Migrating to Jamf Pro: a step-by-step guide

Organisations start migrating to Jamf Pro for different reasons: Macs are now a large share of their devices, the current platform is slow to support new Apple releases, or security teams need more control and evidence. Whatever the reason, the move itself is where projects succeed or fail. This is how we plan it, and what Apple’s newer migration tools now allow.

1. Take stock of what you have

List every Mac, iPhone and iPad, its operating system version, how it was enrolled, and whether it is registered in Apple Business. Note the apps, profiles, certificates and security tools each device depends on, and which apps were bought through Apple’s Apps and Books.

2. Decide how each group of devices will move

This is the key decision, and Apple has made it much easier. Devices on iOS 26, iPadOS 26 or macOS 26 or later that were enrolled through Automated Device Enrollment can move to a new management service without being erased. In Apple Business you assign them to Jamf Pro and set a deadline of more than one day and less than 90 days, or no more than 30 days if volume-purchased apps are involved.

What Apple’s documentation says happens during the move:

• People get prompts to re-enrol, more often as the deadline gets closer. If they do nothing, the organisation can enforce it: a restart on iPhone and iPad, and a full-screen prompt that cannot be dismissed on Mac.
• On iPhone and iPad, apps and their data stay if Jamf delivers them before setup completes. Declaratively managed apps are always kept.
• If FileVault is on, Jamf can rotate the recovery key with the Mac’s bootstrap token and escrow the new one, so you are not relying on keys left in the old system.
• The old Activation Lock is removed and its bypass codes stop working, so the new service should apply its own.
• Shared iPad, and devices set up for Return to Service with app preservation, are not migrated this way.

For older devices, Macs can usually be unenrolled and re-enrolled without losing data. iPhones and iPads normally need a reset before they can be supervised again. Most organisations end up with a mix.

3. Bring stray devices into Apple Business

Devices bought outside Apple’s programmes cannot enrol automatically until they are in Apple Business. Apple Configurator can add iPhones, iPads and Macs with Apple silicon or a T2 chip. Apple gives the user a 30-day provisional period in which they can release the device from management, and a device added this way can only use the no-erase migration once that period is over. Plan these devices early.

4. Build Jamf properly, do not copy the old set-up

A migration is a chance to remove old workarounds. Design enrolment, profiles, policies, smart groups and security in Jamf Pro from a clean baseline, and only keep what is still needed. Two set-up details save trouble later:

• Create the Apple push certificate with an organisation-owned Apple Account. Jamf says it must be renewed every year with the same account, and if a personal account is used and that person leaves, every device has to be re-enrolled.
• For Apps and Books, remove the content token from the old platform and upload a new one to Jamf. Apple’s content tokens expire after a year, so record the renewal date.

5. Plan identity and security

Decide how people will sign in, with Jamf Connect or Platform SSO and Microsoft Entra ID, and how device compliance will feed conditional access through Jamf’s Device Compliance integration. Replace security tools delivered by the old platform before it is switched off.

6. Pilot, then move in waves

Start with IT and a few willing users. Fix the problems they find, then move teams in planned waves with clear messages about what will happen and when. With deadline-based migration, each wave is a date in Apple Business rather than a desk visit.

7. Switch Apple Business over and decommission

Assign devices in Apple Business to the Jamf Pro server, so new and reset devices enrol in Jamf automatically. Once every device has moved, remove the old platform and cancel its licences.

Common problems

• Devices bought outside Apple Business that cannot be enrolled automatically.
• Wi-Fi or VPN that depends on certificates issued by the old platform.
• Apps licensed through the old platform’s Apps and Books connection.
• FileVault recovery keys left behind in the old system.
• Push certificates or tokens tied to someone’s personal account.

Keeping Intune for Windows

Moving Apple devices to Jamf does not mean leaving Microsoft. Many organisations use Jamf for Apple and Intune for Windows, with Jamf reporting each Mac’s compliance to Entra ID so conditional access treats Macs and PCs the same way. Our Jamf vs Intune guide covers when each fits.

How we help

As a Jamf Professional Partner and MSP, we plan and run migrations to Jamf from Intune, Workspace ONE and other device management platforms, through our projects and transformation service. We also supply Jamf licences. For a global consumer brand, we rebuilt the Jamf Pro design document from the live configuration so it matched what was really deployed. See our Apple and Jamf services.