Intune or Jamf? Managing Macs, iPhones and Windows in a small business

By Akash Sengar · 6 October 2026 · 6 min read

Why a small business needs MDM

Mobile device management (MDM) lets you set up laptops and phones automatically, enforce encryption and passcodes, push apps and updates, and wipe a lost device. For a small business it also answers questions clients and insurers now ask: are devices encrypted, patched and centrally managed? The two names that come up most for mixed Apple and Windows fleets are Microsoft Intune and Jamf.

What Intune does

Microsoft Intune is Microsoft's cloud endpoint management service. It manages Windows, macOS, iOS/iPadOS and Android devices, and works closely with Microsoft Entra ID for sign-in and Conditional Access, so you can block email and files on devices that are not compliant. Microsoft 365 Business Premium and some enterprise plans include Intune, which is often the deciding factor for small businesses.

What Jamf does

Jamf Pro focuses on Apple devices: Mac, iPhone, iPad and Apple TV. Because it specialises in Apple, it is popular with organisations that run mostly Macs and want deep macOS control, a self-service app catalogue for users, and quick support for new Apple features. Jamf integrates with Microsoft Entra ID so Mac compliance can feed Conditional Access. It does not manage Windows PCs.

Apple Business and automated enrolment

Whichever MDM you choose, company-owned Apple devices should be enrolled through Apple Business, formerly Apple Business Manager, renamed in April 2026. Devices bought from Apple or a participating reseller are assigned to your organisation and to your MDM server. When someone switches a new Mac on, Setup Assistant enrols it automatically.

Microsoft describes this automated device enrolment (ADE) for Intune: devices are supervised by default, can ship directly to users, and enrol when first turned on; personal devices are not supported through ADE (Microsoft Learn). Jamf uses the same Apple mechanism. Setting up Apple Business correctly is the most important step for either tool.

Windows Autopilot

For Windows, the equivalent is Windows Autopilot, which registers devices with your tenant so that a new PC signs the user in, joins Entra ID, enrols in Intune and installs your apps and policies out of the box. Autopilot works with Intune, which is one reason Windows-heavy businesses standardise on it.

Intune vs Jamf: side by side

Can you manage Macs with Intune?

Yes. Intune can enrol Macs through Apple Business, apply configuration profiles, enforce FileVault encryption, deploy apps and scripts, and report compliance. Microsoft has also added platform single sign-on, so users can sign in to their Mac with their organisation account during setup (Microsoft Learn). For a business with a handful of Macs alongside Windows, Intune is usually enough. Where Macs are the main fleet, or teams need specialised macOS tooling, Jamf is worth evaluating.

A baseline policy set for small businesses

Whichever tool you pick, the first policies are similar. A sensible starting set for company devices:

• Full-disk encryption: BitLocker on Windows, FileVault on Mac, with recovery keys escrowed to the MDM.
• Screen lock and passcode requirements on laptops and phones.
• Automatic operating system updates with a deadline, and reporting on devices that fall behind.
• Firewall on, and endpoint protection deployed and reporting.
• Standard apps deployed automatically, and a self-service catalogue for optional ones.
• Compliance rules feeding Conditional Access, so non-compliant devices cannot reach company email and files.
• Remote lock and wipe tested on a spare device.

Personal phones (BYOD)

Many small businesses let staff read email on their own phones. Full device enrolment is usually unwelcome on personal devices. Intune app protection policies can protect company data inside apps such as Outlook and Teams without managing the whole phone, and Apple offers User Enrollment for personally owned devices. Decide your BYOD rules with HR and write them down, including what happens to company data when someone leaves.

Licensing considerations

We do not quote prices; check current vendor pricing. Questions to ask:

• Does your current Microsoft 365 plan already include Intune? Business Premium and some enterprise plans do.
• How many Apple devices do you have, and is that growing?
• Would running two tools, Jamf for Apple and Intune for Windows, cost more in admin time than the licence difference?
• Do you need features only available in higher tiers of either product?

Moving from another MDM or from no MDM

If devices are already managed by another tool, plan the switch one group at a time. Company-owned Apple devices are usually unenrolled and re-enrolled through Apple Business after being reassigned to the new MDM server; Microsoft notes that devices managed by another MDM must be unenrolled before enrolling in Intune (Microsoft Learn). Windows PCs can be registered for Autopilot and reset. If you have no MDM today, start with new devices through Apple Business and Autopilot, then bring existing devices in gradually, beginning with those used by admins and finance.

Back up user data and check recovery keys before any reset, and tell users in advance when their device will be affected and how long the reset should take. A short printed or emailed guide for the first sign-in helps people finish setup on their own.

Mixed fleets: one tool or two?

Three patterns are common:

1. Intune for everything: simplest to run, one console and one set of compliance rules. Works well for mostly Windows fleets with some Macs and phones.
2. Jamf for Apple, Intune for Windows: best Apple experience, at the cost of two consoles. Connect Jamf to Entra ID so both feed one access policy.
3. Jamf only: for Apple-only businesses.

With two tools, keep one source of truth for who owns which device, and make sure leavers are removed from both on the same day. Review compliance reports from both consoles together every month so gaps on one platform do not go unnoticed.

MDM for small business: how to choose

1. Count devices by platform and ownership (company or personal).
2. List must-haves: encryption, OS updates, app deployment, remote wipe, Conditional Access.
3. Check what your Microsoft 365 licence already includes.
4. Pilot with a few devices of each type, including a full new-device setup from the box.
5. Plan migration if devices are already in another MDM: they must usually be unenrolled first.

Our network, endpoint and MDM service sets up Intune, Windows Autopilot, Apple Business and Jamf for mixed fleets.