Enroll a Mac into MDM During macOS 13 Deployment

Enrolling a Mac into a Mobile Device Management (MDM) server during macOS 13 (Ventura) deployment ensures the machine is securely configured, monitored, and compliant before reaching the end-user. This guide details the step-by-step methods to achieve enrollment during deployment, focusing on Automated Device Enrollment (ADE) via Apple Business Manager as the standard deployment path, as well as manual enrollment via Setup Assistant.

Method 1: Automated Device Enrollment (ADE)

Automated Device Enrollment via Apple Business Manager (ABM) or Apple School Manager (ASM) is the recommended deployment method. It forces the device into management automatically out of the box during the initial Setup Assistant.

Prerequisites

  • An Apple Business Manager or Apple School Manager account.
  • An active MDM solution (e.g., Jamf, Microsoft Intune, Kandji, Mosyle).
  • The Mac device assigned to your MDM server inside ABM/ASM.
  • Active internet connection (Wi-Fi or Ethernet).

Step 1: Assign the Mac to Your MDM Server

  1. Log in to Apple Business Manager or Apple School Manager.
  2. Navigate to Devices and search for the Mac's serial number.
  3. Select the Mac and click Edit MDM Server.
  4. Assign the device to your connected MDM server.

Step 2: Configure the Enrollment Profile in Your MDM

  1. Open your MDM administrator console.
  2. Navigate to your Automated Device Enrollment / PreStage Enrollment settings.
  3. Define the setup parameters (e.g., enforce mandatory management, configure local administrator account creation, and skip redundant Setup Assistant screens).
  4. Save the enrollment profile and ensure the target Mac is scoped to it.

Step 3: Trigger Enrollment on the Mac

  1. Power on the Mac (or erase it via System Settings > General > Transfer or Reset > Erase All Content and Settings if it was previously configured).
  2. Select your language and region.
  3. Connect the Mac to the internet via Wi-Fi or Ethernet.
  4. The Mac automatically contacts Apple's activation servers, checks its serial number, and downloads the MDM configuration.
  5. When the Remote Management screen appears, click Continue.
  6. Follow any identity provider (IdP) authentication prompts configured in your MDM. The enrollment profiles, management certificates, and base software packages will install automatically.

Method 2: Manual Device Enrollment via Setup Assistant

If the Mac is not registered in Apple Business Manager, you can enroll it manually during the provisioning process using an enrollment profile URL.

Step 1: Complete Initial macOS 13 Setup

  1. Turn on the device and progress through the macOS Setup Assistant.
  2. Create a temporary local administrator account to configure the machine.
  3. Connect to the internet.

Step 2: Download the MDM Enrollment Profile

  1. Launch Safari.
  2. Enter your MDM provider’s specific user enrollment or device enrollment URL.
  3. Authenticate with your administrator or user credentials when prompted.
  4. Click Allow when prompted to download the configuration profile.

Step 3: Install the Profile in macOS 13 System Settings

  1. Open System Settings (Apple menu > System Settings).
  2. Locate the notification under your account name that states Profile Downloaded, or navigate to Privacy & Security > Profiles.
  3. Double-click the downloaded enrollment profile.
  4. Click Install... and enter the local administrator credentials.
  5. Complete the installation to establish the trust relationship between the Mac and the MDM server.