Skip to main content

​
Overview

A new Mac enrolls through Automated Device Enrollment (ADE) with only TruU and Microsoft Company Portal, registers Platform SSO (PSSO) with Microsoft Entra ID, and only then installs its apps through Jamf Pro’s native macOS Onboarding. The result mirrors the Intune “Welcome / Installation status” experience. Two Smart Groups do the waiting: Pre-Stage TruU Device Setup waits until Company Portal is in inventory, and Pre-Stage TruU Device Configuration holds every app until registration is complete.

​
Prerequisites

Everything below must exist in Jamf Pro before a Mac is wiped or unboxed. Names are examples; use your own naming convention.

​
Phase 1: ADE PreStage enrollment with TruU

The PreStage installs only what registration needs: TruU and Company Portal. All other apps are held back until Platform SSO registration is complete.
  1. Go to Computers → PreStage Enrollments → Prestage TruU → Edit.
  2. General: confirm the target Macs are assigned (Scope tab) and skip Setup Assistant screens per your standard.
  3. Configuration Profiles: attach these two:
    • TruU MA Application Configuration
    • TruU Account Provisioning
  4. Attach the Microsoft Platform SSO profile here as well.
  5. Enrollment Packages: attach exactly these three:
    • TruU ADE Tracker
    • TruU Authenticator
    • Company Portal
  6. Remove any other app packages (browsers, Teams, VPN clients, etc.) from Enrollment Packages. They install from Onboarding policies after registration.
  7. Save, reload, and verify the counts: 3 profiles, 3 packages.

​
Phase 2: Wait for Company Portal, then register Platform SSO

Two Smart Groups gate the flow: the first waits for Company Portal, the second waits for a completed registration.

​
2a. Smart Group: Pre-Stage TruU Device Setup (waits for Company Portal)

  1. Computers → Smart Computer Groups → New (or edit your existing PreStage group), name it Pre-Stage TruU Device Setup.
  2. Criteria: Enrolled via PreStage is Prestage TruU and Application Title is Company Portal.app.
  3. Save. A Mac joins only after Jamf inventory sees Company Portal installed.
Scope these items to this group:

​
2b. User registers Platform SSO

  1. Once the Platform SSO profile is active, macOS shows the Registration Required notification at login.
  2. The user clicks it and signs in with their Entra ID credentials (plus MFA if required).
  3. macOS registers the device in Entra ID and enables SSO.

​
2c. Registration check: Extension Attribute + post-registration policy

  1. Extension Attribute “PSSO Registration Status” (Settings → Computer management → Extension attributes). A script that runs app-sso platform -s as the logged-in user at every inventory and reports Registered, Not Registered or No User.
  2. Policy “PSSO - Post-Registration Onboarding”, triggers Login and Recurring Check-in, scoped to Pre-Stage TruU Device Setup. Its script does the same app-sso check. While not registered it does nothing; once registrationCompleted : true, it runs jamf recon and opens Self Service.

​
2d. Smart Group: Pre-Stage TruU Device Configuration

  1. Criteria: member of Pre-Stage TruU Device Setup and PSSO Registration Status is Registered.
  2. All Onboarding policies (Phase 3) are scoped to this group, so no app installs before registration.
  3. Exclude Pre-Stage TruU Device Setup from any existing app policies scoped to All Computers (for example, a Teams update policy at recurring check-in) so they cannot install apps before registration.

​
Phase 3: Installomator script and onboarding app policies

Each app installs from its own policy that runs the Installomator script with an app label, scoped to Pre-Stage TruU Device Configuration.

​
3a. Script

This is a custom wrapper script, not a built-in Jamf item. It downloads the open-source Installomator at run time and installs the app named in Parameter 4. If your Jamf Pro already has an Installomator script, use it and skip to 3b.
  1. Go to Settings → Computer management → Scripts → New.
  2. General tab: Display Name Installomator - Install App.
  3. Script tab: paste the script below.
  4. Options tab: Parameter 4 label Installomator label; Parameter 5 label Installomator version (tag or branch, optional).
  5. Save.
Installomator - Install App
DEBUG=0 is required: the script on GitHub defaults to debug mode, which downloads but does not install. NOTIFY=silent hides Installomator’s own pop-ups (Self Service onboarding shows progress), and BLOCKING_PROCESS_ACTION=kill closes a running copy of the app so the update can install. For production, set Parameter 5 to a release tag from the Installomator releases page instead of main.

​
3b. Policies

For each app row: Computers → Policies → New. Execution Frequency Once per computer; add the Installomator script with Parameter 4 = the label; Scope = Pre-Stage TruU Device Configuration; Self Service = enabled.
Add all other apps required during device setup (for example security agents, VPN clients, or line-of-business apps) as Onboarding policies the same way, and order them before the Final Configuration policy. Installomator has labels for most common apps; for apps without a label, upload the vendor .pkg to Settings → Packages and add it to the policy instead of the script. Scope any configuration profiles those apps need (system extensions, Full Disk Access, Wi-Fi) to Pre-Stage TruU Device Setup so they arrive before the installer runs.
Final Configuration restart options: no user logged in → restart immediately; user logged in → restart after a 5-minute notice. Run it only as the last Self Service onboarding step.

​
Phase 4: Self Service macOS Onboarding and final restart

Jamf’s native macOS Onboarding gives the user an Intune-style “Welcome / Installation status” screen listing each app as it installs.
  1. Settings → Self Service → macOS Onboarding → Edit, set to Enabled.
  2. Add a Welcome screen (company name, logo, short text such as “We’re setting up your Mac”).
  3. Add an Installation step and select the Onboarding app policies in order.
  4. Add Onboarding - Final Configuration and System Restart as the last item.
  5. Save.
  6. Onboarding starts when the user first opens Self Service. The post-registration policy (Phase 2c) opens Self Service right after registration, so the user lands on the onboarding screen.

​
Testing and validation checklist

Wipe a test Mac and confirm each check in order.
  1. Setup Assistant shows Remote Management and enrolls into Jamf Pro.
  2. Only TruU ADE Tracker, TruU Authenticator and Company Portal install during setup.
  3. The computer record shows membership in Pre-Stage TruU Device Setup after Company Portal installs.
  4. The Microsoft Platform SSO profile installs during enrollment.
  5. At first login the Registration Required notification appears; no other apps install.
  6. The user signs in with Entra ID + MFA and registration completes.
  7. app-sso platform -s | grep -i registrationCompleted returns true.
  8. Extension Attribute PSSO Registration Status = Registered; the Mac is in Pre-Stage TruU Device Configuration.
  9. Self Service opens to the onboarding screen; all app policies complete.
  10. The Final Configuration policy updates inventory and restarts (5-minute notice if logged in).