# Create separate Jamf Android app configurations for distinct activation profiles

> How should Intune app-configuration policies map to multiple Jamf Trust activation profiles?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-188-create-separate-jamf-android-app-configurations-for-distinct-activation-profiles/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:52+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

How should Intune app-configuration policies map to multiple Jamf Trust activation profiles?

## Potentially affected

Use this review when provisioning Jamf Trust through Intune for Android Enterprise and iOS. Inventory the intended activation profiles and the device groups that should receive each configuration.

## DSE recommendation

DSE recommends maintaining a profile-to-policy map for the Android deployment.

## Article

## Source facts

Microsoft requires a unique Android Enterprise app-configuration policy for each Jamf Activation Profile; one policy can serve all target devices when only one profile is needed. For iOS, Microsoft documents that one configuration policy can cover all devices being provisioned with Jamf. For Jamf device synchronization through UEM Connect, the activation profile must select Microsoft Entra ID under Associated User. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-security/mobile-threat-defense/assign-apps).

## Applicability

Use this review when provisioning Jamf Trust through Intune for Android Enterprise and iOS. Inventory the intended activation profiles and the device groups that should receive each configuration.

## DSE recommendation

DSE recommends maintaining a profile-to-policy map for the Android deployment. Give each policy an identifiable target population and record its activation-profile URL under the organization’s credential-handling controls. Review the iOS configuration independently rather than copying the Android policy layout without checking the documented platform workflow.

## Verification

Assign configurations to an approved test group first. Confirm that representative Android devices activate under their intended profile and that the expected device association synchronizes. Validate the iOS provisioning path separately, then retain the configuration mapping and observed profile membership before expanding assignments.

## Official references

[Microsoft Learn: Add and assign Mobile Threat Defense (MTD) apps with Intune](https://learn.microsoft.com/en-us/intune/device-security/mobile-threat-defense/assign-apps). Source reviewed September 17, 2026.

## Primary reference

- Name: Add and assign MTD apps to Microsoft Intune - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/device-security/mobile-threat-defense/assign-apps
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Create separate Jamf Android app configurations for distinct activation profiles,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-188-create-separate-jamf-android-app-configurations-for-distinct-activation-profiles/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.