Jamf vs. Intune vs. Kandji (Now Iru) for CMMC Mac Fleets

Your MDM decision is the stickiest one in a Mac compliance program. A Mac enrolls in exactly one MDM at a time, switching means re-enrollment and rebuilding every profile, baseline, and evidence pipeline, and your assessor will read the choice through two lenses at once: can it enforce the controls, and what is this cloud service’s place in my assessment scope? Here is the honest comparison as of July 2026, including the fact most 2024-era comparisons miss: Kandji rebranded to Iru in late 2025.

Government-cloud posture, because your assessor will ask

Intune is the only one of the three that lives inside a FedRAMP-authorized boundary today: Microsoft 365 GCC High carries FedRAMP High authorization on the FedRAMP Marketplace, with IL4/IL5 instances for DoD, and Intune for US Government manages macOS with essentially the commercial feature set (the gaps Microsoft documents are mostly Windows-side, though Intune Suite add-ons lag in GCC High).

Jamf holds no FedRAMP authorization. Its public posture is SOC 2, ISO 27001, and StateRAMP Authorized (January 2025), and in December 2025 Jamf announced a partnership with UberEther to deliver Jamf inside an existing FedRAMP High / IL5 boundary. No completion date has been published, so treat any specific quarter you hear as rumor and check the Marketplace before you write it into a vendor risk assessment.

Kandji/Iru has no FedRAMP authorization and no announced pursuit; its posture is SOC 2 Type 2 on commercial multi-tenant cloud.

Here is the part most comparisons soften, so let us not: as of mid-2026, no cloud-hosted Mac-first MDM holds FedRAMP authorization. If your Macs are CUI assets, hanging their control plane on a non-FedRAMP cloud rests entirely on a scoping argument, under 32 CFR 170.4, that the MDM is a Security Protection Asset handling only Security Protection Data (configs, inventory, escrowed recovery keys) rather than a CUI-handling cloud subject to the DFARS 7012 FedRAMP floor. That argument has a textual basis, and some assessors accept it. Others look at a console that can push profiles, scripts, and recovery-key access to every CUI endpoint and conclude that is too much control to sit in an unauthorized cloud, and you will not know which assessor you drew until it matters. Only two architectures avoid the argument entirely: self-hosted Jamf Pro running inside your own assessment boundary, where the MDM is assessed directly as your system and there is no cloud question to argue, and Intune inside GCC High’s FedRAMP High boundary. And one route does not work: recategorizing CUI-touching Macs as Contractor Risk Managed Assets to soften the MDM question. CRMA status belongs to assets that can but are not intended to process CUI; if your Macs process CUI, they are CUI assets, and scoping paperwork does not change what the assessor observes them doing.

What each one actually does for 800-171 work

All three stand on the same foundation: Apple Business Manager plus supervised Automated Device Enrollment. That part of the work is identical whichever console you pick.

How small DIB shops should actually decide

If you already run a GCC High tenant, Intune is the path of least resistance: it is inside the authorized boundary, it is probably already licensed, and the assessment conversation about your MDM becomes boring, which is the goal. The cost is Mac-native depth; you will maintain mSCP profiles yourself and occasionally discover a Mac feature that arrives in commercial Intune first.

If Mac administration is your competence center and you want the strongest hardening-and-evidence tooling, Jamf is the deepest option, and it is the only one of the three that can run inside your assessment boundary: self-hosted Jamf Pro on your own infrastructure is the clean, argument-free answer for CUI-asset Macs today. Jamf Cloud remains the contested-argument route until a FedRAMP-authorized boundary actually ships; treat the UberEther partnership as a roadmap, not a status. If you are a one-person IT shop that needs automation to stay compliant at all, Iru’s one-click baselines and remediation are genuinely compelling, with the weakest government-market posture of the three and no self-hosted option, so there is no boundary-internal escape hatch; budget extra care for the contested ESP writeup in your SSP, or keep Iru-managed Macs out of CUI scope.

Plan for stickiness

Whatever you choose, choose like it is permanent. Migration means re-enrollment (only macOS 26 adds a managed migration flow without erasing), FileVault key rotation, and rebuilding baselines, groups, and evidence exports, all of which lands in your change-management and SCRM paperwork. Run the vendor-risk analysis once, properly, before enrollment number one; our vendor risk and shared-responsibility workbooks exist for exactly this decision.

Educational content, not an endorsement; vendor capabilities and authorizations change. Statuses cited were verified against the FedRAMP Marketplace and vendor documentation in July 2026.