Deploying a Script to Migrate Users from Conditional Access to Device Compliance

This workflow allows end users to run a migration script from Self Service. Because this workflow requires end users to enter their credentials, the migration script must be run on computers while the end user is logged in. Deploying the policy via Self Service ensures that this condition is always met.

Note:

If your environment requires a migration workflow that does not rely on user interaction via Self Service, contact Jamf Support to discuss alternate options.

In Jamf Pro, click Settings in the sidebar.
In the Computer management section, click Scripts .
Click New .
On the General pane, enter a name for the script in the Display Name field.
Example: Device compliance migration script

On the Script pane, add the following script to the script editor:

#!/bin/bash
# copyright 2024, JAMF Software, LLC
# THE SOFTWARE IS PROVIDED "AS-IS," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.
# IN NO EVENT SHALL JAMF SOFTWARE, LLC OR ANY OF ITS AFFILIATES BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OF OR OTHER DEALINGS IN THE SOFTWARE, 
# INCLUDING BUT NOT LIMITED TO DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES AND OTHER DAMAGES SUCH AS LOSS OF USE, PROFITS, SAVINGS, TIME OR DATA, BUSINESS INTERRUPTION, OR PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES.
#get logged in user
loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )
#get user home directory
userHome=$(dscl . read "/Users/$loggedInUser" NFSHomeDirectory | awk -F ' ' '{print $2}')
#Check if wpj key is present
WPJKey=$(su -l $loggedInUser -c "/usr/bin/security dump $userHome/Library/Keychains/login.keychain-db | grep MS-ORGANIZATION-ACCESS")
if [ ! -z "$WPJKey" ]
    then
    #run gatherAADInfo
    su -l $loggedInUser -c "/Library/Application\ Support/JAMF/Jamf.app/Contents/MacOS/Jamf\ Conditional\ Access.app/Contents/MacOS/Jamf\ Conditional\ Access gatherAADInfo"
    exit 0
fi
echo "no WPJ key found"
exit 1

Click Save .
In Jamf Pro, click Computers in the sidebar.
Click Policies in the sidebar.
Click New .
In the General payload, ensure that no triggers are selected.
Click the Scope tab.
Scope the policy to the group in Jamf Pro you created as the Applicable Group earlier in the Configuring the Microsoft Entra Integration section of this guide.
Click Save .

The script is made available in the Self Service app on scoped computers. Notify the end users of the target computers that they must run the policy from Self Service.