Reporting the UPN on macOS

Collector reports the User Principal Name (UPN) of the signed-in user, an email-style identifier such as [e-mail]. Nexthink uses the UPN to identify the same user across devices and platforms, and to enrich user objects with data from third-party services. Spark, AI Tools, and connector-based enrichment depend on it.

This page describes how Collector obtains the UPN on macOS. It applies to every macOS deployment path: manual installation, Jamf, and Microsoft Intune.

How Collector selects the UPN source

Collector checks the following sources in order, and uses the first one that returns a value:

Priority	Source	Collector uses it when
1	Active Directory binding	The device is joined to an on-premises Active Directory domain. This is the most authoritative source.
2	Platform SSO	The device is enrolled in Microsoft Intune with Entra ID and Platform SSO, and is not bound to Active Directory.
3	Jamf Connect	You deployed Jamf Connect, and neither of the sources above applies.

Active Directory binding is independent of the deployment path. On a bound device, Collector reports the Active Directory UPN, even when the device is also enrolled in Intune or managed in Jamf.

Collector does not report a UPN for a local account that none of these sources covers.

Source requirements

Active Directory binding

The device is joined to an on-premises Active Directory domain. Collector reads the UPN from the Active Directory-bound identity record on the device.

Platform SSO

This source requires the following:

• macOS device managed in Microsoft Intune, with Microsoft Entra ID and Platform SSO configured.
• Collector version 26.8 or later.

Collector reads the UPN from the local identity record that Platform SSO maintains on the device. This source needs no additional Collector configuration.

Collector reads the UPN whether the user is online or offline. It also works whether Platform SSO uses a password or Secure Enclave-backed authentication.

Refer to the Deploying Collector in Intune page.

Jamf Connect

Collector reads the UPN from the identity information that Jamf Connect stores on the device after the user signs in. Collector does not report a UPN for local accounts that Jamf Connect does not manage.

Refer to the Deploying Collector in Jamf page.

Enable UPN reporting

Collector reports the UPN only when the User Principal Name (UPN) setting is enabled. Check the setting in the device configuration profile that applies to your macOS devices. Refer to the Device configuration profiles page.

On devices that have not migrated to device configuration profiles, the Collector built-in default is no_import, which reports no UPN. Refer to the Configuring Collector-level anonymization (classic) page.