Computers with macOS 10.15 or later automatically generate and escrow a bootstrap token to Jamf Pro during user account creation in the Setup Assistant. Starting in macOS 10.15.5, if a bootstrap token has not yet been escrowed and a cryptographic user with a secure token signs in through the macOS login window, the computer will automatically generate a bootstrap token and escrow it with Jamf Pro.
Beginning with Jamf Pro 11.18.0, all MDM enrollment methods automatically escrow a bootstrap token to Jamf Pro immediately after the MDM profile is installed, provided that the user that completes the MDM enrollment has a secure token and cryptographic privileges on the computer.