@Jan_H ...you are treading down a road I just travelled and it was not fun. The exact same ask, use our corporate 802.1x wifi for staging devices. Let me tell you what I found. Maybe it will help you.
-During Setup, when you are prompted to chose which wifi and you enter credentials, they are used to make that initial connection to Jamf and pull down the pre-stage settings/profiles. When complete, that wifi connection is dropped since there is no end-user based keychain (yet) to store credentials.
-Jamf Connect (in our case) comes up and since there is no keychain and no network connection at this point, it displays errors since we are operating as the "mbsetupUser" account...not yet as an end user
-Here, at this Jamf Connect screen, Apple has the OS configured where you cannot chose the corp wifi and enter and store a user name and pw for wifi unless the Mac is domain joined (and who wants to do that anymore).
-Jamf has informed me that there is a feature request submitted to Apple asking to allow credentials to be input in that screen, but they've not allowed it to date.
-A way around this is to use certificate based, device authentication to get on the wifi network at the Jamf Connect screen but that could create a lot of re-architecting a network.
-Apple DID say that the best practice maneuver is to have a "staging wifi", open to the internet and once the device has been configured, that connection can be removed (so to speak) and the device join the corporate wifi.
That's where we left it....we have an open wifi network for staging devices, and I'm presently preparing a script to run removing the open network from the list of networks and adding our corp wifi as the top listed network.
That was a lot. Hope it didn't confuse you.
