Managing Remote Macs at Scale

First, use Apple Business Manager so that Macs will auto enroll in Jamf Pro. Jamf Pro can install an admin account just before the Setup Assistant launches. This can be a LAPS account with a password that can be set to automatically rotate regularly on what ever schedule you decide to use. Next, create the intended user's account first. This will ensure that this user gets the secure token that allows them to perform software updates. You should use some kind of zero touch provisioning process to allow users to boot up new Macs for the first time and do their own setups. They won't need to do much except get it connected to the internet, and create their user account. After the Mac reaches the desktop, your ZTP process can launch and get all the apps installed. The solution I use is called Setup Your Mac. https://github.com/setup-your-mac/Setup-Your-Mac/blob/main/Setup-Your-Mac-via-Dialog.bash  I recommend that you enforce using FileVault. What apps do you want your users to have when they get their Macs? There are a lot of smart Apple admins here who have created some really great solutions. We're all happy to help!

Depends on your budget. For me 0 touch deployment is a non-negotiation point.

1. Automated Device Enrollment (or go home).
1. the 501 admin account will be created on the device by Jamf during enrollment.
2. Configure the device as desired automatically with policies and Configuration Profiles.
2. User Enrolls the Device, and skip account creation during setup assistant.
3. Use Jamf Connect, XCreds, or PSSO to create the user account on demand from the login screen.
4. There is no step 4, the user is off to the races.

Your tech should never log in to the device, and should never really touch the device. I also very strongly recommend not giving the end users admin access. You can add users to local groups like _developers, or change permissions on preferences like WIFI or printers to allow standard users to add/remove networks and printers. For advanced workflows look in to EPM tools, but don’t give admin access out.

I'll add Jamf Setup Manager into the ring. We are using this with success along with Installomater and DockUtil. 

We are a Smart Card organization, so we use Microsoft Platform SSO (PSSO).

https://community.jamf.com/t5/tech-thoughts/give-yourself-a-holiday-gift-with-jamf-setup-manager/ba-p/338538

I'll add