In most deployment scenarios, manual interaction is not required to create a bootstrap token – the primary user of the computer will receive the first secure token, and macOS will automatically create and escrow a bootstrap token to Jamf Pro when the user logs in to the computer.
In rare situations, a deployment workflow may cause the computer to issue the first secure token to an account other than the primary user account. This can happen if the other account is programmatically created, or if its credentials are used in a script before the primary user logs in.
Sign in on the macOS login window using the user account that has a secure token. This will allow the computer to generate and escrow a bootstrap token automatically to Jamf Pro during login.
Log in to the enrolled computer locally or via SSH as a secure token-enabled administrator and execute the following command:
When prompted, enter the username and password.sudo profiles install -type bootstraptoken
A bootstrap token is generated for the selected user account.