Pre-stage enrollment

[sekinpetr]

I am attempting to set up pre-stage enrollments for Jamf, but am running into some issues:

1. I manually assigned a device to our business manager account for testing purposes. When I sign into the account, everything looks like it works correctly, but the device isn't assigned to any user. Is there a way that it can be automatically assigned?

2. I would love to get Google SSO set up for creating the local user account. Would I need Jamf Connect to accomplish this?

Thank you in advance!

[AJPinto · Accepted solution]

1. With Apple Business Manager, you assign a device to an MDM solution like Jamf. Apple does not care who uses the device, and has no mechanism to track who is using a device between ABM and MDM.
   1. Once the device is enrolled in MDM, you can assign it to a user from within the MDM. There are ways to automate this process.
2. You will need to discuss your needs with Google.
   1. SSO really just means that credentials from logging into the OS (or another tool) are passed to other services and applications, so the user only has to sign in a single time. I think what you are after is On Demand Account Creation. 
   2. MacOS has something called Platform Single Sign On, which you would use to natively use your IDP credentials to log in to macOS and create a user account on demand. However, very few IDP's support this function of macOS. The only IDP I am aware of that has this in prod currently is Okta, even Microsoft still has it in preview. 
   3. JAMF Connect could be setup with Google as an IDP and perform on demand account creation.

Platform Single Sign-on for macOS - Apple Support

[ivanlovisi]

we have introduced the "enrollment customization" function into our enrollment workflow .

We have enabled the "single sign on authentication" panel.

The user has to identify himself in order to enroll his device. after successful authentication the device is assigned to the user in Jamf Pro

[liska]

Hey there!
I want to do the same in our company setup, but it is not working so far. How do you create the user? I have the SSO authentication pane in enrollment customization, but I skipped account creation during Prestage enrollment because we use Jamf Connect. My desired outcome is that the user signs in either during Prestage SSO authentication or during account creation with Jamf connect, and then the computer gets assigned to the newly created user, and the user and location information in the computer card gets filled with the user info. 

[AJPinto]

You can use recon to assign the device to the logged in user, and the device should be assigned to whoever enrolls the device if they are authenticating to enroll to your MDM. The location and other information must be filled manually, or with a recon script. For whatever reason Jamf does not assign that data with enrollment from LDAP or anything else.