Create a user account with FileVault 2 enable from JAMF without the user interaction.

I understand what you're asking for and why you would want this - I ran into it recently as well. However, you're essentially asking for two conflicting things - the security of FV encrypting your data at rest and the convenience of anyone in your organization being able to access that data via the shared account; but the good practice these days from Apple seems to be to really consider your use case and why you need to do it and adjust your policy and implementations accordingly.

Going down the path of having Macs shared by multiple varying users with FileVault enabled is going to cause other complications. For example, you're going to get a call anytime a user who has logged into one of those Macs before, then changed their password from a different Mac, then comes back to that shared Mac - because either their local FV password is out of sync (if they still remember the previous password and think to try it) OR that they can't log into that Mac because it's not taking their current password. Sure, the generic account would solve these cases too, but again not the way Apple thinks this should be solved. 

Are home folders stored as encrypted disk images still available? If so, that kind of gives you the best of both worlds - each user's data remains encrypted at rest and you then don't need this wonky FV kludge. Hm... looks like encrypted user homes are no longer built-in, and other implementations no longer work as indicated here: https://gist.github.com/chetstone/8a1294dc3aab9d494e5344dba94e09f0 ). I'd imagine you could do something with a script that creates the DMG on first login, sets it as a startup item to be mounted via keychain password, and moves / links all the usual folders inside ~ onto the DMG except the login items including mounting the DMG? Or maybe a loginhook script would be better... 

Hey There, 

From a prior environment where I was able to get this going, you are going to need to make sure you've got a few things going.  First is for this you are going to need to make sure that the connect profile sets all new users up as admins.  You are also going to need to make sure you have another local account that's setup as an admin and that account is used as a bootstrap token on your MDM.  From what I remember that should allowed for what you are looking for.