If you already pay for Microsoft 365 Business Premium, Intune manages your Macs at no extra cost. Jamf Pro or Kandji cost roughly £3–£8 per Mac per month on top. Whether that money is worth it depends on five questions, and for most businesses under 500 people the answer is clearer than the vendors make it sound.
The short version
| Your situation | Our recommendation |
|---|---|
| Fewer than 30 Macs, mostly office apps and a browser | Intune. Compliance, FileVault, updates and Conditional Access are all you need. |
| Macs are the primary device for developers, designers or video teams | Jamf Pro or Kandji. You need app patching, scripts and self-service that Intune does poorly on macOS. |
| Mixed estate, IT team of one, no Mac specialist | Kandji. Opinionated defaults, less to maintain than Jamf, still integrates with Entra ID. |
| Regulated or Cyber Essentials Plus in scope | Either, but the evidence pack is easier from Jamf/Kandji because patch state is reported per app. |
| Already running Jamf, wondering whether to consolidate | Keep it unless the licence is the only cost you can cut. Migration effort usually outweighs the saving below 200 Macs. |
The five questions
1. Who patches third-party apps?
Intune can deploy PKG and DMG apps and, since 2025, update a growing catalogue of them, but it still does not patch Chrome, Zoom, Slack, Adobe and the developer toolchain the way Jamf App Installers or Kandji Auto Apps do. If unpatched third-party apps would fail your Cyber Essentials assessment, this question alone decides it.
2. Do you need scripts and self-service?
Jamf and Kandji run shell scripts on a schedule, on enrolment or on demand, and give users a Self Service app. Intune runs scripts too, but with fewer triggers and no user-facing catalogue worth the name. Developer-heavy teams notice this within a week.
3. How do Macs join the company identity?
All three support Apple Business Manager automated enrolment and Platform SSO with Entra ID, so users sign in to the Mac with their Microsoft credentials and get a Conditional Access-compliant device. Intune's advantage is that compliance state flows into Conditional Access natively; Jamf and Kandji do it through the Partner Compliance connector, which works well but is one more thing to configure and one more thing to break.
4. Who runs it day to day?
Intune is one console for Windows, iOS, Android and macOS, so a generalist IT person learns once. Jamf rewards a Mac specialist and punishes a generalist. Kandji sits between the two.
5. What does it actually cost?
For 50 Macs, Jamf Pro is around £2,500–£4,000 a year; Kandji is similar with volume discounts; Intune is £0 on top of Business Premium. Against that, put the hours your team spends on manual Mac patching today — for most 50-Mac estates that is 3–5 hours a week, which at any realistic hourly rate exceeds the licence.
What we deploy either way
- Automated Device Enrollment through Apple Business Manager, so a new Mac is compliant before the user opens the lid.
- FileVault with escrowed recovery keys, firewall on, Gatekeeper enforced, screen lock at 5 minutes.
- Platform SSO with Entra ID and a Conditional Access policy that requires a compliant Mac for Microsoft 365.
- Managed software updates with a deferral window of no more than 14 days.
- A tested wipe-and-reissue procedure, because a leaver's Mac is the most common data-loss event we see.
Not sure which side of the line you fall on? Our Device Management Setup package includes the decision, the build and the handover, whichever platform you land on — and we will tell you if Intune is enough before you buy anything else.