Deployment, Imaging, and Management
This domain covers how Macs are provisioned and managed at scale. Modern questions focus on Automated Device Enrollment, MDM, configuration profiles, volume ownership, and the end of monolithic imaging, especially for Apple silicon.
Enrollment and management
Automated Device Enrollment assigns newly purchased or erased Macs to an organization’s MDM server. Enrollment can be device-level or user-level; device enrollment gives management more control, while user enrollment separates personal and work data. Configuration profiles deliver Wi-Fi, certificates, restrictions, and payload settings. Apps and Books can assign licenses, and MDM can push commands, query inventory, and enforce settings. Bootstrap Token and Secure Token are central to management and FileVault workflows on Apple silicon.
Imaging and recovery
Monolithic imaging is legacy: Apple silicon Macs do not support booting an external imaging workflow the way Intel Macs once did. Use MDM enrollment, Erase All Content and Settings, Recovery, and DFU restore or revive as appropriate. Erase All Content and Settings returns a Mac to setup while preserving the OS; DFU can revive firmware or restore a Mac that will not start. Always confirm activation lock and organization ownership before erasing.
Worked example
A fleet of new Macs must be productive with no hands-on setup. Reasoning: assign the devices to the MDM server in Automated Device Enrollment, scope a prestage enrollment profile, and deliver Wi-Fi, certificates, and restrictions by configuration profile. Do not create a monolithic image; it is unsupported for Apple silicon and fights the enrollment model. Verify Bootstrap Token escrow and FileVault settings after enrollment.
Traps
- Treating imaging as the default for Apple silicon is a common mark-losing answer.
- Erase All Content and Settings is not the same as DFU restore.
- Activation Lock can block redeployment even after a wipe.
- User enrollment and device enrollment have different privacy and control boundaries.