Unfortunately when I got into work, it started asking for the admin decrypt key on login. I am going to continue testing.

If you encrypt via Config Profile using the Individual key you will see the key displayed by default. There is a key you can set, ShowRecoveryKey, that you can set as False and it will suppress that. However, that means you have to download the profile, edit it, and upload it again.

We requested Apple to put that as an option in Configuration Manager, which they just released. There is an open FR now with Jamf to implement the same, so we can set this directly from the interface. Vote up!

Definitely voted that up!

This could be a make or break for my deployment. I have found it to use the inline config profile in the above way does work... but it just might need to be a manual process when setting up these devices. I can just have them accept it before we get to the onboarding portion by having our team login before the end user does.

I do think there should be a way to sync up the escrow keys when you have a user encrypt on login. The guys from NoMAD seem to have this working with other MDMs. This also suppresses any notification of filevault and does encrypt, but it seems when JAMF's binary runs, it changes the password before it escrow's and breaks the login process... I am still testing on this, hopefully I can find some sort of work around to use the escrow and NoMAD for that seamless FDE.