Jamf School to Jamf Pro migration

On the Wi-Fi profile timing the "install configuration profiles before Setup Assistant completes" option in the PreStage doesn't mean before the device gets online. The device still needs internet to hit Apple's activation servers and complete MDM enrollment first. The PreStage profiles land after that enrollment step, so the Wi-Fi profile can't bootstrap that initial connection, it arrives too late for that.

For getting Macs online during Setup Assistant, you have two practical options:

1. Hardwire with ethernet, cleanest option, no security exposure, most reliable. A simple switch at a provisioning bench is all you need.
2. Temporary PSK or open SSID, works if ethernet isn't practical, but introduces some security exposure and the overhead of remembering to turn it off.

On separate profiles for iOS and macOS, correct, you do need to create them separately. There's no way to share profiles across platforms in Jamf Pro.

On the Jamf School to Jamf Pro migration a few things worth knowing going in:

• Test a full wipe-to-enrolled cycle on one device of each type before you do it at scale over the summer
• Build and scope your config profiles before you start migrating devices you want them ready to land immediately on enrollment
• If you're using WPA2-Enterprise or 802.1X on your wireless, factor in cert delivery as part of your enrollment flow that's a common source of Wi-Fi profile failures post-enroll
• Jamf School and Jamf Pro handle scoping differently, so don't assume your existing profile logic will translate 1:1

One more thing if your devices are on or can be upgraded to OS 26 before you do this, Apple now supports migrating devices between MDM servers directly from Apple School Manager without a factory reset. You can reassign devices to the new MDM server and set an enrollment deadline, and the device handles the re-enrollment automatically. If you're on older OS versions you're still doing it the old fashioned way, been there, it's not fun, but worth knowing about if you can time the OS upgrades right.

Take a good look at the Blueprints component of JAMF Pro. While every single profile component may not currently exist, there are a wide variety of DDM and Legacy profile payloads that can be configured collectively across apples OSs.

One thing that helps in migrations like this is separating the ABM/ADE plumbing from the Jamf School to Jamf Pro move itself. For return-to-service and wipe scenarios, the critical check is that the device is assigned in Apple Business Manager to the new Jamf Pro MDM server before the wipe, because ADE is what gives you the zero-touch re-enrollment path after activation.

I work on Swif. This ADE walkthrough may help on the enrollment side: https://help.swif.ai/en/articles/6860974-apple-automated-device-enrollment-dep-ade

Also +1 that macOS and iOS profiles need to stay separate in Jamf Pro. I would test one full wipe-to-enroll path per platform before summer rollout, then validate Wi-Fi timing, PreStage scope, and whether you need temporary network access at Setup Assistant for Macs.

Just adding context here to my previous comment about Blueprints. ​@angelohuang is correct that configuration profiles should be very separated. Not even just between iOS and macOS. Each setting managed by a configuration profile should have it’s own configuration profile. i.e. a config profile for WiFi should not have any other settings configured in that profile. 

On the other hand. Jamf Pro Blueprints CAN and arguably SHOULD be a combination of settings you previously would have used many several Configuration Profiles for.

Thank all of you for your advice!

It is greatly appreciated