Different Management Accounts for Different PreStage Enrollments?

[jnm1]

When I create a prestage enrollment I see this note in the Account setting section under the Management Account:

Edit the management account via the User-Initiated Enrollment settings

The issue is that we would have two Prestage enrollments and we would like them to have different Management account. Is this possible?

[cosmosb]

I am bumping this thread. We also have various sites and scenarios that dictate separate management accounts. For instance, our students enroll using the user-initiated enrollment URL and are not automatically enrolled in DEP.

We have school own devices that are automatically enrolled in DEP and are designated to certain sites. Each site has its own site administrator and we give them their own management account for their site.

I'm not clear on why the JSS forces you to use the management account for user-initiated enrollments. Can someone clarify or suggest a way around this?

What is the point of having separate prestage enrollments?

[ryan_ball]

If you don't plan to use Casper Remote, I don't think there is even a need for a management account at all.

[cosmosb]

We most certainly will use Casper remote although knowing the management account is less important for that as long as the JSS has the right account.

The use case for us is ssh, vnc, ard or any other service where an administrator needs elevated permissions to tech a machine beyond automated means.

[ryan_ball]

A possible workaround is using Recon.app to create separate QuickAdd packages with the different management accounts, and install them to their respective sites. You could also modify the postinstall script in the package to include something like:

jamf enroll -invitation XXXX -noRecon -noPolicy

[cosmosb]

Thanks, Ryan. The issue is that this is for prestage enrollment. To your point, we can certainly alter the machines after but that means more human interaction and manual work. That means more time and potential for human error. The advantage of prestage enrollment is to leverage all of the aforementioned from factory to onsite and then configure the device with whatever customizations you need for a site or user etc.

[ryan_ball]

Correct, but what I'm saying is in lieu of being able to do what you want, you could prestage with the same user, then set a policy scoped to each site with a different quickadd which will then change the management account for you. It enrolls with the prestage, then gets changed to the new management account at check-in or whatever you choose.

Just a thought.

[cosmosb]

Thanks!