I am a jamf admin working on getting our enrollment modernized. Within the last year we got our connection setup with ABM and Jamf so that our devices will have automated enrollment during setup. The issue we are running into is that our company requires all devices on internal network to be trusted (typically using a certificate)
Since the enrollment is happening during the setup experience, I cant see how there would be a way to get the device the certificate before reaching out to our enrollment server. If we are on internal we get an immediate block. We have to connect it to an external network to enroll.
I put in a request with our security team and after some back and forth I asked if our specific enrollment URL could be allowed access on the network without being trusted. Understandably they are not too keen on this idea. I can’t find anything from jamf on getting around this, has anyone had a similar experience in their enterprise on anything like this?
