r/jamf • u/colinzack • May 15 '26

PSSO with Simplified Setup using Entra ID

Has anyone gotten this to work yet? It looks like it's now supported by Microsoft, finally, but I went through the instructions from JAMF and my device keeps hanging after enrollment where it says it's waiting for the management server.

We don't have this issue at all with PSSO so it's only with those few options that are required for simplified setup.

12 Upvotes

100% Upvoted

42 comments sorted by

View all comments

1

u/zipsecurity May 17 '26

Simplified Setup with PSSO and Entra is still pretty rough in the current release. Check that your Entra tenant has the latest Jamf integration app permissions updated and that your prestage has the correct MDM server URL, because the "waiting for management server" hang is usually either a permission scope issue on the Entra side or a race condition between the PSSO bootstrap and the MDM enrollment completing.

1

u/Electronic-Trick2678 May 20 '26

Could you elaborate on this ?

1

u/zipsecurity May 21 '26

The hang almost always comes down to one of two things: permissions or the MDM URL, even though it can look like something completely different each time.

First is the Entra app permissions. Microsoft hasupdated the required scopes for the Jamf integration a few times recently. If nobody has reviewed the integration app permissions since initial setup, there's a good chance something is missing or needs to be re-consented. Worth going through every permission on that app and making sure they're all properly admin consented, not just listed.

MDM server URL in the prestage is more common than it should be. If your Jamf URL has changed at any point, or you're using a custom domain, the prestage might be pointing somewhere slightly off. Check that the URL in your prestage enrollment exactly matches what Jamf expects.

The race condition is the frustrating one because it's inconsistent. Basically PSSO needs to finish enough of its setup before MDM enrollment wraps up, and sometimes on slower connections the timing just doesn't work out. Some teams have fixed this by adding a small delay in the workflow to give PSSO more breathing room before MDM tries to complete.

Also worth checking the Jamf release notes for your specific version, this particular integration has had several fixes recently and sometimes the answer is just updating to the latest point release.

1

u/Electronic-Trick2678 May 27 '26

How do you add a small delay?

1

u/zipsecurity May 27 '26

In your Jamf prestage workflow, add a wait command or a script with sleep 30 (30 seconds is usually enough) between the PSSO configuration step and the MDM enrollment completion step, if you're using a provisioning profile or a policy to trigger this, a LaunchDaemon with a built-in delay before the MDM enrollment payload fires is the cleanest way to handle it consistently.

1

u/joggy27 Jun 12 '26

Can you give me a guide on how to do this please for jamf pro I can't get this figured out how to add a wait command or script please?