Skip to main content
The device management integrations connect Microsoft Intune (Windows, Android, cross-platform) and Jamf (macOS, iOS) to Softbooq’s IT & Helpdesk module. Device records, compliance status, and enrolled-employee mappings flow into Softbooq so your IT team has a single view of asset compliance without switching between consoles.

​
What syncs

Softbooq reads compliance data from Intune and Jamf. It does not push configuration profiles, MDM policies, or commands to enrolled devices. Your existing MDM console remains the management plane for device control.

​
Connect Microsoft Intune

Intune is accessed via the Microsoft Graph API using the same Microsoft 365 OAuth token as Admin Sync. If Microsoft 365 is already connected for directory provisioning, no additional OAuth consent is needed.
1

Confirm Microsoft 365 is connected under Settings → Integrations → Admin Sync → Microsoft 365

Intune requires the Device.Read.All scope. If you did not approve that scope when connecting Microsoft 365, reconnect and accept the updated consent prompt.
2

Open Settings → Integrations → Device Management → Intune → Enable

Toggle Intune sync on. The first sync runs immediately and imports all enrolled devices.
3

Review the device inventory in IT & Helpdesk → Assets

Imported devices appear with a compliance badge: Compliant, Non-Compliant, or Unknown.

​
Connect Jamf

1

Open Settings → Integrations → Device Management → Jamf → Connect

2

Enter your Jamf Pro URL

Enter the URL of your Jamf Pro instance (e.g. yourcompany.jamfcloud.com). On-premises Jamf servers require a publicly accessible FQDN; Jamf Cloud instances work out of the box.
3

Create a Jamf API role and client credentials

In Jamf Pro, go to Settings → API Roles and Clients. Create an API role with read-only access to Computers and Mobile Devices, then create a client with that role. Copy the Client ID and Client Secret.
4

Enter the credentials in Softbooq

Paste the Client ID and Client Secret. They are stored encrypted in the Vault.
5

Run the initial sync

Click Sync now to import the device inventory. Devices are matched to Softbooq employees by the enrolled user’s email address in Jamf, which must match the employee’s Softbooq account email.

​
Compliance dashboard

After sync, the IT & Helpdesk module’s Compliance section shows:
  • Total enrolled devices split by Compliant / Non-Compliant / Unknown
  • A per-employee view of which devices are compliant
  • A filterable list of non-compliant devices with the policy failure reason (from Intune) or category (from Jamf)
Non-compliant devices surface as a soft alert on the employee’s HR record, visible to HR Admins and IT Admins.

​
Onboarding and offboarding

When a new employee is provisioned via Admin Sync, Softbooq checks for devices enrolled under their email in both Intune and Jamf. If a device is found, it is attached to their IT Assets record and the onboarding checklist item Device assigned is marked complete automatically. On offboarding (employee deactivated via Admin Sync or manually), their devices are marked Pending return in IT Assets. Softbooq does not trigger remote wipe or MDM unenrollment — those actions must be performed in your MDM console.

​
Disconnect

1

Open Settings → Integrations → Device Management → [Intune or Jamf] → Disconnect

2

Confirm

Sync stops. Existing device records remain in IT & Helpdesk as static records.

​
Troubleshooting

Matching uses the email on the device’s enrolled user account in Intune or Jamf. If the device is enrolled under a different email than the employee’s Softbooq account email, no match occurs. Update the enrolled user in your MDM console or update the employee’s email in Softbooq to align them, then re-sync.
Intune requires the Device.Read.All scope, which is a separate consent from the basic Microsoft 365 directory scopes. Reconnect Microsoft 365 under Admin Sync and approve the updated permissions on the Microsoft consent screen.
Jamf API client secrets can be rotated or expired. In Jamf Pro under Settings → API Roles and Clients, generate new credentials for the Softbooq API role, then update them in Softbooq under Settings → Integrations → Device Management → Jamf → Update credentials.
Unknown means the device is enrolled but has not yet reported a compliance state. This is normal for newly enrolled devices — Intune compliance checks can take up to 24 hours for the first result. For Jamf, Unknown means the device is not in a managed compliance policy.

​
See also

IT & Helpdesk

The module where device records, tickets and compliance data live.

Admin Sync

Directory provisioning. Intune shares its OAuth token with the Microsoft 365 Admin Sync connection.

HR

Device assignment and offboarding status surface on the employee’s HR record.