What actually happens during zero-touch Mac enrollment

A new hire opens a sealed MacBook at home, joins Wi-Fi, signs in once, and twenty minutes later the machine is encrypted, has every app they need, and is fully managed. Nobody from IT touched it.

When it works, it looks like magic. When it doesn’t, it looks like a black box — the Mac sits on the Remote Management screen forever, or sails past it and enrolls into nothing. Both failures are the same kind of bug: one link in a chain of network calls didn’t happen. So it’s worth knowing the chain.

The chain, step by step

Before the box is even opened

Zero-touch starts at purchase, not at unboxing. When your organization buys Macs from Apple or an authorized reseller tied to your Apple Business Manager (ABM), the device’s serial number lands in ABM automatically. From there it has to be assigned to a specific MDM server — your Jamf, Intune, or Mosyle instance. That assignment is the thing Apple checks later; if it didn’t happen, nothing downstream fires.

First boot: the device asks Apple who owns it

During Setup Assistant, before the user has signed in to anything, the Mac reaches out to Apple’s device-enrollment endpoints (mdmenrollment.apple.com, iprofiles.apple.com, plus the usual gdmf.apple.com / albert.apple.com for activation). The question it’s asking is simple: am I assigned to an MDM?

If ABM says yes, Apple hands back the enrollment profile pointing at your MDM. This is why a Mac with no network at setup — or one behind a captive-portal Wi-Fi or a filtering proxy — never offers Remote Management: it literally can’t ask the question.

The one screen the user sees

Apple’s answer produces the Remote Management pane in Setup Assistant. Accepting it tells the Mac to fetch its enrollment profile from your MDM and enroll. Because this came through ADE, the enrollment is supervised and the MDM is non-removable — the user can’t unmanage the device, and even an erase re-enrolls it.

PreStage decides everything about that enrollment

What the user experiences is defined ahead of time by the PreStage enrollment (Jamf’s term; the equivalent exists in every MDM):

• Which Setup Assistant panes to skip — Apple ID, Siri, Touch ID, Screen Time. Skip the ones the user shouldn’t see.
• Account creation — a managed local admin, a standard account, or sign-in via Platform SSO against your IdP.
• Non-removable MDM, certificates, and the first configuration profiles and apps.

The provisioning window

Right after enrollment, the MDM pushes the real payload: the security baseline (FileVault, firewall, passcode/OS-update policy), identity, and the app catalog deployed silently through Apple’s volume purchasing. Many setups hold the Mac on a provisioning screen here — Apple’s Setup Manager, or a DEPNotify/Setup-Manager-style UI — so the user waits on a progress bar instead of landing on a half-configured desktop.

Bootstrap token: the quiet keystone

During ADE enrollment with a managed admin, the Mac escrows a bootstrap token to the MDM. That token is what later grants SecureToken to accounts, enables FileVault without a user prompt, and authorizes MDM-driven admin actions. It’s invisible when it works — and the root cause of a whole class of “FileVault won’t enable” / “can’t make this user an admin” tickets when it doesn’t get escrowed.

Where it actually goes wrong

Almost every zero-touch failure is one of these:

• The device isn’t in ABM, or is assigned to the wrong MDM server. Assignment has to be correct before the Mac enrolls. Reassigning a device that’s already set up means wiping it.
• No network path at Setup Assistant. The Mac has to reach Apple’s endpoints and your MDM before the user signs in. Captive-portal Wi-Fi, content filters, and proxies that require auth all break this. Apple publishes the hostnames and ports to allow — get them on the allowlist.
• The Mac was already set up. ADE only triggers on a clean first boot or after an erase-install. A Mac someone already clicked through won’t retroactively go zero-touch without a wipe.
• The bootstrap token never escrowed, so FileVault and SecureToken break later.
• The wrong Setup Assistant panes are shown, so users hit screens (Apple ID, Screen Time) they were never supposed to.

Takeaway

Zero-touch isn’t a feature you switch on; it’s a chain — ABM assignment → Apple’s enrollment check → MDM enrollment → PreStage config → bootstrap token. When it “doesn’t work,” don’t debug it as a mystery. Walk the chain in order and find the one link that didn’t fire. It’s almost always the network at Setup Assistant or a device that was never assigned to the right MDM in the first place.