Apple's Automated Device Enrollment, also known as zero-touch deployment, ensures Trusted Access by immediately enrolling and configuring a computer when a user turns it on, without requiring any interaction with IT. This method is ideal for institutionally owned computers and uniquely prevents end users from removing the MDM profile, maintaining device compliance and security.
Apple's Automated Device Enrollment is the Jamf-recommended enrollment method to achieve optimal Trusted Access outcomes. Users can manually enroll institutionally owned computers that are not eligible for Automated Device Enrollment with Device Enrollment. For more information, see Device Enrollment for Computers in the Jamf Pro Documentation.
Jamf Pro's Global Management settings allow you to integrate with Automated Device Enrollment, which establishes communication between Jamf Pro and Apple Business. For more information, see Automated Device Enrollment Integration in the Jamf Pro Documentation.
When the integration is complete, you can use a Jamf Pro PreStage enrollment to configure and deploy the Automated Device Enrollment experience to computers. This includes leveraging Jamf Pro, Jamf Connect, and Jamf Protect to ensure that only authorized users, using secure and compliant enrolled devices, can access sensitive data. This is the starting point for creating a simple and secure enrollment experience for users.
- Configure an Enrollment Customization —
Use the Enrollment Customization settings in Jamf Pro to require authentication via a cloud identity provider (IdP) before enrollment, customize the Automated Device Enrollment experience, and pass user information to Jamf Connect to create a local account on computers.
When the user authenticates using their IdP credentials (and multi-factor authentication, if required), this allows Jamf Pro to query the organization's directory service (if configured) and easily populate the user and location information.
- Configure Jamf Connect Settings —
Use Jamf Pro to configure and deploy Jamf Connect settings to target computers via the Applications & Custom Settings payload in a computer configuration profile.
- Create a Local Account —
Allow Jamf Pro to pass user information to Jamf Connect, which will create a new local account on Mac computers.
When Jamf Connect is deployed as part of the PreStage enrollment, Jamf Pro will automatically pass username attributes to Jamf Connect. Then, the user only needs to enter their password on the next screen to create either a standard or administrator account, depending on their IdP group membership.