How to Deploy Apple Setup Assistant with Modern Authentication for macOS Provisioning

The Apple Automated Device Enrollment (ADE) workflow—formerly DEP—historically relied on a precarious onboarding sequence. When a user unboxed a new Mac, they connected to Wi-Fi, the Mac reached out to Apple, and Apple pointed the Mac to the organization’s MDM server. The user was then presented with a basic, webkit-based authentication prompt to log in and download their MDM profile.

This legacy architecture was highly problematic. The webkit view lacked the security capabilities of modern browsers, frequently breaking complex Conditional Access policies, FIDO2 hardware key authentications, and passwordless flows (like Microsoft Authenticator). IT administrators were forced into terrible compromises, often bypassing MFA entirely during the initial enrollment phase.

Apple resolved this by introducing Setup Assistant with Modern Authentication. This paradigm shift integrates the native Extensible Single Sign-On (SSO) framework directly into the macOS Setup Assistant, allowing organizations to enforce strict, phishing-resistant Zero Trust policies at the very first moment a Mac is powered on.

Understanding the Architecture Shift

In the legacy flow, authentication happened before the MDM profile was downloaded. The MDM server simply hosted a basic captive portal webpage.

With Setup Assistant with Modern Authentication, the architecture is inverted:

1. The Mac connects to Wi-Fi and contacts Apple.
2. Apple directs the Mac to the MDM server.
3. The MDM server immediately pushes the enrollment profile down to the Mac without asking for credentials.
4. macOS drops the user onto the desktop.
5. Instantly, the native macOS Extensible SSO framework intercepts the user. It launches a highly secure, native authentication window (not a basic webkit pop-up) driven by the Identity Provider (e.g., Microsoft Entra ID or Okta).
6. The user authenticates using full Conditional Access (including FIDO2 keys or device compliance checks).
7. Once authenticated, the local macOS user account is created, and the MDM payload executes the rest of the configuration.

Prerequisites for Modern Authentication

To deploy this workflow, you need the following infrastructure aligned:

• OS Version: macOS 10.15 (Catalina) or later, though macOS 13+ (Ventura) is strongly recommended for the best Extensible SSO experience.
• MDM Provider: Your MDM must explicitly support “Setup Assistant with Modern Authentication” (e.g., Jamf Pro 10.26+, Microsoft Intune).
• Identity Provider (IdP): Microsoft Entra ID (Azure AD), Okta, or Ping Identity configured for OIDC (OpenID Connect).

Step 1: Configuring the MDM Enrollment Profile

The configuration begins in your MDM console, where you define how the Mac behaves during the out-of-box experience.

In your MDM (e.g., Jamf Pro), navigate to Settings > Global Management > Automated Device Enrollment and edit your PreStage Enrollment profile.

1. Navigate to the Authentication tab.
2. Select Require Authentication.
3. Change the authentication type from the legacy Web Clip/Custom URL to Setup Assistant with Modern Authentication.
4. Ensure your MDM is integrated with your cloud IdP (via the Jamf Connect or Intune Entra ID connector).

Step 2: Configuring the Awaiting Configuration State

Because the user reaches the macOS desktop before the heavy applications (like Office 365 or VPNs) are installed, they might attempt to start working on an unsecured machine.

To prevent this, you must enable the Await Device Configured state.

1. In your PreStage Enrollment profile, navigate to the General tab.
2. Check the box for Await Configuration.

When this is enabled, macOS will present a full-screen “Configuring your Mac” lockdown screen immediately after the user authenticates via the Modern Auth prompt. The user cannot access the Finder or Dock until the MDM server explicitly sends the DeviceConfigured command, guaranteeing the Mac is fully secure before use.

Step 3: Enforcing Conditional Access Policies

Because the authentication prompt utilizes the modern Apple authentication frameworks, it passes the full device context to your Identity Provider. This allows you to construct strict Conditional Access policies in Microsoft Entra ID.

For example, you can create a policy targeting the “macOS Enrollment” application:

• Grant Control: Require Authentication Strength (Phishing-Resistant MFA).

When the user unboxes the Mac, they will be forced to insert their YubiKey (FIDO2 token) into the USB-C port to complete the enrollment. If an attacker steals the hardware and attempts to enroll it from a foreign country using a stolen password and SMS code, Entra ID will block the enrollment instantly.

Conclusion

Deploying Setup Assistant with Modern Authentication is mandatory for any enterprise adopting Zero Trust on macOS. By abandoning legacy webkit authentication and shifting to the native Extensible SSO framework during the out-of-box experience, IT teams can mandate hardware security keys, enforce location-based conditional access, and guarantee cryptographic compliance before a single byte of corporate data touches the hard drive.