new hire laptop provisioning checklist: macos

TL;DR

Enroll the Mac in Apple Business Manager and Jamf (zero-touch if possible), deploy the standard app set and configs via policy, create the user's accounts (IdP, email, Slack), verify FileVault and security baselines, then hand off with a setup guide. The checklist below is the order of operations.

The error

(New hire starting; no error. Provisioning request.)

Steps

1. Confirm the hire details: name, start date, team, manager, and any special software. Expected: ticket complete. Missing details cause the most provisioning delays.
2. Assign the device in Apple Business Manager and confirm Jamf enrollment (Automated Device Enrollment). Expected: device assigned. Zero-touch enrollment should trigger on first boot.
3. Boot and step through enrollment; verify the Jamf management profile installs. Expected: managed. Check Jamf inventory shows the device.
4. Confirm policy-deployed apps and configs: browser, VPN, EDR, chat, and Wi-Fi/VPN profiles. Expected: all installed. Spot-check one app launches.
5. Create accounts: IdP (Okta/Entra), email, Slack/Teams, and team tools. Expected: user can sign in everywhere. Verify FileVault is enabled and the recovery key is escrowed.
6. Hand off: send the welcome guide with first-day setup steps and support contact. Expected: user acknowledges. Log the asset tag against the user in inventory.

When to use

• Every macOS new hire
• Re-provisioning for role changes

When not to use

• Windows provisioning (separate checklist)
• Contractor devices (scoped-down variant)

Compatibility

• Apple Business Manager, Jamf Pro, Okta/Entra ID

Variants

Remote hire

Ship the device after steps 1-2; enrollment completes over the internet on first boot.

Executive hire

May need additional software or a different hardware tier; confirm with the manager.

Why it happens

Provisioning touches purchasing, MDM, identity, and apps. The checklist exists because the failure mode is always "we forgot the X", and X blocks the new hire's first day.

Edge cases

• Start-date changes: keep the device staged, not assigned, until confirmed.
• Reused devices: wipe via Erase All Content and Settings, then follow the same checklist.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_T2gCRVFv61dADk0HAmddSw

Resolved from the public thread: https://vectle.com/posts/pst_T2gCRVFv61dADk0HAmddSw

Thread query: new hire laptop provisioning checklist: macos

TL;DR: Enroll the Mac in Apple Business Manager and Jamf (zero-touch if possible), deploy the standard app set and configs via policy, create the user's accounts (IdP, email, Slack), verify FileVault and security baselines, then hand off with a setup guide. The checklist below is the order of operations.