> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/macos-collector-references/reporting-the-upn-on-macos.md).

# Reporting the UPN on macOS

Collector reports the User Principal Name (UPN) of the signed-in user, an email-style identifier such as `john.doe@company.com`. Nexthink uses the UPN to identify the same user across devices and platforms, and to enrich user objects with data from third-party services. Spark, AI Tools, and connector-based enrichment depend on it.

This page describes how Collector obtains the UPN on macOS. It applies to every macOS deployment path: manual installation, Jamf, and Microsoft Intune.

## How Collector selects the UPN source

Collector checks the following sources in order, and uses the first one that returns a value:

| Priority | Source                   | Collector uses it when                                                                                           |
| -------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------- |
| 1        | Active Directory binding | The device is joined to an on-premises Active Directory domain. This is the most authoritative source.           |
| 2        | Platform SSO             | The device is enrolled in Microsoft Intune with Entra ID and Platform SSO, and is not bound to Active Directory. |
| 3        | Jamf Connect             | You deployed Jamf Connect, and neither of the sources above applies.                                             |

Active Directory binding is independent of the deployment path. On a bound device, Collector reports the Active Directory UPN, even when the device is also enrolled in Intune or managed in Jamf.

Collector does not report a UPN for a local account that none of these sources covers.

## Source requirements

### Active Directory binding

The device is joined to an on-premises Active Directory domain. Collector reads the UPN from the Active Directory-bound identity record on the device.

### Platform SSO

This source requires the following:

* macOS device managed in Microsoft Intune, with Microsoft Entra ID and Platform SSO configured.
* Collector version 26.8 or later.

Collector reads the UPN from the local identity record that Platform SSO maintains on the device. This source needs no additional Collector configuration.

Collector reads the UPN whether the user is online or offline. It also works whether Platform SSO uses a password or Secure Enclave-backed authentication.

Refer to the [Deploying Collector in Intune](/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-macos/intune-deployment-tp.md) page.

### Jamf Connect

Collector reads the UPN from the identity information that Jamf Connect stores on the device after the user signs in. Collector does not report a UPN for local accounts that Jamf Connect does not manage.

Refer to the [Deploying Collector in Jamf](/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-macos/jamf-deployment-tp.md) page.

## Enable UPN reporting

Collector reports the UPN only when the **User Principal Name (UPN)** setting is enabled. Check the setting in the device configuration profile that applies to your macOS devices. Refer to the [Device configuration profiles](/platform/user-guide/administration/system-configuration/data-management/device-configuration-profiles.md) page.

On devices that have not migrated to device configuration profiles, the Collector built-in default is `no_import`, which reports no UPN. Refer to the [Configuring Collector-level anonymization (classic)](/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/configuring-collector-level-anonymization/configuring-collector-level-anonymization-classic.md) page.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/macos-collector-references/reporting-the-upn-on-macos.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.