Posting this because I couldn't find it documented anywhere and it cost us a day of detective work.
Symptom: a cart of zero-touch ADE Macs (no user created in Setup Assistant) enrolled fine and checked in for about a week, then went dark. At the login window, Wi-Fi was disconnected and the Mac had "No preferred networks". Logging in as the local admin either auto-joined with no password prompt, or asked for the password, depending on the Mac.
Cause, from the airportd logs: Wi-Fi joined in Setup Assistant stays "pending". It works for that boot, and even through the post-setup restart, but macOS only saves it to the System keychain and Known Networks at the first console login:
Attempting to remember network joined during SetupAssistant (network=SSID: ...)SUCCEEDED to set system keychain password for network joined during SetupAssistantSUCCEEDED to add known network for network joined during SetupAssistant
If nobody logs in, it's never saved. Once the Mac drops off Wi-Fi it can't rejoin. And if the Mac loses power before that first login (battery died in the cart), the pending network is discarded completely, so you'll be asked for the password again.
Gotcha: the Wi-Fi config profile can't fix it after the fact, because the Mac has to be online to receive it.
Fixes:
- Scope your Wi-Fi configuration profile to the enrollment/prestage so it lands during setup, or
- log in once at the end of setup, or
- if you're already stuck, log in once as local admin and join Wi-Fi. The profile then installs and the Mac stays connected from then on.
Bonus: lid-closed Macs answer MDM profile installs with NotNow … reason: Not supported during DarkWake, so open the lids while the queue drains.
Seen on macOS 26.5.2.