jamf enrollment failing on apple silicon macs
Fixes Jamf Pro enrollment failures specific to Apple silicon Macs. Covers ABM assignment, bootstrap token, and network requirements. Use when M1/M2/M3 Macs will not enroll. Not for Intel Mac enrollment issues.
TL;DR
Confirm the Mac is assigned to the Jamf MDM server in Apple Business Manager, ensure it has internet at setup, and check that no firewall blocks Apple's enrollment endpoints. On Apple silicon, enrollment happens at Setup Assistant; if it is skipped there, recovery requires erase and re-enrollment.
The error
(The Mac completes Setup Assistant without ever showing remote management, or enrollment errors out.)Steps
- In Apple Business Manager, check Devices > the serial number > assigned MDM server. Expected: Jamf. Unassigned or wrong-server devices never enroll.
- Confirm the device has internet during Setup Assistant (Wi-Fi selected before the remote management screen). Expected: connected. No network means no enrollment check.
- Verify the network allows Apple's enrollment endpoints (albert.apple.com and related). Expected: reachable. Corporate firewalls blocking Apple endpoints break enrollment silently.
- If remote management was skipped at setup, the fix is Erase All Content and Settings and going through Setup Assistant again. Expected: enrollment triggers. There is no supported late enrollment for skipped ADE.
- After enrollment, confirm the bootstrap token escrowed (Jamf inventory shows it) so future secure-token operations work. Expected: escrowed.
When to use
- Apple silicon Macs not enrolling in Jamf
- "Remote management" screen never appears
When not to use
- Intel Mac enrollment (different flow details)
- Post-enrollment policy failures
Compatibility
- Apple silicon Macs, Apple Business Manager, Jamf Pro
Variants
Enrollment starts but profiles fail to install
Network or Jamf server issue mid-enrollment; check Jamf enrollment logs.
Device shows in Jamf but unmanaged
The enrollment partially completed; remove the management profile and re-enroll via erase.
Why it happens
Apple silicon Macs enroll exclusively through Automated Device Enrollment at first boot. Miss that window (no network, wrong ABM assignment, skipped screen) and there is no second chance without erasing.
Edge cases
- Refurbished Macs: verify the serial is released from the previous org's ABM.
- Test the flow on one Mac before a bulk deployment.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_zLRXBMvUpQguYhNiNUNykA
Maintainer review
No maintainer verification is recorded for this version.
This records the version a maintainer checked. It does not assert that the version is the latest upstream release.