Zero-Touch Enrollment Stalls for 150 New Macs at a Warehouse Site
A company receives 150 MacBook Pro laptops at a warehouse. All are assigned in Apple Business Manager to the MDM server, and the enrollment profile skips most Setup Assistant panes and is set to 'Await configuration'. The warehouse has guest Wi-Fi behind a captive portal and an Ethernet network that requires 802.1X; the staging desk has a small unmanaged switch and no certificate infrastructure. Setup Assistant reaches Remote Management, spins for 20-30 minutes, then fails with 'The server returned an unexpected response'. About 20 devices get stuck at 'Applying configuration'; others time out and fall out of the ADE flow. The MDM has a valid push certificate and a bootstrap token from an earlier fleet. Content caching exists only at HQ. The installer is macOS 14.6.
1. Diagnose the enrollment failures and explain the difference between the timeout at Remote Management and the 20 devices stuck at 'Applying configuration'.
Read the worked answer
Setup Assistant needs to reach Apple's activation and MDM enrollment endpoints over the internet. The guest Wi-Fi captive portal intercepts that traffic, so the device can associate but cannot complete TLS to the enrollment service; the 20-30 minute spin and 'unexpected response' are consistent with portal interception or an allowlist block. The Ethernet path is worse before enrollment because 802.1X requires a certificate the device does not yet have. 'Applying configuration' means those 20 got further: they enrolled and are waiting for the MDM to finish sending profiles or for the device to acknowledge them. They are not the same failure; one is reachability, the other is a configuration or acknowledgment timeout. A bootstrap token from an earlier fleet does not help a device that cannot reach the MDM, and 'Await configuration' deliberately holds the device until the MDM releases it.
2. Design the staging network and process for the remaining devices. Include the constraint that the warehouse has no certificate infrastructure.
Read the worked answer
Stand up a temporary staging VLAN with DHCP, NAT to the internet, no captive portal, and no 802.1X; use wired Ethernet at the staging desk. Allow Apple activation, APNs, and the MDM hostnames through the firewall, and verify with a test Mac before opening the batch. Keep the ABM assignment and MDM enrollment profile ready, and do not use 'Await configuration' unless the MDM blueprint is complete. Stage in batches of 10-15 so failures are contained, and record serial numbers as devices complete. Put a content cache at the staging site or pre-cache the macOS 14.6 installer at HQ and ship it, because 150 devices downloading over the warehouse link will compete with enrollment. Once enrolled and configured, move devices to the production 802.1X network; do not try to solve 802.1X before enrollment.
3. What can you do for the 20 stuck devices and the ones that fell out of the ADE flow without creating a wipe-first habit?
Read the worked answer
For the 20 at 'Applying configuration', first restore a clean network path and let the MDM finish; check the MDM console for pending commands and profile acknowledgments, and resend the install profile rather than erasing. If a device is truly stuck, restart it and resume Setup Assistant; if it has fallen out of the ADE flow, confirm its ABM assignment, reassign it to the MDM, and re-enroll. Because these are new machines with no user data, erasing is acceptable as a last resort, but it should be a documented exception, not the default. For devices that already have user data, never erase to fix enrollment; use the MDM's re-enrollment or bootstrap token workflow. Track which devices are in ABM, which are enrolled, and which are merely activated. The habit to avoid is treating every enrollment timeout as a device fault when the network path is the common cause.