How to Configure Apple Business Manager Automated Device Enrollment (ADE) for Zero-Touch Mac Deployment

Historically, provisioning a new MacBook for an enterprise employee involved a frustrating, labor-intensive process: the IT department would receive the physical hardware, boot it from an external USB drive, wipe the disk, deploy a monolithic system image (often breaking Apple firmware updates in the process), bind it to Active Directory, and manually ship it to the user. This “imaging” approach is entirely deprecated by Apple. Modern macOS deployment relies on a Zero-Touch paradigm driven by Apple Business Manager (ABM) and Automated Device Enrollment (ADE). With ADE, an organization can ship a shrink-wrapped MacBook directly from the Apple Store to a remote employee’s home, and upon unboxing and connecting to Wi-Fi, the device will autonomously securely configure itself, install required security agents, and enforce corporate compliance policies without any IT intervention.

The Architecture of Automated Device Enrollment

Automated Device Enrollment (formerly known as the Device Enrollment Program, or DEP) functions via a cryptographic trust chain established between Apple’s global activation servers, your organization’s Apple Business Manager portal, and your third-party Mobile Device Management (MDM) solution (e.g., Microsoft Intune, Jamf Pro, or Kandji).

When you purchase Apple hardware through an authorized enterprise reseller, the device serial numbers are injected directly into your ABM portal before the physical boxes even leave the warehouse. Within ABM, you configure an MDM Server assignment rule, telling Apple: “Every Mac purchased by this organization belongs to this specific MDM tenant.”

When the employee opens the MacBook and selects their language and Wi-Fi network during the Setup Assistant, the macOS operating system silently reaches out to iprofiles.mac.com to verify its activation status. Apple’s servers recognize the serial number, inform the Mac that it is corporate-owned, and forcefully redirect the Setup Assistant to your MDM server to download its initial configuration payload.

Establishing the ABM to MDM Trust

To enable this flow, you must first mathematically link your MDM tenant to your Apple Business Manager portal using a public/private key exchange.

1. Log in to your MDM console (e.g., Intune or Jamf) and navigate to the Apple Enrollment section. Download the MDM public key certificate (usually a .pem or .cer file).
2. Log in to Apple Business Manager (business.apple.com) with an Administrator or Device Enrollment Manager role.
3. Navigate to Settings > Device Management Settings > Add MDM Server.
4. Upload the public key you downloaded from your MDM. ABM will generate a secure Server Token (a .p7m file).
5. Return to your MDM console and upload the ABM Server Token. The two systems are now cryptographically bonded.

Configuring the Enrollment Profile

With the synchronization established, your MDM will automatically import the serial numbers from ABM. However, the devices will not do anything until you assign them an Enrollment Profile. This profile dictates the behavior of the macOS Setup Assistant.

Within your MDM, create a new macOS Enrollment Profile. The critical settings to configure for a true Zero-Touch experience are:

• User Affinity: Set to Enroll with User Affinity. This ensures the device is mathematically tied to the specific employee utilizing it.
• Authentication Method: Utilize Setup Assistant with Modern Authentication. This will present a web-based login screen (e.g., Microsoft Entra ID or Okta) directly within the native Apple Setup Assistant, supporting MFA and Conditional Access before the user ever reaches the desktop.
• Setup Assistant Customization: You can explicitly hide unnecessary consumer-focused setup screens (e.g., Apple ID, Siri, Screen Time, True Tone configuration) to radically speed up the onboarding process and prevent user confusion.
• Await Final Configuration: This is a critical security setting. If enabled, macOS will intentionally halt the Setup Assistant at the final screen and lock the user out until the MDM confirms that all required mandatory applications (e.g., EDR/Antivirus, VPN agents) and compliance policies (e.g., FileVault encryption) have successfully installed in the background.

The Zero-Touch User Experience

Once the profile is assigned, the deployment is complete. When the end-user receives their sealed MacBook, they simply power it on and connect to their home Wi-Fi. The Setup Assistant immediately locks into “Remote Management” mode, displaying your organization’s custom branding.

The user authenticates with their standard corporate credentials, and the Mac proceeds to the desktop. Because the device was enrolled via ADE, the MDM profile is flagged as Supervised and non-removable. The employee cannot simply delete the management profile from System Settings to bypass corporate security. This ensures absolute chain-of-custody and compliance enforcement from the moment the shrink-wrap is broken.