Skip to main content

Hello All, 

Hopefully this is the correct place to post this, but I need a helping hand. 

What are the management capabilities that are lost when using User-Initiated Enrollment as opposed to using Device Enrollment through Apple Configurator? I am implementing Jamf into our organization and we already have a number of Mac computers in circulation, and wiping these devices to enroll them may not be feasible. Any and all help is appreciated. Thanks! 

I have only been able to find one article covering this, but it does not list everything. 

https://learn.jamf.com/bundle/jamf-now-documentation/page/Supervision.html

From someone who was in your position, what I have done is as a user needs a rebuild I have enrolled them and then gone the Automated enrolment after that instead of forcing everyone at once!

I'd strongly suggest trying the same, as there are important things like the ability to block Activation Lock and so on that only happen during automated deployments. 

@Knight_Owl If you can add those devices to Apple Business Manager, then you can run a terminal command to trigger the DEP Enrollment.

  1. Add the devices to the ABM
  2. Configure ADE in Jamf
  3. Inform users to run "sudo profiles show -type enrollment" in terminal. This will trigger DEP enrollment process.

Thanks.

@Knight_Owl If you can add those devices to Apple Business Manager, then you can run a terminal command to trigger the DEP Enrollment.

  1. Add the devices to the ABM
  2. Configure ADE in Jamf
  3. Inform users to run "sudo profiles show -type enrollment" in terminal. This will trigger DEP enrollment process.

Thanks.


Hi Karthikeyan_Mac,

Correct me if I am wrong, but to add the devices to the ABM, I need to wipe and prepare them using Apple Configurator. This may not be an option for us.

Thanks for the input, looking forward to your response.

From someone who was in your position, what I have done is as a user needs a rebuild I have enrolled them and then gone the Automated enrolment after that instead of forcing everyone at once!

I'd strongly suggest trying the same, as there are important things like the ability to block Activation Lock and so on that only happen during automated deployments. 


Hi Michael,

That is what I think our plan of action will be. However, We would really appreciate knowing what the limitations are of using User-Initiated (Open) Enrollment compared to Device Enrollment with Apple Configurator.

Correct me if I am wrong, but the devices will be managed, but not supervised, correct? And with the loss of supervision comes the loss of applying some configuration profile attributes? Such as the ability to remove profiles. 

Thank you for your input, and I look forward to your response.

Hi Michael,

That is what I think our plan of action will be. However, We would really appreciate knowing what the limitations are of using User-Initiated (Open) Enrollment compared to Device Enrollment with Apple Configurator.

Correct me if I am wrong, but the devices will be managed, but not supervised, correct? And with the loss of supervision comes the loss of applying some configuration profile attributes? Such as the ability to remove profiles. 

Thank you for your input, and I look forward to your response.


Yes, your Apple reseller should add the devices to your ABM or ASM. Or you can connect via USB-C and prepare from there. You can also use your iPhone with Apple Configuration Manager installed and tied to your Apple Device instance. Long wait for an answer, and I bet your all good to go now.


Remember to use an M1 or above. Mr Machintosh has a great process for you and others:
https://mrmacintosh.com/restore-macos-firmware-on-an-apple-silicon-mac-boot-to-dfu-mode/


and


HSC is awesome as well:


chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://hcsonline.com/images/PDFs/Add_Mac_ABM_No_Erase.pdf


Best of luck.

Reply


Terms & ConditionsCookie settings