Conditional Access

Conditional Access

Check your Macs against a compliance policy you set, such as a minimum macOS version and FileVault, before you turn on conditional access in Microsoft Entra ID or another identity provider. Read-only.

This tool doesn't connect to Entra ID or Intune, and doesn't change any compliance setting. It reads Jamf Pro inventory and tells you which Macs would pass or fail the rules you choose, so you can fix them first.

How to use it

1. Connect to Jamf Pro and click Connect →. The tool checks Read Computers. Then click Continue → (or Proceed Anyway →).

2. Under Compliance Policy, set the rules:

   Rule	Options	Default
   Minimum OS Version	13.0, 14.0, 14.6, 15.0, 15.2, 26.0 or 27.0	14.0
   Maximum Days Since Inventory	7, 14, 30, 60 or 90 days. Measured from the Mac's last inventory update, not its last check-in	30
   Require FileVault encryption	On or off	On
   Require Gatekeeper enabled	On or off	On
   Require System Integrity Protection (SIP)	On or off	Off
   Require Firewall enabled	On or off	Off

   Every Mac is also checked for MDM Managed.

3. Click Run Assessment →. The tool reads your whole computer inventory.

Results

Counts at the top show how many Macs are Compliant and Non-Compliant. The policy you used is shown above the list, for example Policy: OS ≥ 14.0, inventory ≤ 30d, FileVault, Firewall.

Each Mac shows its name, macOS version, user, the number of Issues (rules it fails) and its status. Turn on Failing only to hide compliant Macs, and type in Filter… to search. Click a Mac to see each rule with a pass or fail and the detail, for example Last inventory: 45d ago (threshold: 30d). The detail also shows the Mac's serial number and last inventory. Back to List returns to all Macs.

If every Mac passes, you see All devices compliant.

Back changes the rules without connecting again.

How unknown values are treated

Rule	When the value is missing from inventory
FileVault, Firewall	Fails (Status unknown)
Gatekeeper, SIP	Passes (Status unknown)
Recent Inventory	Fails (No inventory recorded)

Treat a Mac that passes with an unknown status as unconfirmed, and update its inventory before relying on it.

Permissions: Read Computers.