Jamf vs Intune for managing Apple devices in India

A 140-person product firm in Powai asked me to choose an MDM for their 48 Macs. They had already chosen one. Nobody in the room knew it yet.

The question arrived framed as Jamf or Intune. That is already the wrong question.

Powai, a Tuesday in October, a 140-person product design and engineering firm. 48 Macs on the design and engineering floor, 92 Windows laptops across sales, finance and operations, one head of IT, one junior admin, and a security questionnaire from a European client sitting open on the screen. The questionnaire is what started this. It asked how they enforce disk encryption on every endpoint, and the honest answer was that nobody knew for the Macs.

I am Karthik. I have run this evaluation for four mixed fleets now. This is the one where my first recommendation was wrong, so it is the one worth writing down.

One disclosure before anything else. We sell and support Microsoft licensing and we sell Apple hardware, so read this knowing that. We make money either way, which is exactly why we can be straight with you.

What Intune actually does to a Mac now

Start with the thing most people are wrong about, because the folklore here is five years stale.

Intune enrols Macs through Automated Device Enrollment tied to Apple Business, the same path any Apple-first tool uses. Software updates moved to Apple’s declarative framework, so Intune declares a target version with a deferral and an enforcement deadline, and the Mac installs it and reports back. Microsoft has also committed publicly to day-zero support for new Apple operating systems, which was not true a few years ago and is worth updating your mental model for.

Then the part that decided the Powai room. Intune’s macOS compliance policy checks a fixed list. Microsoft’s own documentation covers system integrity protection, minimum and maximum OS version, password rules, firewall, disk encryption and Gatekeeper. Six things. Custom compliance scripts, the escape hatch you would use to check anything else, are available for Windows and Linux and not for Apple platforms.

Six checks answered the European questionnaire. Encryption was on the list. Bas, that was the whole emergency.

And the money question had already been answered by an invoice they were paying. Intune Plan 1 lists at ₹665 per user per month on microsoft.com, and it is included at no extra cost in Microsoft 365 Business Premium, E3, E5 and Enterprise Mobility plus Security.* They were on Business Premium. Another vendor had quoted them the standalone Plan 1 price as a fresh line item three months earlier. That is the most common way Indian mid-market buyers overpay for MDM, and it takes one look at the licence page to catch. We walk clients through that check as part of our Intune deployment practice before anyone signs anything.

What Jamf sees that Intune cannot

Now walk the other floor, because the Jamf case is real and I do not want to flatten it.

Jamf sells Apple management as three lines now. Jamf for Mac, which bundles Jamf Pro, Connect and Protect for macOS. Jamf for Mobile for iOS, iPadOS and the rest. And Jamf Now for organisations under 25 employees. The plan comparison sits in Jamf’s published product documentation if you want the feature grid.

The depth is not marketing. Jamf argues, in its own published comparison against Intune, that six compliance settings is a short checklist rather than a security posture. Jamf can assess whether XProtect malware signatures are current, whether Recovery Lock is set on Apple silicon, how a Mac scores against the CIS macOS benchmark, whether a specific certificate is installed. It is a competitor making the argument, so weigh it accordingly. I checked the six-setting claim against Microsoft’s documentation and the claim holds.

Then Extension Attributes and Smart Groups, which is where Jamf admins live. You can query any value on a Mac, turn it into an attribute, and group devices on it. Nothing in Intune replicates that on Apple.

Pricing is the part Indian buyers find hardest. Jamf publishes in US dollars and points you to a local reseller for a rupee quote. Public trackers put Jamf for Mac around USD 12.50 per device per month with a 25-device minimum, and Jamf Now around USD 4.* Treat those as the shape of a quote you are about to receive.

Why my first recommendation was wrong

My first draft said run both. It is a legitimate architecture, it is common in large mixed estates, and it goes like this: Jamf manages the Macs at depth, Jamf reports Mac compliance into Microsoft Entra, and Conditional Access enforces across the whole fleet from one identity plane. Clean on a slide. I have drawn it on whiteboards.

Two conversations changed my mind, and neither was about features.

The first was with the junior admin. I asked what he scripts. He said he does not, the person who did left in 2024, and the shared scripts folder still has that person’s name on it. Jamf’s advantage is an operator advantage. Hand it to a team with no operator and you have bought a deeper console that nobody drives. This is the same reason we put an MDM engineer on payroll rather than a ticket queue behind our device lifecycle management work. The console is the cheap half.

The second was arithmetic. 48 Macs at roughly USD 12.50 a month lands near ₹6 lakh a year at current rates, on top of licences already paid for. Matlab, that is most of a junior systems administrator’s salary. And a systems administrator would have closed the real gap, because the real gap was not a missing setting. Nobody was opening the compliance report. Achha, the console had been sitting there for eleven months telling them things.

Which is the corrective pair I keep coming back to. What that firm needed was a person who reads the report every Monday, not a console with more checks in it.

The math: Jamf vs Intune, line by line

This is the table I now draw before any mixed-fleet MDM decision. It arrives here, after both walks, because the walks are what make the rows mean anything.

Two rows carry most rooms. The staffing row, because it is the one nobody puts in the evaluation matrix and the one that decides whether either tool works. And the top row, because half the Indian buyers I meet are being quoted for something already sitting inside their licence.

What I told the head of IT

Intune for the whole fleet. Both platforms, one compliance model, one Conditional Access story, no new invoice.

Then two conditions, because a recommendation without a review date is just an opinion.

First, a named owner for the compliance report and a fifteen-minute slot every Monday morning. A person and a calendar entry. When a Mac shows red two weeks running, it goes to the head of IT with a date attached.

Second, a written trigger to revisit Jamf. Any one of these reopens the file. Mac share crossing half the fleet, a client questionnaire asking for CIS benchmark evidence on macOS, or a new hire whose job description includes scripting Macs. It sits in their IT plan with a review date on it, so the decision expires instead of hardening into policy.

The DPDP Act matters here in a way people underrate. The penalty ceiling for failing reasonable security safeguards is ₹250 crore, and an estate where nobody can say which endpoints had encryption enforced last quarter is exactly the estate that question gets asked about later. The audit trail is the part of the fleet that testifies. That is the same reason we keep device records under our device lifecycle management practice rather than in whatever the MDM happened to export that month.

If you are running this evaluation yourself

Five things, in the order I would do them.

Convert your Mac count into a percentage before anything else. 48 sounds like a lot until you set it beside 92. Under 40 percent Apple, the single-console argument usually wins on total effort.

Read your Microsoft licence before you read any vendor deck. Business Premium, E3, E5 and EMS already carry core Intune. Thoda boring, saves lakhs.

Ask who scripts. If the answer is nobody, or the answer is a person who left, Jamf’s best features are not available to you at any price.

Write down the exact compliance evidence a client or auditor has asked you for. Six settings answers many questionnaires. CIS benchmark scoring on macOS does not come out of Intune, and you should know which one you are being asked for.

Check the Apple Business side before blaming the MDM. Half the enrolment failures we get called about are a supplier number that was never linked, not a tool that cannot manage Macs. We wrote the full sequence in our Apple Business setup guide for Indian companies. If you are earlier than that in the process, how to choose an MDM in India is the better starting point.

* Prices are list prices at the time of writing and move with vendor updates, currency and volume. Microsoft publishes Intune pricing in rupees on microsoft.com. Jamf publishes in US dollars and quotes Indian buyers through authorised resellers, so confirm both against a current written quote before you budget.