Create separate Jamf Android app configurations for distinct activation profiles

Source facts

Microsoft requires a unique Android Enterprise app-configuration policy for each Jamf Activation Profile; one policy can serve all target devices when only one profile is needed. For iOS, Microsoft documents that one configuration policy can cover all devices being provisioned with Jamf. For Jamf device synchronization through UEM Connect, the activation profile must select Microsoft Entra ID under Associated User. Microsoft Learn.

Applicability

Use this review when provisioning Jamf Trust through Intune for Android Enterprise and iOS. Inventory the intended activation profiles and the device groups that should receive each configuration.

DSE recommendation

DSE recommends maintaining a profile-to-policy map for the Android deployment. Give each policy an identifiable target population and record its activation-profile URL under the organization’s credential-handling controls. Review the iOS configuration independently rather than copying the Android policy layout without checking the documented platform workflow.

Verification

Assign configurations to an approved test group first. Confirm that representative Android devices activate under their intended profile and that the expected device association synchronizes. Validate the iOS provisioning path separately, then retain the configuration mapping and observed profile membership before expanding assignments.

Official references

Microsoft Learn: Add and assign Mobile Threat Defense (MTD) apps with Intune. Source reviewed September 17, 2026.