Jamf Pro vs Microsoft Intune vs Iru: A 2026 Apple MDM Comparison for UK Businesses

The Apple MDM market got a lot more interesting in late 2025. Kandji rebranded to Iru on 22 October and turned itself into a six-product unified platform covering identity, endpoint management, EDR, vulnerability management, compliance automation, and a public trust center. They also added Windows and Android, so the "Apple-only" framing for them is gone.

Meanwhile Jamf doubled down on Apple specialism, and Microsoft Intune kept doing what it does best: serving the Microsoft 365 estate and reaching grudging parity on Mac.

If you're choosing an MDM in 2026, this is the landscape. Three platforms with three different bets. Here's what we've seen rolling these out across UK fleets, and what the official documentation and independent reviews say in May 2026.

The 2026 landscape in one paragraph

Jamf is still the Apple gold standard, with the deepest macOS feature support and the cleanest fit for Apple Business Manager workflows. Intune is the default if you live in Microsoft 365 and Entra ID, and Microsoft has explicitly committed to day-zero support for new Apple OS releases. Iru is the wild card: a credible Apple MDM with a much broader stack now wrapped around it, betting that mid-market buyers want one vendor instead of six.

The right answer depends on what your fleet looks like, what identity provider you use, and how much Apple specialism you need.

Iru vs Jamf: which should you choose?

Choose Jamf if Macs are most of your fleet and you want the deepest Apple control available, or if you're working towards Cyber Essentials Plus and want the best-documented route there. Choose Iru if you want Apple device management that's quicker to run day to day, with identity, EDR and compliance evidence from the same vendor.

The deciding factor is how much else you want one vendor to do. Jamf is the deeper Apple tool: more scripting and policy flexibility, the biggest admin community, and the largest bench of UK partners. That depth comes with a steeper learning curve. Iru has the cleaner console and, by reviewers' accounts, smoother patching. It also now manages Windows and Android, while Jamf's device management stays Apple-only.

Iru was called Kandji until October 2025, so older "Kandji vs Jamf" comparisons still hold for the device management side. What they miss is the identity, security and compliance modules Iru has added since.

Neither vendor publishes prices any more, so you'll need a quote from both. Buying direct, Jamf's last published pricing had a 25-device minimum, but there's no minimum when you license Jamf through a Jamf MSP partner such as Stabilise. Iru doesn't publish a minimum, and independent reports put it anywhere from 25 to 100 devices.

Iru vs Intune: which should you choose?

If your business runs on Microsoft 365 and Entra ID and Macs are the minority, choose Intune. If most of your people are on Macs and Microsoft is mainly your email and Office, choose Iru.

Intune wins on cost and Conditional Access. It comes inside Microsoft 365 Business Premium, E3 and E5. From July 2026 Microsoft also moved Intune Plan 2, Remote Help and Advanced Analytics into E3, so plenty of UK businesses already pay for more Intune than they use. Device compliance feeds straight into Entra Conditional Access with nothing extra to wire up.

Iru wins on the Mac experience. Intune manages Macs adequately, but admins consistently report it trails dedicated Apple tools on automation and advanced macOS policy. Iru is built Apple-first and now covers Windows and Android too, so a Mac-majority company with a handful of Windows laptops can run everything from one console.

The catch is identity. Iru's Entra Conditional Access reporting is less documented than Jamf's or Intune's, so if Conditional Access is how you enforce security, test it properly in Iru's 14-day trial before you sign. Microsoft shops with a large Mac fleet more often land on Intune plus Jamf (see the hybrid option below), which keeps Entra in charge and gives the Macs proper depth.

Pricing in 2026

As of October 2026, Microsoft is the only one of the three publishing UK list prices. Jamf removed per-device prices from its pricing page in the first half of 2026, and Iru has always been quote-only.

Intune is bundled into Business Premium, E3 and E5, so a lot of organisations already have it in their licensing without realising. Since July 2026, E3 also includes Intune Plan 2, Remote Help and Advanced Analytics, and E5 adds Endpoint Privilege Management, Cloud PKI and Enterprise App Management. Microsoft's UK page no longer lists standalone prices for Plan 2 or the Intune Suite. Iru quotes scale with the modules you pick and your number of users and devices, contracts are annual, and onboarding and migration support are included free.

The headline that matters: if you're already on Microsoft 365 Business Premium or E3/E5, Intune is effectively free. If you're not, Jamf and Iru both need a sales conversation now, so get them quoted for the same device count and the same modules before you compare. We've published a full Mac vs Windows TCO breakdown for UK SMEs if you want to see how MDM costs fit into the wider device economics.

Apple feature depth

This is where the platforms diverge most. Below is what the official documentation says as of May 2026, with our annotations on what matters in practice.

Reading this matrix: Jamf wins on the Apple-first fundamentals where you'd expect it to (DDM, ABM workflows, macOS 26 setup). Intune wins on the boring but important operational stuff (FileVault key management, day-zero OS support). Iru has surprising strength on Activation Lock workflows but thinner public documentation on federation and day-one OS support, which is a gap if you care about audit trails.

Intune's day-zero commitment is genuinely useful. Microsoft now publicly commits to supporting the new MDM payloads that Apple ships at WWDC on the day macOS or iOS hits general release. Jamf gets there too, but historically it's been a release-by-release scramble for everyone.

Iru's expanded platform: bundle play or category killer?

This is the question that defines whether Iru is a serious option or a packaging exercise.

Iru's six modules are Workforce Identity, Endpoint Management, EDR, Vulnerability Management, Compliance Automation, and a Trust Center. Looking at each one against the standalone leader:

• Workforce Identity vs Okta. Competitive for Apple-first and lean teams, but not a serious Okta replacement at scale. Okta still owns the identity category in analyst coverage and large-enterprise buying patterns.
• Endpoint Management vs Jamf and Intune. This is Iru's strongest module by far. It inherits the Kandji foundation, which reviewers consistently praise for clean admin UX and smooth patching. It's now cross-platform, which Jamf is not.
• EDR vs CrowdStrike. This is the weakest claim in the bundle. CrowdStrike has analyst depth, breach forensics, and threat intelligence that Iru's launch coverage doesn't match.
• Vulnerability Management vs Tenable. Adjacency play. Useful inside the Iru console, not best-of-breed.
• Compliance Automation vs Drata. Helpful for lean teams, but Drata's framework support and audit-evidence depth are still ahead.
• Trust Center vs Drata/Vanta-style portals. This is more a sales-enablement layer than a governance platform. Useful for security questionnaire response, not a substitute for proper GRC.

The buyer takeaway: Iru is genuinely strong if your priority is Apple endpoint management plus some identity and compliance automation in one console. It's a less convincing replacement if you already rely on CrowdStrike, Okta, Tenable, or Drata for serious enterprise workflows. Treat the bundle as a consolidation play, not a category sweep.

Identity and Conditional Access

If your organisation uses Microsoft Entra ID (and most UK SMEs do), this section probably matters more than the feature matrix.

Microsoft Intune is the deepest Entra integration by definition. Conditional Access is a native Entra capability, and Intune feeds device compliance and app protection signals straight into it. Platform SSO, FileVault escrow, app-based Conditional Access, and the Enterprise SSO plug-in for iOS all sit in the same stack. Nothing else competes on this ground.

Jamf Pro has the deepest Entra integration outside Intune itself. Jamf can look up users and groups via Entra Graph, map group membership to roles, configure an Entra SSO app, and report Mac device compliance back to Entra so Conditional Access policies evaluate Macs correctly. That last bit is what makes Jamf a credible Apple companion to an Entra-native security model.

Iru supports SSO and SAML connections to Entra, Okta, and Google Workspace, plus its own Passport tool for Mac identity. Multi-IdP flexibility is genuinely there. What we couldn't verify in vendor docs is the depth of SCIM provisioning or Entra-specific Conditional Access reporting, which makes it harder to assess for organisations with strict identity governance requirements.

For most UK businesses we work with, the practical answer is: if you're Microsoft 365 first, run Intune for everything you can and Jamf for the Mac depth that Intune lacks. We covered the wider identity question in our identity management platform comparison, and the conclusion there hasn't changed.

What admins complain about

Independent reviews on G2, Capterra, Reddit r/macsysadmin, and Gartner Peer Insights from 2025 to early 2026 are remarkably consistent.

Jamf Pro. Steep learning curve, especially for admins who don't already know Mac management deeply. UI inconsistency. Complaints about cost and segmentation across the product line. Some reviewers report support quality has slipped over the last two years. The product is powerful, but it's not simple and it's not cheap.

Microsoft Intune. Still feels behind dedicated Mac tools for Apple workflows. Macadmins on Reddit regularly mention gaps around macOS automation, slower handling of advanced Mac policies, and awkward configuration profile behaviour at scale. The platform is broad rather than deep. Reviewers describe it as "good enough" for mixed fleets but rarely as elegant.

Iru. Pricing complaints dominate. The device minimum, which some independent analysts put at 100, is a barrier for smaller organisations, and renewal price increases are a recurring trigger for churn. Some reviewers also note that the newer modules (identity, EDR, compliance) feel less mature than standalone leaders, which echoes our own bundle analysis above.

The cross-cutting theme: each product is excellent at its core competence and starts to creak when you push it outside that core. Jamf for Apple depth. Intune for Microsoft estate management. Iru for clean Apple endpoint management with consolidation upside.

UK fit and Cyber Essentials Plus

This is the bit our Cyber Essentials Plus clients ask us about most.

Jamf has the best-documented Cyber Essentials Plus story. Their 2025 guidance maps Jamf Pro directly to the controls the NCSC requires, including patch management, configuration baselines, and policy enforcement. We've taken several clients through CE+ on Jamf, and the audit trail comes together with very little custom work. The UK partner ecosystem (CDW, We Are Sync, XMA, Jigsaw24, ourselves) is also the deepest of the three platforms, which matters when you need expertise on call.

Intune is a strong fit for Microsoft 365-centric UK SMEs. Conditional Access logs, compliance policies, and Entra integration give you mature audit trails out of the box. We use it heavily for clients whose estate is already Microsoft-first. The Apple side of Intune is the weak point, not the compliance side.

Iru is capable on paper, but UK-specific case studies and documented Cyber Essentials Plus mappings are thinner. The Trust Center and compliance automation modules might help with evidence collection, but we'd treat Iru as promising rather than proven for UK certification workflows. If you're going for CE+ this year, that matters.

How to choose

The decision framework we use with clients in 2026:

Pick Jamf Pro if:

• Your fleet is more than 60% Apple
• You care about Cyber Essentials Plus, ISO 27001, or other UK certifications with Apple-specific audit requirements
• You're in creative, film, agency, or finance and need deep Mac admin capability
• You have or are willing to develop Apple MDM expertise (or work with a partner who has it)

Pick Microsoft Intune if:

• You're already on Microsoft 365 Business Premium or E3/E5
• Your fleet is mixed Windows and Mac, with Mac as the minority
• Your security operations live in Defender and Entra
• Cost efficiency matters more than Apple specialism

Pick Iru if:

• You're an Apple-first or Apple-heavy organisation between 100 and 1,000 devices
• You want to consolidate endpoint management, identity, and compliance into one vendor
• You're comfortable with quote-only pricing and a minimum that may be as high as 100 devices
• You're not already locked into best-of-breed tools for EDR, IAM, or GRC that you'd need to displace

Run a hybrid (Jamf plus Intune) if:

• You have both significant Mac and significant Windows fleets
• You need Apple depth from Jamf and Conditional Access governance from Intune
• You can absorb the cost of two MDM stacks in exchange for best-in-class on each side

The hybrid pattern is increasingly common with our enterprise clients. Jamf manages the Macs at depth, and the device compliance signal gets reported into Entra so Conditional Access policies enforce correctly across both platforms.

How we help our clients choose

Full disclosure up front: we're a Jamf Silver Partner and our engineers hold JAMF 300 certifications, which is Jamf's senior admin qualification. That's why we have the deepest hands-on time with Jamf, and the strongest opinions about it. It's also why we know exactly where it isn't the right fit. We deploy and run all three platforms in production across UK clients in film, creative, finance, and architecture, so the recommendation we give isn't theoretical.

The question we walk clients through is always the same:

1. What does your device fleet look like in five years, not today?
2. Which identity provider runs your business?
3. Are you going for any UK certifications in the next 18 months?
4. What's already in your Microsoft 365 licensing?
5. How much Apple-specific admin capability do you have in-house?

Whichever way the answers point, we'll deploy and run it. If you want to talk through which platform fits your business, book a free audit and we'll work through it together.