Standard Operating Procedure (SOP): Automated macOS Device Enrollment via JumpCloud MDM (ADE + ABM + ZTE)

Document Version: 1.0
Author: Karthik G
Date: 30-04-2025

Table of Contents

1. Overview
   
   

2. Automated Device Enrollment Setup (ZTE Group)
   
   

3. Application Deployment to Device Group
   
   

4. Adding Non-ABM Mac Devices to ABM via Apple Configurator
   
   

5. Zero Touch Enrollment (ZTE) Walkthrough
   
   

6. Additional Notes

1. Overview

This document outlines the steps to automate macOS device enrollment into JumpCloud using Automated Device Enrollment (ADE), Apple Business Manager (ABM), and Zero Touch Enrollment (ZTE). It also includes procedures for integrating non-ABM devices and automating software deployment via JumpCloud.

2. Automated Device Enrollment Setup (ZTE Group)

Step-by-Step:

1. Create a Device Group in JumpCloud:
   
   

• Name it appropriately (e.g., ZTE Mac Group).
  
  

• This group will be used to manage all macOS devices onboarded via Zero Touch Enrollment.
  
  

2. Configure MDM ADE in JumpCloud:
   
   

• Navigate to MDM > ADE in JumpCloud Admin Portal.
  
  

• Click on Configure macOS.
  
  

• Under Default Group Association, select the group created in Step 1.
  
  

• Adjust settings as per organizational policies (e.g., supervision mode, user authentication, skip setup steps).
  
  

• Click Save.
  
  

3. Application Deployment to Device Group

1. Create or upload the required software under Software Management in JumpCloud.
   
   

2. Associate the software to the previously created ZTE Mac Group.
   
   

3. This will do the auto installation of the Application as soon as the device comes to JC admin.
   
   

4. Adding Non-ABM Mac Devices to ABM via Apple Configurator (iOS)

Prerequisites:

• Mac running macOS 12.0 Monterey or later

• Latest version of Apple Configurator (available on the  iOS App Store)

• Apple Business Manager account with Admin or Device Enrollment Manager role

• The device (Mac) must be erased and at the Hello screen
  
  

Procedure:

1. Install and Open Apple Configurator on iOS device.
   
   

2. Log in using your ABM admin credentials.
   
   

3. Grant necessary app permissions:
   
   

• Enable Camera.
  
  

• Ensure Bluetooth is enabled on the iOS device.
  
  

4. In app settings:
   
   

• Scroll to MDM Server Assignment.
  
  

• Select Specific and choose your JumpCloud MDM.
  
  

5. Restart the app after configuration.
   
   

6. On a reset/fresh macOS device, stop at the Hello screen.
   
   

7. Bring your iPhone close to the Mac and press Next on Mac.
   
   

8. The Mac will display a pairing code—scan it using your iPhone.
   
   

9. Complete the steps until prompted to restart the Mac.

10. Now this device will reflect in ABM.
    

11. Come to the JumpCloud Admin console click on MDM and scroll down to all the end and click on Sync With Apple make sure you should be able to see the device Serial Number of the Device.
    

12. Important step is click on the Sync with Apple and make sure you should not miss it. As this is the main step for ZTE.
    

13. After restart, the device will appear under the JumpCloud's Remote Management.
    

Reference: Apple KB - Use Apple Configurator for iPhone

5. Zero Touch Enrollment (ZTE) Walkthrough

Steps:

1. Reset the macOS device to factory settings.
   
   

2. On boot, wait for the Hello screen.
   
   

3. Proceed with initial setup steps until the Wi-Fi selection screen.
   
   

4. Connect the device to a valid Wi-Fi network.
   
   

5. Wait for the Remote Management screen.
   
   

6. Click "I Understand" on this page.
   
   

7. You'll be directed to the JumpCloud Login Screen.
   
   

8. Enter the user's JumpCloud email and password.
   
   

9. JumpCloud will complete the enrollment process.
   
   

10. The device will now appear in JumpCloud Admin Portal under the defined ZTE device group.
    
    

6. Additional Notes

• Automated applications will install based on device group association—no manual intervention is needed.
  
  

• Devices must remain connected to Wi-Fi until the entire enrollment and software installation process completes.

End of Document