[email protected]
DEEN

Deploying NetBird via MDM: Intune, Jamf and GPO with Managed Policies

Timo WevelsiepTimo Wevelsiep
  • #NetBird
  • #MDM
  • #Intune
  • #Jamf
  • #ZeroTrust
Deploying NetBird via MDM: Intune, Jamf and GPO with Managed Policies

Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.

Rolling out NetBird to company devices without users bending the settings? We plan rollout, policies and licensing and can operate NetBird for you - see the Secure Access Flatrate with Managed NetBird from €349.90 net per month (base package with monitoring, updates, backups and support) and our NetBird expertise, or book an initial consultation.

Since summer 2026, NetBird can be managed through your existing MDM like any other business software. With client version 0.73.0 from 18 June 2026, NetBird added support for MDM configuration profiles via the Windows registry and macOS plists (NetBird v0.73.0). The new desktop app from version 0.75 is explicitly built to be deployed and managed "through whatever MDM platform your organization already uses" (NetBird v0.75).

This post shows what the feature does, how the rollout works with Intune, Jamf or Group Policy, and where its limits are. It separates two things that are often mixed up: managed client settings and compliance gating. As of October 2026.

Table of contents

Two features you need to keep apart

Managed client settings Compliance gating
Question How is the client configured? May this device join the network?
Where it acts On the endpoint In NetBird's management
Since Client 0.73.0 (June 2026) Available before this release
Connection Any MDM via registry, profile or app configuration API matching with Intune, CrowdStrike, SentinelOne, Huntress, FleetDM
Platforms Windows, macOS, iOS, tvOS With Intune only Windows and macOS
Licence No plan restriction documented Cloud Business or self-hosted Enterprise licence

The 2026 change is the left column. Gating existed before, but it is often the reason companies search for "NetBird Intune". The two complement each other: the MDM makes sure the client is configured correctly, gating makes sure only compliant devices get access.

What MDM policies do technically

The MDM writes values to a location protected by the operating system. The client reads them, applies them last and therefore above every other setting, and locks the affected options so nobody on the device can change them (NetBird, MDM integration).

NetBird adds no agent of its own. The mechanism belongs to the operating system: any MDM that can write a registry value on Windows, push a configuration profile on macOS or send an app configuration on iOS works. The documentation names Microsoft Intune, Jamf Pro, Kandji, Mosyle, Workspace ONE, JumpCloud, Group Policy and Apple Configurator 2.

Behaviour in detail:

  • Precedence: the policy is applied last. A change request that touches a pinned value is rejected as a whole.
  • Refresh: on Windows and macOS the client reloads the policy every minute.
  • Interface: pinned options are hidden, not greyed out. The user sees the notice "Your NetBird configuration was updated by your IT policy."
  • Verification: netbird debug config shows in the mDMManagedFields field which settings are pinned.
  • Minimum version: client 0.73.0; older versions ignore managed policies entirely (NetBird, GPO deployment).

Windows, macOS and iOS at a glance

Platform Policy location Distribution Notes
Windows Registry HKLM\Software\Policies\NetBird ADMX/ADML templates for GPO; Intune via the same ADMX or OMA-URI Always include the port in the management URL, e.g. https://api.example.com:443
macOS Preference domain io.netbird.client in /Library/Managed Preferences/ Template netbird-macos.mobileconfig, bare plist for Jamf Pro, script for JumpCloud Without MDM enrolment, macOS clears /Library/Managed Preferences/ at every boot
iOS / tvOS Managed App Configuration for io.netbird.app / io.netbird.app.tv Via the MDM as app configuration A policy only takes effect the next time the app is opened; on tvOS only the app is managed, not the tunnel
Linux No MDM channel Configuration management such as Ansible or Puppet -
Android No documented MDM integration - Policy bridge in the SDK since 0.79.0, shipping not described

Sources: macOS policy, iOS policy, MDM rollout, NetBird v0.79.0.

A sensible baseline policy

NetBird documents 23 manageable keys. For most companies a small set is enough to pin the client to your own instance and lock the options users should not change:

Key Effect Recommendation
managementURL Sets which NetBird instance the client connects to Always set, especially when self-hosting
disableProfiles Prevents custom profiles and thus connections to other instances Set
disableUpdateSettings Locks the update settings in the client Set if updates run through the MDM
disableAutostart Controls launch at login; enforced on every app launch since 0.75 As needed
disableAutoConnect Controls automatic connection As needed
blockInbound Blocks inbound connections to the device Set for laptops
allowServerSSH Allows the built-in SSH server Disable on client devices
rosenpassEnabled Post-quantum key exchange Per security concept

According to the documentation, three keys have no effect yet: splitTunnelMode, splitTunnelApps and disableMetricsCollection. Version 0.78.0 also made remote jobs such as a remote debug bundle require an explicit opt-in, which can be set via MDM as well (NetBird v0.78.0).

The rollout in four jobs

NetBird recommends splitting the rollout into four jobs, each with one clear owner (NetBird, MDM rollout):

  1. Install via the MDM. On Windows as a Win32 app (.intunewin) or MSI, from Windows 10 22H2 (Intune guide). Important: the EXE and MSI installers do not detect each other. Pick one format.
  2. One SSO sign-in per user. Devices sign in through the identity provider. According to NetBird, setup keys are meant for servers, not laptops.
  3. Settings via policy. The baseline policy from the previous section, distributed via ADMX, configuration profile or app configuration.
  4. One owner for updates. Either the MDM or the client itself, not both. If updates run through the MDM, lock the update settings in the client.

Since version 0.75.0 the installer no longer creates a machine-wide autostart entry for the interface. If you want to control launch at login centrally, do it via the policy.

The limits stated plainly

The feature is a big step for managed environments, but not a full forced tunnel. The documentation says so clearly:

  • No forced tunnel. The policy pins the configuration, not the connection state. Users can disconnect with netbird down or the Disconnect button.
  • Local administrators stay powerful. Anyone with administrator rights on the device can stop the service, uninstall the client or edit the registry. Without removing admin rights, the policy is a configuration default, not a lock.
  • Linux and Android are missing. There is no MDM channel for Linux and no documented integration for Android yet.
  • iOS with a delay. A policy that arrives while the app is closed only takes effect the next time it is opened.
  • Client security level. The client daemon vulnerability GHSA-qcpp-8vwj-hhwr (CVSS 8.8) affected versions up to 0.75.1. When rolling out via MDM, distribute at least 0.76.0.

Compliance gating with Intune and EDR

Separately from policies, NetBird can tie access to the status in the MDM or EDR. NetBird matches the list of managed devices via API and blocks access if the agent is missing or the device is not compliant (NetBird, EDR and MDM integrations). This applies only to the selected groups.

Supported are CrowdStrike Falcon, FleetDM, Huntress, Microsoft Intune and SentinelOne Singularity. For Intune, fixed rules apply (NetBird, Intune integration):

Rule Value
Required Graph permission DeviceManagementManagedDevices.Read.All
Accepted state Compliant or InGracePeriod
Last sync with Intune within the last 24 hours
Platforms Windows and macOS only; Linux, iOS and Android are excluded
Licence NetBird Cloud Business or self-hosted Enterprise licence

In NetBird Cloud, the Business plan costs 12 euros per user per month and, according to the pricing page, includes the MDM and EDR device controls (netbird.io/pricing). When self-hosting, neither the free Community Edition nor the Commercial Starter is enough; the Enterprise licence is required. Our post on the NetBird self-hosting licence explains how the editions differ.

Independently of gating there are the built-in posture checks, for example for client version, country, network range, operating system or running processes (NetBird, posture checks). They need no MDM and already cover many requirements.

How it compares with Tailscale and Cloudflare

NetBird Tailscale Cloudflare WARP
Client settings via MDM Windows, macOS, iOS, tvOS Windows, macOS, iOS, tvOS, Android Windows, macOS, Linux, iOS, Android
Lockable tunnel No Yes (AlwaysOn.Enabled) Yes (switch_locked)
Plan for MDM settings No restriction documented Standard and up Not checked
Gating via MDM/EDR Intune, CrowdStrike, SentinelOne, Huntress, FleetDM Device posture with integrations Including CrowdStrike, Microsoft Endpoint Manager, SentinelOne, Workspace ONE
Self-hosting Yes No (only via Headscale) No

Sources: Tailscale MDM keys, Tailscale device posture, Cloudflare WARP MDM deployment, Cloudflare service providers.

NetBird's advantage is the combination of self-hostable management, an open client and MDM policies without a documented plan barrier. The drawback is the missing forced tunnel. If you strictly need it, check this before choosing. Our mesh VPN comparison 2026 offers a broader view.

Our approach at WZ-IT

As an official NetBird reseller, we roll out NetBird so it fits your existing device management:

  1. Assess the estate: which MDM, which platforms, which identity provider, whether local admin rights are removed.
  2. Choose the licence: Community, Commercial Starter, Enterprise or a cloud plan, depending on whether compliance gating is needed.
  3. Build the baseline policy: management URL, locked profiles, update path, inbound connections, SSH, tested on one device per platform.
  4. Roll out in waves: pilot group, then departments, verified with netbird debug config and the device lists in the management.
  5. Operate: updates, policy maintenance and monitoring as part of the Secure Access Flatrate or within our NetBird expertise.

Further guides

Want NetBird on every company device, cleanly? We plan the MDM policy, licence and rollout with you and can take over ongoing operations. Book an initial consultation or see the Secure Access Flatrate.

Sources

Timo Wevelsiep

Written by

Timo Wevelsiep

Co-Founder & CEO

Co-Founder of WZ-IT. Specialized in cloud infrastructure, open-source platforms and managed services for SMEs and enterprise clients worldwide.

LinkedIn

Frequently Asked Questions

Answers to important questions about this topic

Companies worldwide trust WZ-IT

  • Stadtwerke Brühl
  • DGHO e.V.
  • ABCO Water Systems
  • Golem.de
  • EVADXB
  • nextGYM
  • AInergy
  • ml&s
  • Odiseo Solutions
  • Annota
  • ARGE
  • SweetConnect GmbH
  • Aphy AG
  • CORGOS
  • Rekorder
  • SolidProof
  • Yonju
  • Keymate
  • Paritel
  • Mr. Clipart
  • Millenium
  • Negosh
  • Führerscheinmacher
  • Boese VA
Read client reviews

Free intro call

Let's talk about your project - honest and no strings attached

  • Straight with Timo and Robin - no sales team, no pitch
  • An honest take, including when we are not the right fit
  • Concrete next steps for infrastructure, software or AI

No risk: worst case, you leave with a clearer understanding of your project than before.

WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
Email[email protected]Phone+49 2922 875068
Timo and Robin, founders of WZ-IT

Let's Talk About Your Idea

Whether a specific IT challenge or just an idea - we look forward to the exchange. In a brief conversation, we'll evaluate together if and how your project fits with WZ-IT.

1 / 3 · Topic Selection

What is your inquiry about?

First select the service area that best matches your project.

WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH