A new hire opens a Windows laptop and gets the company apps within an hour. Another employee receives a Mac and spends half a day waiting for the right permissions. Both devices belong to the same company, yet their setup feels like 2 different IT departments are involved. That gap is where endpoint management decisions become expensive.
The Intune vs Jamf vs Kandji comparison is especially important for teams supporting Windows and macOS together. Microsoft Intune manages both operating systems. Jamf Pro focuses on Apple devices and can share compliance information with Microsoft Entra ID. Kandji has also changed: it became Iru in October 2025, and the current Iru platform supports Windows as well as Apple devices.
The choice affects new device setup, app updates, security checks, employee sign-in, help desk work, and the time spent keeping policies consistent. The useful question is which setup covers your actual devices and applications without creating extra work for the people maintaining them.
TL;DR:
Intune is a practical single-console choice when Windows is central to the fleet and the company already uses Microsoft identity services. Jamf Pro gives Apple administrators detailed Mac policies and can work with Intune for Microsoft Entra compliance checks. Kandji is now Iru, with Windows management added to its Apple roots, so older Apple-only comparisons are out of date. Test enrollment, apps, updates, encryption, identity, and support processes on real Windows and Mac devices before choosing. Compare the full cost of licenses and administration, including the work involved if 2 tools share responsibility.
What has changed in the Intune, Jamf, and Kandji comparison?
The first change is the product name. Kandji became Iru on October 22, 2025. The company announced an expanded suite covering endpoint management, identity, security, and compliance. Its rebrand announcement confirms that the current endpoint platform covers Apple, Windows, and Android, so describing Kandji as today’s Apple-only alternative would mislead readers. The legacy Kandji product and the newer Iru offering also need to be distinguished during a migration.
Legacy Kandji customers have an immediate planning issue. The company’s legacy support notice says they must complete their move to Iru by December 1, 2026, to retain uninterrupted access. That deadline matters to buyers comparing contracts in late 2026. It should be checked against the customer’s account instructions before any cutover, since software assignments and integrations may need review.
Microsoft Intune remains a cross-platform endpoint service. It manages Windows PCs and Macs from the same administrative service, but the operating systems still need distinct policies. A setting available to Windows through native management may require a different method on a Mac. One console doesn’t remove platform differences.
Jamf Pro takes another route. It is built around Apple device management, including Mac-specific inventory, policies, software distribution, and user-facing Self Service. Jamf’s integration with Microsoft helps companies keep Macs under Jamf while using Microsoft Entra rules to assess access to protected work resources. It doesn’t turn Jamf Pro into a Windows PC manager.
It also changes the old Microsoft Intune vs Jamf question. With Iru in the picture, a company can evaluate 2 cross-platform platforms and a dedicated Apple platform that fits alongside Windows management.
Side-by-side comparison for a mixed fleet
A useful comparison starts with what each platform can administer directly. It then separates core management from related products that may cost extra. Product names alone don’t tell an IT team whether a feature belongs to an endpoint management license, a security add-on, or a separate identity service.
| Requirement | Microsoft Intune | Jamf Pro | Iru (Formerly Kandji) |
| Windows PCs | Direct management | Requires another Windows tool | Direct management |
| Mac computers | Direct management | Primary focus | Direct management |
| Apple enrollment | Supports Automated Device Enrollment | Supports Automated Device Enrollment | Supports Automated Device Enrollment |
| Windows Autopilot | Supported | Separate Windows tool needed | Supported through Iru setup |
| Mac scripts and policies | Supported with Intune methods | Detailed Apple policy workflows | Apple management and assignment controls |
| Microsoft Entra access | Native Microsoft integration | Device compliance connector available | Evaluate current identity integration and scope |
| Mac app deployment | Supported | Supported | Supported |
| Windows app deployment | Supported | Another Windows tool needed | Supported |
| Licensing model | User plans and included suites | Quote by current package | Quote by selected products |
The Intune vs Jamf vs Kandji table describes supported categories, not equal depth. Mixed Windows and Mac management gets harder when a purchasing team assumes every platform uses the same app packaging, update controls, reporting fields, or login workflow. Require a live demonstration on both systems.
A key difference is operational ownership. Intune can give 1 team a single place to assign broad device policies. Jamf Pro may be managed by an Apple specialist while a Windows team uses Intune. Iru offers a cross-platform alternative, but a company should examine how its current Windows feature set handles existing policies before moving devices.
This is also why Mac device management software should be judged against the Macs in the fleet. Developers may need approved scripts and developer tools. Designers may need special licensing. Shared lab Macs may need stricter local account controls. A fleet of 15 standard Macs needs different policies from 500 specialist workstations.
How Windows management differs across the 3 platforms
For Windows policy teams, Intune vs Jamf vs Kandji starts with the tools already in production. Intune has a long history in the Microsoft business stack. IT teams can combine enrollment, configuration profiles, compliance policies, and application delivery with Entra identities. Windows Autopilot helps prepare eligible company devices during their initial setup. Some also use Configuration Manager alongside Intune.
Iru is now a real Windows contender, but buyers should examine the feature maturity relevant to their environments. In May 2026, Iru added Windows Autopilot setup for MDM enrollment during the first-run experience. That supports a concrete Windows onboarding path, though a pilot still needs to prove the company’s app delivery and recovery process.
Jamf Pro is not intended to replace Intune on Windows computers. Where Jamf is selected for the Macs, a separate Windows management service remains necessary. Price the combined arrangement and record which service owns each device. A shared dashboard doesn’t change primary MDM authority.
For mixed Windows and Mac management, test existing Windows requirements before replacing a known working service. Include BitLocker recovery, application packaging, local administrator controls, Windows update rings, and enrollment after a device reset. A product may cover the basic lifecycle without matching every established management workflow.
The Intune vs Jamf vs Kandji choice also turns on which Microsoft features an organization already pays for. If Intune Plan 1 is part of the employee’s Microsoft 365 license, adding another Windows manager may create a separate bill. That can still make sense for a defined reason, but the reason needs to be visible in the business case.
Mac enrollment and first-day experience
For the Intune vs Jamf vs Kandji decision, Apple Automated Device Enrollment is a shared starting point. It brings eligible company-owned Macs under an assigned service during setup. The device still needs connectivity, a valid enrollment configuration, and the permissions needed for its assigned apps. The employee’s experience depends on that preparation.
For the enrollment methods and limits, Microsoft’s macOS deployment guide describes enrollment options and app assignment for Macs. Intune supports company-owned enrollment and other enrollment models, with different management rights. Teams should decide which devices are company-owned and which are personally owned before they build policies. A personal Mac should not automatically receive every control designed for corporate hardware.
Jamf Pro uses Apple’s enrollment methods while placing more of the Mac setup process in Apple-focused administration. Policies and user-facing software options can be used after enrollment. Iru also retains Apple device enrollment and configuration controls from Kandji’s earlier product. Differences appear when an app or account setup fails.
Test the Mac before calling setup complete
A new Mac should receive disk encryption settings, approved applications, network access, and the required sign-in configuration. Confirm these outcomes on actual hardware. Apple silicon and older Intel devices can require different app handling. Some corporate apps also need a login before they can finish setup.
Jamf Pro Mac management can be attractive where administrators maintain several Mac profiles and application sets. Microsoft Intune vs Jamf is less clear when all Macs need only a small standard app set and common compliance checks. Neither point proves that a product is best without a trial using the organization’s standard Mac image and user accounts.
Document what users can do if setup stalls. Enrollment tests should include a missing app assignment and its recovery. Devices needing a manual fix aren’t ready for unattended delivery.
What Mac administrators can actually control
In Intune vs Jamf vs Kandji, daily Mac administration covers more than enrollment. Devices need settings maintained over time, inventory kept current, and special software installed for the correct users. IT should also understand which tasks are controlled through Apple’s management framework and which rely on a vendor agent or script.
For task scheduling and scope control, Jamf’s policy documentation explains how a Mac administrator can scope a policy, run a script, distribute software, and set the trigger or execution frequency. Policies can also be exposed through Self Service. That matters in environments where help desk staff need a repeatable repair action rather than asking every Mac user to run a terminal command.
Intune supports configuration profiles and scripts on Macs as well. Microsoft’s Mac script guidance explains the prerequisites for its management agent and script execution, including device check-ins and reporting behavior. Remote scripts may fail despite working locally because their account context differs. Confirm that the script changed the device as intended and check the reported result.
Iru uses an Apple management framework alongside agent-delivered functions and assignment rules. Iru endpoint management should be evaluated by how clearly the admin can see which settings reached a device and what happens when policies conflict. Buyers should verify the current feature in their intended product tier instead of assuming every function described in a broader vendor catalog is included.
In Jamf Pro Mac management, a custom policy library can be valuable but also creates maintenance work. Scripts need owners and testing after operating system updates. The same issue arises when scripting is used to fill gaps in Intune or Iru. A comparison of Mac device management software should therefore include how many local scripts the team will maintain over 12 months, not just how many the console can execute.
Application delivery and third-party software updates
A working laptop needs the correct applications without repeated manual installation. Windows and Mac packages use different formats and may have different update behavior. Across all 3 platforms, an administrator should confirm how apps are assigned to roles and whether a failed installation produces enough detail to fix the problem.
Intune supports application assignments for both Windows and macOS. Jamf Pro supports Mac software policies and Self Service delivery. Iru provides app management across its supported systems, including catalog-based updates for supported software. These broad capabilities overlap, but the exact catalog and update controls differ by product and licensing.
Iru endpoint management offers Auto Apps for supported titles. Its product documentation and current endpoint pricing page describe app updates as part of the endpoint offering, but administrators must still check whether their critical software is in the catalog. A catalog-based update cannot maintain a specialized internal app that the vendor doesn’t support unless a separate deployment method is used.
A comparison of Mac device management software should include an app installed on a clean laptop, an in-place upgrade, a blocked installation, and removal when the employee changes roles. For Macs, test on Apple silicon if that hardware is in use. For Windows, test a standard-user device that cannot approve installation prompts. Repeat the test with a device that has been offline for several days.
This is where Microsoft Intune vs Jamf becomes a question of staff workload. A team comfortable packaging both operating systems in Intune may prefer a common process. A team using Jamf Pro Mac management may spend less time maintaining its existing policy library. Jamf Pro Mac management should be evaluated using the support hours needed to maintain its application packages.
For mixed Windows and Mac management, don’t force identical apps or installation methods where the operating systems don’t support them. Build a shared requirement such as ‘VPN installed and working’ and allow each platform to meet it through a verified method.
Operating system updates and patch reporting
Update policies must reach devices and report outcomes. Teams also need a way to handle laptops that are asleep, off the network, or waiting for a restart. Those gaps often explain why a dashboard shows that an update was assigned while the actual computer remains behind.
For macOS 14 and newer, Microsoft recommends Apple’s declarative device management method for software updates. The macOS update checklist describes enforcing a target update by a deadline and notes Apple’s move away from older MDM update commands. Jamf and Iru also use Apple management capabilities for updates, but the available reporting and scheduling options should be checked in each current release.
Windows has its own update process and restart behavior. Before moving Windows devices from Intune to Iru, test quality updates, feature updates, and restart behavior. Those controls may be central to an existing security policy. Matching feature names don’t prove equivalent workflows.
Jamf Pro Mac management makes sense to examine when Mac updates require separate pilot rings for developers or users of older plugins. Iru endpoint management also needs a pilot with the exact macOS releases in use. For either product, test reporting after the machine reconnects. A console may show stale inventory until the next check-in.
In Intune vs Jamf vs Kandji, distinguish operating system updates from third-party app patching. A platform can do one well while requiring extra configuration for the other. List the applications whose updates must be installed quickly, then measure results across real machines.
Device security, encryption, and remote actions
For Intune vs Jamf vs Kandji, security settings should lead to a device state the team can check. Windows PCs commonly use BitLocker, while Macs use FileVault. NIST’s mobile security guidance describes management and protection across a device lifecycle, including company and personal equipment. A security plan also needs safe recovery-key handling and support for employees locked out of their computers.
Mac device management software must respect Apple’s security model. Some settings require a supervised device, user approval, or a specific macOS release. A company-owned Mac that enrolled through Automated Device Enrollment may allow different management actions than a personally owned Mac. IT should record those differences in its policies rather than copying the same settings to every device.
Remote lock and wipe deserve special care. A missing laptop could be offline when the administrator sends a command. The command may not take effect until the device contacts its management service. A ‘wipe requested’ status is different from confirmation that the device completed the action.
The products in Intune vs Jamf vs Kandji shouldn’t be compared as though MDM and endpoint detection are the same product. Management handles settings and device lifecycle. Threat detection and response may come from Microsoft Defender, Jamf Protect, an Iru security product, or another approved tool. Buying endpoint management doesn’t prove that every separate security feature is licensed.
A useful test includes a lost-device simulation and a failed encryption recovery. Check who can read the recovery key, how access is recorded, and what support can do when a worker changes machines. These details matter more than a feature list.
Identity, Microsoft Entra, and Jamf compliance
Device compliance affects whether a user can open business services protected by Microsoft Entra Conditional Access. The identity system needs a trustworthy view of the device’s state. That matters for Macs managed outside Microsoft.
Jamf Pro supports a device compliance connection with Microsoft. Microsoft’s Jamf compliance guidance describes the partner integration, which sends Jamf’s compliance results through Intune to Entra ID. The older Jamf Conditional Access integration was deprecated, so teams should use the current compliance route and check its prerequisites rather than follow older deployment tutorials.
This makes Microsoft Intune vs Jamf a different question from ‘Which one gives us Microsoft sign-in?’ A company can manage Macs in Jamf while using Entra access policies for approved resources. It still has to configure registration and policy scopes correctly. A mistake can block a compliant Mac or prevent registration.
On Intune-managed Macs, Microsoft supports Platform Single Sign-On with Entra ID. The Platform SSO overview explains the supported authentication methods and configuration requirements. This can reduce repeated prompts, but IT must test the intended sign-in flow and local account behavior. Different identity providers and shared-device workflows may need separate configurations.
Iru endpoint management should be checked against the same identity scenarios. Its broader product suite includes identity features, but a buyer must confirm the purchased product and required integrations. Cross-platform device inventory alone doesn’t establish equivalent Conditional Access functionality. For mixed Windows and Mac management, define identity success apart from MDM enrollment. The Intune vs Jamf vs Kandji decision should account for that distinction.
One console or separate Windows and Mac tools?
In Intune vs Jamf vs Kandji, a single console can save admin time, but 2 tools can be easier when each has a defined job. The decision depends on team skills and the policies already in production. Count the real management tasks rather than assuming the number of dashboards predicts the workload.
An Intune-only plan gives a Windows-first organization a common management service. It may fit a smaller Mac population with standard applications and straightforward compliance rules. Microsoft Intune vs Jamf requires more thought when Mac administrators maintain many custom packages or Apple-specific repair actions. Moving those workflows to Intune has a cost even if license fees appear lower.
The Intune-plus-Jamf model keeps Jamf as the Mac MDM and Intune as the Windows manager and Microsoft compliance connection. It creates 2 policy libraries and 2 support paths. Document each device’s primary management service and avoid conflicting Mac enrollments.
A third model uses Iru for both Windows and Macs. Iru endpoint management reduces the number of endpoint tools a buyer may need, but its Windows features should be demonstrated against established Windows policies. Jamf Pro Mac management remains a separate option for companies that prefer a Mac-specific operations team. These are choices about actual processes, not an automatic ranking.
| Fleet situation | Reasonable model to test | Main question |
| Mostly Windows with standard Macs | Intune for both | Do Mac app and login workflows meet the requirement? |
| Many specialized Macs plus Windows | Jamf for Macs and Intune for Windows | Is extra Mac control worth 2 consoles? |
| Mixed fleet seeking a different single platform | Iru across both | Does its Windows coverage meet existing policy needs? |
| Existing Jamf Mac investment | Retain Jamf during evaluation | What would migration save after project work? |
The Intune vs Jamf vs Kandji decision should follow a written ownership map. That map names the primary MDM, identity service, security tool, app update owner, and help desk escalation path for each operating system.
Moving devices between management platforms
Changing management services creates more work than transferring a device list. Old profiles must be removed in the correct order, new enrollment must succeed, and the replacement service must install the controls users need. Plan for app licenses, encryption escrow, network certificates, local accounts, and employee downtime.
Apple now provides a migration route for eligible enrolled devices. Its management migration guide describes moving devices to another management service with deadlines and re-enrollment. It includes requirements involving macOS 26 and device ownership or enrollment method. The feature does not mean that every Mac can change MDM without effort or that all old configurations automatically carry over.
If an organization uses legacy Kandji, the planned move to Iru is a separate transition that deserves its own checklist. A Kandji Iru migration should verify tenant readiness, assigned apps, scripts, custom configuration, and any connectors used to issue certificates or manage identity. The published December 2026 date makes the order of testing important for customers still on the old platform.
Teams considering a Kandji Iru migration should pilot different hardware generations and Mac roles, rather than pick only a recently enrolled laptop. A device used by a developer may have more special permissions than a standard employee Mac. The help desk needs rollback and escalation instructions even when the migration mechanism claims to preserve user data.
For mixed Windows and Mac management, changing Windows enrollment is a different exercise from Apple’s migration feature. Check Autopilot registration, old policy removal, and the steps needed to restore apps after a reset. Treat migrations as 2 coordinated platform projects under 1 owner, with clear acceptance checks for each.
Licensing, packaging, and total cost
An Intune vs Jamf vs Kandji price comparison needs the same scope on all sides. Microsoft lists Intune Plan 1 at $8 per user per month, paid annually, on its US Intune product page. It is also included in certain Microsoft 365 and Enterprise Mobility + Security subscriptions. A company already entitled to Plan 1 should check its actual contract before treating the published standalone price as a new cost.
For current package details and quote requirements, Jamf’s business pricing page directs buyers to contact sales for its Jamf for Mac package. That package includes products beyond Jamf Pro. An IT team pricing only MDM needs a quote that shows precisely what is included. Published package descriptions don’t justify reusing an old per-device figure as today’s rate.
Iru provides quote-based product pricing. Iru endpoint management may be bought alongside related security or identity offerings, depending on the quote. A buyer should separate those items to avoid comparing a management-only plan with a larger security bundle. A Kandji Iru migration may also require project time even when the vendor provides transition assistance.
For mixed Windows and Mac management, use a 12-month cost sheet with license charges, onboarding labor, migration labor, any add-ons, and ongoing administration hours. Include devices that belong to contractors or temporary staff if the agreement covers them.
Microsoft Intune vs Jamf may look inexpensive for Intune when it is already included in Microsoft 365, but a switch can require retesting Mac scripts and app workflows. A separate Jamf license can also be worth considering if it removes substantial work for a Mac support team. The comparison of Mac device management software must include operational cost and confirmed license scope rather than inventing a universal savings figure.
How to run a fair pilot on both operating systems
A Mac device management software pilot should use devices that look like the real fleet, alongside Windows PCs. Include a new Windows PC, a company-owned Mac, a Mac with a large application set, and an existing device that needs policy changes. Use normal employee accounts.
Set acceptance tests before anyone scores the products. Observe what happens when a device is offline or an application install fails. The team should be able to reproduce both the success and the failure.
For mixed Windows and Mac management, keep separate scorecards for Windows and Mac behavior, then compare the combined support burden. Jamf Pro Mac management may perform well in a complex Mac test without answering the Windows question. Iru endpoint management should pass the same Windows tests as Intune before a company treats it as a replacement for Windows policies.
Document how long each task takes and how much scripting it requires. A shortcut can shift work into custom code. Check the support team’s ability to maintain that code after the original administrator leaves. A comparison of Mac device management software should include day-2 support, not just the first successful enrollment.
The Intune vs Jamf vs Kandji pilot ends when decision makers can explain the gaps, costs, and ownership model. A short, evidence-based exception list is more useful than a large table of untested vendor claims. Select the arrangement that meets required controls with an administrative workload the team can sustain.
The practical decision for mixed fleets
No product makes Windows and macOS identical. Each operating system has its own enrollment rules and application formats. A management choice succeeds when the IT team understands those differences and can deliver a consistent result to employees. That means repeatable setup, clear compliance decisions, and working recovery steps when something fails.
For a Windows-heavy business already using Microsoft 365, Intune is a logical first pilot. A company with demanding Mac workflows can evaluate Jamf Pro alongside Intune. Iru adds a current cross-platform option, and existing Kandji customers need to account for the platform transition. Intune vs Jamf vs Kandji ultimately comes down to which tested model handles the fleet you have, at a cost and support effort you can explain.
Frequently asked questions
Is Intune enough to manage Windows and Mac devices?
It can be, depending on the Mac software and policy requirements. Intune supports both operating systems and can manage applications and compliance settings on each. A company should test its critical Mac workflows before assuming that a common console meets every need. Macs with extensive custom administration may justify a separate tool.
Is Kandji still called Kandji in 2026?
The company changed its name to Iru in October 2025. The current Iru platform offers endpoint management for Apple, Windows, and Android. Legacy Kandji environments are being moved to Iru, with a published December 1, 2026 transition deadline. Customers should follow their tenant-specific migration instructions.
Can Iru manage Windows PCs?
Yes. Iru supports Windows endpoint management and introduced a Windows Autopilot integration for first-run MDM enrollment in May 2026. The ability to enroll Windows devices doesn’t establish that every existing Intune feature has an identical replacement. Test required Windows configurations and app deployments before switching.
Can Jamf Pro replace Intune for Windows?
Jamf Pro is designed for Apple device management. A company using it for Macs still needs a suitable service to manage Windows PCs. Microsoft can cover Windows while a connector sends Jamf Mac compliance information.
What is the difference between Intune and Jamf for Macs?
Both can enroll Macs and deliver configurations and apps. Jamf Pro provides Apple-focused policies, inventory, and software workflows. Intune places Mac management within a broader Microsoft endpoint service. Microsoft Intune vs Jamf should be evaluated using the company’s actual Mac applications and help desk tasks.
Does Intune support Apple Automated Device Enrollment?
Yes. Intune can manage eligible company-owned Macs enrolled through Apple’s Automated Device Enrollment. Administrators still need to prepare enrollment settings, app assignments, and required identity steps. Testing a fresh device is important because the user experience depends on more than the enrollment profile alone.
Can Iru use Windows Autopilot?
Yes. Iru documented Windows Autopilot setup in May 2026 for automatic MDM enrollment during a new device’s initial setup. The configuration uses Microsoft Entra application settings and Iru Blueprint assignments. A company should verify its own Autopilot registration and deployment steps in a pilot.
Can Jamf and Intune work together with Microsoft Entra?
Yes. Jamf can manage Macs and report device compliance through the supported connector for Microsoft Intune and Entra ID. The setup requires matching policies, registration, and correct access scopes. Teams should use the current device compliance integration rather than older Jamf Conditional Access instructions.
Can the same Mac be fully managed by 2 MDM services?
A Mac ordinarily has 1 primary MDM management enrollment. Running Jamf and Intune together for compliance reporting doesn’t mean both services need full MDM authority over that Mac. Assign one service as the management owner and use documented integrations for the additional information needed by identity systems.
Do all 3 products support FileVault?
Each provides ways to manage or assess Mac security settings, including encryption, subject to supported configuration and licensing. FileVault is the macOS disk encryption technology. Test recovery-key handling and reporting on managed Macs, and confirm which administrators can retrieve recovery information when a user is locked out.
How should IT teams handle macOS updates?
Use management policies that match the macOS version and Apple’s current update methods. For macOS 14 and later, Apple declarative device management is an important approach. Test deadlines and restarts with a pilot group. A laptop that is offline or powered down may report completion later than expected.
How much does Microsoft Intune cost?
Microsoft currently publishes a US list price of $8 per user per month, paid annually, for Intune Plan 1. Eligible Microsoft 365 and Enterprise Mobility + Security plans include it. Actual prices depend on the agreement, region, and purchased products. Extra security or management features may require separate licenses.
How are Jamf and Iru priced?
Both vendors use quote-based pricing for the relevant business offerings. Jamf’s current Mac package includes more than Jamf Pro, while Iru offers endpoint management alongside separate identity and security products. Compare quotes with the same functions and supported device counts. Don’t rely on old Kandji price lists.
Can a company move Macs between MDM providers without erasing them?
Apple provides a management migration process for eligible devices, including Macs meeting the required operating system and enrollment conditions. It still needs a prepared destination and careful configuration handling. Older devices or unsupported enrollment types may require another process. Always test data and app access first.
Which setup fits a mostly Windows company with a few Macs?
Intune is a reasonable first option, especially if the company already uses eligible Microsoft subscriptions. Confirm that it handles the Mac software and security requirements before committing. Jamf is worth assessing for demanding Mac operations, while Iru offers another cross-platform path. The final decision should follow a pilot.
