10.19.0 Management Account Information Changes

Some additional information from Jamf Support for those who may stumble upon this post.

Pre-10.19 behavior:
1) Any time the Account Settings payload was configured, an administrator user account would be created via the AccountConfiguration MDM command.
2) If the "Create additional local administrator account" feature was not selected, the Jamf Management Account (as defined in User-Initiated Enrollment settings) would be created
---> This caused issues where the Management account home directory is being created in /Users/ with UID being set to 501(first account created) instead of being located within /private/var/ with a UID of 80.
3) Per Apple's MDM specifications, a Managed Administrator is only required to be created when the Local User Account Type is set to "Standard" or "Skip Account Creation."
---> This caused confusion as the Jamf Management account doesn't need to be created if the Local User Account Type was set to "Admin"
---> It also caused additional confusion if the UIE settings were set to not create the Management account

Post-10.19 behavior:
1) Design changes were implemented to reduce confusion per #3 above -- no longer shows the Jamf Management account information unless the "Create additional local admin account" wasn't selected pre 10.19
2) The design changes also addressed a product issue surrounding #2 and helped the admin setting up the PreStage to understand what management account was going to be created.
3) In addition, the Jamf Binary now exclusively creates the management account according to the UIE settings (if the UIE settings are set to create the management account)

My comment (not Jamf's):
This change wasn't documented very well in the 10.19.0 release notes but, admittedly, it's complicated. The main take-away for me is that User-Initiated Enrollment is still the place where you specify your jamfadmin (or casperadmin or whatever) management account. This management account information from Settings > Global Management > UIE is still used for PreStage enrollments.

This change made things a lot more complicated for me; not to mention I just spent a significant amount of time trying to figure out why I could not see the admin account on the most recent enrolled computers from the JAMF Portal.
On top of that, the local user accounts are being created as admin accounts (501) instead of standard (502).

Many thanks for the clarifications!

I just noticed that the admin account we have set up in our initial pre-staged You may be running into some changes that were made in 10.19.0. /discussions/34850/10-19-0-management-account-information-changes.

Official Site