Hi, I'm Colton Fouch. I keep 2,000+ people working.

context

When Microsoft began expanding Intune's macOS capabilities, we faced a decision: consolidate all endpoint management under Intune (reducing vendor count) or maintain a best-of-breed hybrid with Jamf Pro for macOS and Intune for Windows. The fleet included 1,500+ Macs and 500+ Windows devices, with deep investment in Jamf Pro automation and zero-touch workflows.

decision

Maintained Jamf Pro as the primary macOS MDM with Intune for Windows, integrated through Entra ID for unified identity. Kept platform-specific tooling where it provided measurable advantage rather than forcing consolidation at the expense of capability.

alternatives considered

• -Intune-only: Would have required rebuilding zero-touch workflows from scratch with fewer macOS-specific controls. Estimated 6-12 month migration with degraded macOS management during transition.
• -Jamf-only with Intune connector: Lighter touch but would have left Windows devices without mature management, creating a gap for the 25% of fleet on Windows.
• -Third-party unified MDM (Workspace ONE, Kandji): Evaluated but would have required migrating both platforms simultaneously — high risk, uncertain ROI.

consequences

Mac management remains best-in-class with Jamf Pro's Apple-specific feature set (Setup Manager, Patch Management, Platform SSO integration). Windows devices managed through Intune with co-management where needed. Entra ID provides unified identity across both platforms. Ongoing cost of two MDM platforms is offset by reduced IT labor and faster incident resolution on macOS — our primary platform.

context

Patagonia's macOS fleet relied on traditional password-based authentication synced through Jamf Connect. Password resets were a top IT ticket driver, and shared credentials created security risks. When Apple introduced Platform SSO with Secure Enclave support in macOS Ventura, we saw an opportunity to eliminate passwords entirely for device login.

decision

Adopted Platform SSO with Secure Enclave-backed authentication via Jamf Connect + Entra ID, phased across the fleet. Users authenticate once with biometrics (Touch ID) or local account, and the Secure Enclave handles token exchange with Entra ID — no passwords stored or transmitted.

alternatives considered

• -Status quo (Jamf Connect password sync): Functional but perpetuated password-based vulnerabilities and IT ticket volume.
• -Conditional Access + MFA only: Added friction without eliminating the underlying password problem.
• -Full Entra ID Join: Not supported on macOS at the time and would have required Intune migration for Mac management.

consequences

Password reset tickets dropped significantly. Zero credentials stored on-device outside the Secure Enclave. Users authenticate with Touch ID — faster and more secure. However, the initial rollout required careful change management; users accustomed to password login needed training on the new biometric flow. Platform SSO adoption also required macOS Ventura minimum, creating a short-term OS upgrade push.