, for example a laptop model and a phone model.

Create the connection

Open Marketplace, find Microsoft Intune or Jamf Pro (category Device management) and click Add. The sheet New Microsoft Intune connection or New Jamf Pro connection opens.
Under Basics, enter a Name, for example "Nightly asset import".
Under Source, enter the access details:
- Intune: Entra tenant id, Client id and Client secret.
- Jamf Pro: Instance URL (for example https://your-company.jamfcloud.com), Client id (from Settings → API roles and clients in Jamf) and Client secret.
Choose the sync options (see below).
Under Target, choose a Computer fallback model, a Mobile fallback model or both.
Optionally add rules under Device routing.
Under Schedule & status, set the trigger and switch Enabled on.
Click Save.

The client secret is stored in Juvaro's secret vault and never shown again. When you edit, the form says "Secret set - enter a new value to rotate." If you change the Jamf Instance URL, enter the client secret again: a saved secret is only sent to the address it was entered for.

Sync options

Field	Choice	What it does
Sync direction	Import only (device → AMS)	Devices come into AMS; nothing is written back.
Sync direction	Two-way (also push the AMS asset tag back)	Also writes the AMS asset tag to the device in the MDM.
Assigned-user sync	Off	The assigned user is not synced.
Assigned-user sync	Import (device user → AMS assignee)	The device's user in the MDM becomes the asset's assignee in AMS.
Assigned-user sync	Write-back (AMS assignee → device user)	The AMS assignee is written to the device in the MDM.
Assigned-user sync	Two-way (AMS wins; the MDM fills blanks)	AMS is the master; the MDM only fills in devices that have no assignee in AMS.

Overwrite limit

With two-way assigned-user sync, the field Overwrite limit appears (1 to 1000, default 25). It stops the run if it would take the assigned user away from more than this many devices. Filling in a device that has no user is never blocked. That way a mistake on either side cannot remove many assignments in one run.

Fallback models and device routing

Every imported device becomes an asset of an AMS model. The fallback models decide the default: computers go to the Computer fallback model, phones and tablets to the Mobile fallback model. Choose the option "skip computers" or "skip mobile devices" to leave one kind out, but you must pick at least one model ("pick at least one model").

Device routing sends specific devices to other models. To build rules from your actual fleet:

Fill in the source details, then click Scan device models. The Hub lists what it found, for example "14 distinct models from 230 devices", with each model, whether it was matched on Model or Model identifier, and a count.
Click + rule next to a model to start a rule for it, or use Add routing rule for an empty one.
In the rule, choose the AMS model under Route to.
Set the conditions. A group matches Match ALL (and) or Match ANY (or); add more with + Condition and nest with + Group. Each condition compares a field (Model, Model identifier, Manufacturer, OS, Device type, Device class) using equals, does not equal, contains, starts with, ends with, is set or is empty.

Devices are matched top to bottom, and the first matching rule wins. Unmatched devices use the fallback models. Put narrow rules above broad ones. Remove rule deletes a rule.

The field mapping from device to asset is fixed for these connectors, so there is no field mapping or sample section in this editor.

Schedule

A new device connection starts with Trigger on Manual (Run now only) and Enabled off. Switch to On a schedule and the schedule starts as daily at 02:00 UTC; the fastest choice is every 15 minutes. All times are UTC. See Schedules and Run now. The editor also has a Webhook trigger section; see Webhook triggers.

Tip

There is no Test connection for Intune or Jamf. Save the connection with Manual (Run now only), click Run now once and check the run history and the new assets in AMS before you put it on a schedule.

A device connection pauses itself after 3 scheduled failures in a row. See A connection's page: figures, Pause and Resume.