My current workflow (working for older OS but fails for Big Sur):
Prestage enrollment
Bind to domain in prestage enrollment with configuration profile
Create the jamf management account
Skip local account creation
When configured this way the Big Sur M1 computers do not get a securetoken on the mobile accounts and do not escrow the bootstraptoken in the server. Most often the securetoken is picked up by either the AV management account deployed by Sophos or another IT admin account. In either case, bootstraptoken is not escrowed in the server.
This can be worked around by creating a local account during prestage which will then receive the securetoken and escrow the bootstraptoken, but that is not my preferred workflow, and introduces more potential technician errors during setup if account credentials are entered incorrectly.
