Enroll DEP Macs as User initiated enrollment possible?

[hansjoerg_watzl]

Hello
We are using a Jamf Pro (on premise) server with user enrollment (no DEP).

We could buy some new Macs, where we don't know if they are prepared/registered for DEP (different MDM) or not.

Question: Is it possible to user enroll a device on our Jamf server, even if the Macs are registered as DEP device? Or does the enrollment starts automatically, when the device is connected to the Internet (and trying to enroll to the DEP registered MDM - which is not our Jamf server)?

[geoff_widdowson]

It would be automatically, but only if you assign the device in Jamf first. When you buy the device and the supplier adds it to DEP, this should link to your Jamf Server (as long as you have configured DEP correctly). You have to create a pre-stage enrollment to assign a device to pick up DEP. If you dont assign a device it will boot on first start like any non-DEP device. There are multiple steps to getting DEP working from your side, it's not just if the supplier adds it.

[hansjoerg_watzl]

Thanks. But what I mean is, what happens when a DEP devices is already configured for another MDM. Can I still overwrite this and user enroll this device in our Jamf server? (which is NOT the DEP assigned MDM and DEP is not needed for us)

Background: One of our customer had an offer for some Mac devices (and maybe the whole managed Mac service too!) from a different company. It seems, he already bought some of these devices and we don't know, if they are DEP devices (configured for the MDM of this other company) or not. Our customer asked us, if we can confirm, that these devices can be used on OUR Jamf Pro server (just as user enrolled devices).
So, if these are DEP configured devices, what does this mean for us? Can we still enroll these Macs or does the other company have to unassign them from their own MDM first?

[jtrant]

You can do so by not connecting them to the internet before powering on, but if they are assigned to another organization's DEP account they will intermittently receive prompts to allow that organization to manage the device, which will be an annoyance.

Whether or not they are actually able to enroll in that organization's MDM is doubtful, providing your MDM profile is marked as non-removeable.

It's worth remembering that in Catalina and above, user-initiated enrollments can be reversed by the user for 30 days after enrollment. This might complicate your situation further. It would be highly recommended that you have the customer remove the devices from their Apple Business Manager account.

[hansjoerg_watzl]

@jtrant Thanks. I guess, that helps me for the moment. It was more of a preliminary investigation. Of course, it's best if the devices are not be DEP configured for an other MDM (we will try to clarify this first).

[dlondon]

If the machines are already in DEP and assigned to a MDM they need to be released. It's the same as when a person sells their own iphone or mac - they need to remove it from iCloud before someone else can use it - that's the security.