PROVISIONAL ENROLLMENT FAILED - FIXED

Following these steps appears to resolve this issue:

1) Perform DFU wipe on iPad
2) Prepare device in Apple Configurator
3) Assign device to DEP at school.apple.com
4) Assign device to Prestage in JAMF
5) Click OK/NEXT through the initial setup screens on iPad
6) Once at homesreen, wipe the device (ERASE ALL CONTENT AND SETTINGS)
7) When the device restarts, join it to Wifi
8) Click OK/NEXT through setup screens again
9) DONE

Note: I have USB internet sharing enabled on my Macbook)

This probably works for ipads too.

1.) Get a mac laptop or desktop. Install apple configurator 2 on it.

2.) Fire up apple configurator and plug in your ipod.

3.) in system preferences -> sharing -> internet sharing , turn it on and select the ipod USB item. This will share the internet that is on the laptop so you dont have to type any password into the device or install a wireless profile.

4.) Select the ipod in apple configurator and the prepare menu will be shown.

5.) click prepare. Uncheck the one that says "auto enrollment". Leave the other items checked. For the MDM server, put in apple.school.com (This was the most confusing part for me! as i assume it would be some variation on a JSS url and took days to figure that out)

6.) Keep clicking through the settings. Use the certificate from your JSS when prompted for which certificate to install.

7.) You are then dumped back at the menu with a picture of your ipod there.

8.) AT THIS POINT, go to school.apple.com, look up the serial number of your device. It should be in there. Change the MDM server to JSS (your jamf server).

9.) You will now go back to the ipod. It will look like you are setting it up with NO management. Just keep clicking through and don't worry. Skip apple ID and all that. Once its at the home screen, go into settings -> general -> reset and go to the bottom. Erase all settings and configuration (reset the ipad).

10.) becuase you reassinged in step 8, the next time it boots up it has the remote management, and it able to pull down and install a profile. It will now show in jamf and you can apply your policy against it.

If you dont do it in this exact way, you get a "invalid profile" message on the ipod and a "MCProfileErrorDomain - 0x3e8 (1000)" error on apple configurator.

Much props to all who came before me especially haugena who put it all together here...