| + | Fleet | +Jamf Pro | +
|---|---|---|
| macOS management | +Yes — Full MDM lifecycle | +Yes — 20+ year track record | +
| iOS / iPadOS management | +Yes | +Yes | +
| Windows management | +Yes | +No | +
| Linux management | +Yes — Native osquery agent | +No | +
| Android management | +Yes | +Yes — Partner developed solution | +
| Chromebook management | +Yes | +No | +
| tvOS / visionOS management | +No | +Yes | +
| Device scoping & targeting | +Yes — Dynamic labels, Manual labels, and Host vitals labels | +Yes — Smart Groups + Static Groups | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| Zero-touch deployment (ABM/ASM) | +Yes — ABM/ASM + Autopilot | +Yes — ABM/ASM; deep Apple integration | +
| End-user IdP auth at Setup Assistant | +Yes — SAML SSO during OOBE; local account pre-filled from IdP | +Partial — Platform SSO available but less integrated | +
| Bootstrap apps & scripts during Setup Assistant | +Yes — Configure required apps and scripts before device release | +Partial — PreStage enrollment triggers policies, less granular gating | +
| BYOD enrollment | +Yes — Incl. Android work profiles | +Yes — User-initiated enrollment | +
| MDM migration from another vendor | +Yes — Built-in migration workflow | +Partial — Possible but no built-in migration tool | +
| Identity provider integration at enrollment | +Yes — Okta, Entra, Azure AD, etc. | +Yes — Platform SSO; Simplified Setup | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| SAML SSO for admin console | +Yes — SP- and IdP-initiated flows | +Yes — SSO for Jamf Pro console | +
| SCIM user provisioning & attribute sync | +Yes — Provision/deprovision via SCIM with attribute sync | +Partial — Limited SCIM; primarily manual user management | +
| IdP user-to-host mapping | +Yes — Sync IdP user attributes to hosts via SCIM | +Partial — Manual or LDAP-based; no automatic mapping | +
| Role-based access control (RBAC) | +Yes | +Yes | +
| SCEP certificate deployment (e.g., Okta Verify + FastPass) | +Yes — Deploy SCEP cert profiles for device trust | +Yes — SCEP via AD CS or third-party CA | +
| Conditional access integration (IdP policy-based block) | +Yes — Policy failures trigger IdP conditional access blocks | +Partial — Requires Jamf Connect or third-party integration | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| Configuration profile delivery with full confirmation | +Yes — Upload custom profiles | +No | +
| Declarative Device Management (DDM) | +Yes | +Partial — Blueprints framework (Jamf Cloud) | +
| Enforce disk encryption (FileVault/BitLocker) | +Yes — Mac + Windows | +Yes — Mac only (FileVault) | +
| Disk encryption key escrow and recovery | +Yes — Keys escrowed in Fleet, retrievable via host details | +Yes — FileVault key escrow in Jamf Pro, retrievable by admin | +
| Enforce OS updates | +Yes — Mac, iOS, Windows | +Yes — Mac, iOS; managed software updates | +
| OS update ring groups (canary/staged rollout) | +Yes — Fleets for Ring 0 and Ring 1 with DDM enforcement | +Partial — Smart Groups approximate rings, no built-in concept | +
| Device scoping & targeting | +Yes — Labels (dynamic via osquery) + fleets | +Yes — Smart Groups + Static Groups | +
| Local admin account creation and password escrow | +Yes — Script-based, credentials retrievable | +Partial — Requires Jamf Connect, not built into Pro | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| App deployment | +Yes — Fleet-maintained apps + custom packages | +Yes — App Catalog + custom packages | +
| Self-service app installation | +Yes | +Yes — Self Service+ (recently enhanced) | +
| Volume Purchase Program (VPP / Apps & Books) | +Yes | +Yes | +
| Patch management | +Yes — Vulnerability-driven; cross-platform | +Yes — App Installers; macOS & iOS focused | +
| Pre/post-install scripts for app deployment | +Yes | +Yes | +
| App install/uninstall/reinstall from admin UI | +Yes — Per-host from host details | +Yes — Via device management actions | +
| Script execution | +Yes — Cross-platform (Mac, Win, Linux) | +Yes — Mac scripts; Bash, Python, etc. | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| Vulnerability detection (CVEs) | +Yes — Built-in; CISA KEV; cross-platform | +Partial — Basic in Pro; deep scanning requires Jamf Protect ($) | +
| Compliance benchmarks (CIS / STIG) | +Yes — CIS queries publicly available | +Yes — Compliance Benchmarks (mSCP) in Pro | +
| Compliance policy dashboard (per-host pass/fail) | +Yes — Per-host pass/fail on Policies page | +Partial — Smart Groups imply compliance, no unified dashboard | +
| Endpoint detection / threat monitoring | +Yes (built-in) | +Partial — Requires Jamf Protect (separate purchase) | +
| File integrity monitoring (FIM) | +Yes - evented tables (built-in) | +Partial — Requires Jamf Protect | +
| SIEM integration | +Yes — Custom log destinations; included | +Yes — Pro event logs; richer with Protect ($) | +
| Lock / wipe commands | +Yes | +Yes | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| Real-time device queries | +Yes - Live queries | +Partial — Inventory on check-in schedule | +
| Hardware & software inventory | +Yes — Extensive | +Yes — Comprehensive Apple inventory | +
| Application inventory and patch status view | +Yes — Per-host and fleet-wide; flags hosts below target version | +Yes — App inventory; patch status via App Installers | +
| Custom data collection | +Yes — Custom SQL queries across 300+ tables (built-in) | +Partial — Extension attributes (scripts) | +
| Offline device alerting (webhooks) | +Yes — Configurable offline threshold, alerts fire automatically | +Partial — Webhook notifications available, less granular thresholds | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| Policy-triggered auto-remediation | +Yes — Attach remediation script to policy, auto-executes on failure | +Partial — Smart Groups trigger policies, no direct policy→script link | +
| On-demand script execution from admin UI | +Yes — Per-host from host details, real-time output | +Yes — Remote commands available for macOS | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| User deprovisioning via IdP (SCIM) | +Yes — SCIM removes host-user mapping and revokes access | +Partial — Manual user deletion, limited IdP-driven deprovisioning | +
| Device re-assignment between users/teams | +Yes — Transfer device to new fleet, profiles auto-applied | +Yes — Move between sites/groups, profiles re-applied | +
| End-user transparency | +Yes — Scope transparency; open source | +Partial — Limited native transparency features | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| GitOps / infrastructure as code | +Yes — First-class; YAML/Git-based | +Partial — IBM Terraform-based, not all functionality available | +
| API-first architecture | +Yes — Unified REST API; all features | +Partial — Multiple APIs; GUI-first design | +
| Self-hosted deployment | +Yes — On-prem, cloud, air-gapped | +Partial — functionality not as complete as cloud | +
| Managed cloud hosting (SaaS) | +Yes | +Yes — Jamf Cloud | +
| Open-source / source-available code | +Yes — 100% on GitHub | +No — Proprietary | +
| Audit logging | +Yes | +Yes | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| Free tier available | +Yes — Core features; unlimited hosts | +No — 14-day free trial only | +
| Pricing model | +$7/host/month (Premium); all features included | +~$3.67–$7.89/device/month; varies by device type | +
| All-inclusive security (vuln, EDR, FIM) | +Yes — Single license covers everything | +No — Protect, Connect, ETP sold separately | +
| + | Fleet | +Jamf Pro | +
|---|---|---|
| Vendor support channels | +Email, phone, video (Premium); community Slack | +Chat, email, phone; premium services available | +
| Community & ecosystem maturity | +Growing — Active open-source communities & ecosystems | +Mature — Large user base; Jamf Nation; 20+ years | +
| Apple relationship & day-zero OS support | +Yes — Apple-oriented; tracks releases | +Yes — Close Apple partnership; historically day-zero | +