With zero-touch deployment, a new Mac can go from sealed box to ready for work with one sign-in: apps, security tools and settings install on their own. Getting there needs a few things in place before the first device ships. This checklist walks through them in order.

You can also use the interactive version: the Mac Onboarding Checklist lets you tick items off and print or save it as a PDF.

1. Before Any Device Ships

  • Buy through Apple or a participating reseller linked to your organisation, so devices appear in Apple Business automatically.
  • Set up Apple Business (or Apple School Manager for education) and link your purchases: add your Apple customer number or reseller ID, and give your reseller your Organisation ID.
  • Connect your MDM server in Apple Business and set it as the default for new Mac devices.
  • Decide who owns the setup: the employee at home, or IT first and then a handover.

2. In Your MDM Platform

  • Enrolment profile: require enrolment, skip the screens users do not need and keep the user from removing management.
  • Account creation: decide how the user’s account is created, ideally with their work identity through Jamf Connect, Platform SSO or your MDM’s equivalent.
  • FileVault: turn it on during setup or at first sign-in, and escrow the recovery key in the MDM. Make sure the user’s account can unlock the disk.
  • Configuration profiles: Wi-Fi, VPN, firewall, screen lock, privacy settings and any restrictions your security baseline needs.
  • Day-one apps: the apps everyone needs (browser, Microsoft 365 or Google Workspace, chat, video calls), installed automatically at enrolment.
  • Security tools: EDR, DLP or other agents, deployed with the settings and permissions they need so they work without prompting the user.
  • Updates: a macOS update plan, so a new device does not start life months behind.

3. Test It Like a New Starter

  • Enrol a test Mac from a factory reset, on a home network, as a standard user.
  • Time it from first power-on to ready for work.
  • Check every app opens, the security tools report in, and FileVault is on with the key escrowed.
  • Fix anything that needed a person to step in.

4. Choose the Handover Workflow

Straight to the employee. The Mac ships sealed to the person. They turn it on, sign in with their work account, and everything installs on its own. No IT visit needed.

Prepared by IT, then handed over. The Mac arrives at IT. A technician completes setup with a setup account, lets the apps and security tools install, then shuts it down and hands it over. The employee signs in with their work account, which creates their own account on the Mac, and is ready to work.

Many organisations use both: zero-touch for remote staff, IT preparation for executives or special roles.

5. On Day One

  • The user signs in with their work account.
  • Apps and security tools finish installing; the user sees progress, not a blank screen.
  • A self-service app catalogue (such as Jamf Self Service or Intune Company Portal) is available for optional apps.
  • The user knows where to ask for help.

6. After Day One

  • Inventory confirms the device is compliant.
  • The device is in the right groups for its department.
  • When someone leaves, the same platform locks, wipes and reassigns the device.

How TexArxs Can Help

TexArxs sets up and runs zero-touch Mac deployment, including the apps and security tools your people need on day one. See our Apple and Mac services or the case study where Mac setup went from over two hours to under 30 minutes, then talk to us.