Thermory USA · IT Operations

Mac Deployment SOP

Erasing an existing Mac and re-enrolling it into Apple Business Manager and Microsoft Intune with Apple Configurator. Written for on-site deployment.

Owner Shawn Lemon For Paco Lebron · Russell Sciolino July 17, 2026 Status Draft — partly unverified
Read this first

Phases 4 and 5 have not been proven end-to-end. I do not yet have the admin rights in Intune to assign an enrollment profile to a device — I can see devices, but I cannot assign. I expect that access Monday and will confirm the remaining steps then.

Everything through Phase 3 — the device landing in Apple Business Manager — is confirmed working. Steps marked Unverified are what should happen based on Apple and Microsoft documentation. Treat them as expected behavior, not tested fact.

The Workflow

Six Phases, In Order

Phases 0 through 3 are quick and predictable. Phase 4 is the one that can stall — plan the day around it.

0

Pre-work — before you travel

Complete all of this before arriving on site. None of it can be done at the desk.

  1. Accept the Apple Business Manager invitation.

    Shawn has sent an invite to create your Managed Apple Account. It ends in @thermoryusacom.appleid.com — this is not your normal Apple ID and not your Thermory email. Complete setup fully, including two-factor.

  2. Install Apple Configurator on your iPhone.

    Free from the App Store. Requires iOS 16 or later. The iPhone app is the one that can enroll Macs — the Mac version cannot.

  3. Sign in to Apple Configurator with the Managed Apple Account.

    Not your personal Apple ID. The Settings screen should show THERMORY USA, LLC as the organization.

  4. Configure the two settings shown below.

    Set once, then leave alone. If either is wrong, every enrollment silently goes to the wrong place.

  5. Confirm you can actually manage devices in Intune.

    Before you fly: verify you can assign and remove an enrollment profile on a test machine. This is the current blocker — see Open Items.

Apple Configurator Settings showing organization THERMORY USA, LLC and Share Wi-Fi checked
1 — Organization + Share Wi-Fi. Must read THERMORY USA, LLC. Check Share Wi-Fi.
Apple Configurator showing Device Management Service Assignment set to Specific with Intune Thermory selected
2 — Assignment. Scroll down. Choose Specific — not None, not Default. Then Intune Thermory.
Choose Device Management Service list showing Addigy and Intune Thermory, with Intune Thermory checked
3 — Pick the right one. Addigy is the old system. The check must be on Intune Thermory.
About the Wi-Fi network

The screenshots show YASK because that was Shawn's network at the time. Yours will differ — and that matters: whatever network the iPhone is on is the network it hands to the Mac. Before you start, put the phone on the network the Mac should end up on.

The single most common mistake

Addigy is still listed as a device management service. We are migrating off it. If a Mac gets assigned to Addigy instead of Intune Thermory, it enrolls into the wrong MDM and you erase and start over. Verify Specific → Intune Thermory before the first machine, and spot-check after any app update.

1

Prep the Mac

On site · ~5 minutes · Do not skip step 1

  1. Write down the serial number. Do this first.

    → About This Mac. Once the Mac is erased you cannot read the serial from the OS, and in Phase 4 you will pick this machine out of a list of serial numbers with no other identifying information. If several machines are running at once, label each serial with the user's name.

  2. Confirm Desktop and Documents are fully synced to OneDrive.

    Open the OneDrive menu bar icon and confirm it reads "Up to date" — not "Syncing." Anything unsynced is gone permanently after Phase 2.

  3. Ask about bookmarks.

    This is the one thing users reliably panic about afterward. Two cases:

    Signed in to Chrome with their Thermory USA account — nothing to do. They sign back in on the rebuilt machine and bookmarks, extensions and history come back on their own.

    Not signed in — export before erasing. Chrome → Bookmarks → Bookmark Manager → ⋮ → Export Bookmarks. Save the HTML file into OneDrive, not the Desktop, and import it after Phase 5.

  4. Check for anything else outside Desktop and Documents.

    Mainly Downloads and anything saved to a local-only folder. OneDrive folder redirection does not cover these.

  5. Sign out of iCloud and Find My.

    → System Settings → [Apple Account] → Sign Out. Skip this and Erase All Content and Settings will demand the user's personal Apple ID password mid-wipe — and if they don't remember it, you are stuck with a half-erased machine.

2

Erase the Mac

On site · ~5 minutes, mostly unattended

  1. Open System Settings and run Erase All Content and Settings.
    → System Settings → General → Transfer or Reset → Erase All Content and Settings
  2. Let it restart and complete.

    Not time-intensive. The Mac reboots and comes back at the Pick a Language screen. Leave it there.

3

Add the Mac to Apple Business Manager

On site · ~2 minutes · The step that must be timed correctly

  1. Leave the Mac on and advance past Pick a Language.

    The enrollment target appears in the gap between the language screen and the country screen.

  2. Watch for the blue orb.

    A floating blue shape made of many dots, slowly rotating. This is the Mac broadcasting that it is available for Configurator enrollment.

  3. Open Apple Configurator on the iPhone and point the camera at the orb.

    Hold steady until it registers. The Mac is added to Apple Business Manager and assigned to Intune Thermory. Your iPhone's Wi-Fi credentials are handed over at the same time.

  4. Confirm the "Added" screen, then choose Shut Down — not Restart.

    Go to Phase 4 and come back to power it on.

Mon Jun 6  9:41 AM

Add this Mac to Your Organization

Position this image in the frame of Apple Configurator.

Pair Manually Back
The target. Appears between the language and country screens. Point the Apple Configurator camera at the blue dot cloud. If you can see Pair Manually, you're on the right screen.
Mon Jun 6  9:41 AM
✓

Added

This Mac has been added to “Thermory USA, LLC”.

Assign this Mac to an MDM server in Apple Business Manager to configure its enrollment settings and enable Automated Device Enrollment.

Restart Shut Down
Confirmation. Read the second line carefully — it is telling you the job is only half done. Being in ABM is not being assigned. That assignment is Phase 4 and has not happened yet. Choose Shut Down, not Restart.
If it won't connect — work this list in order

The Mac sometimes has trouble reaching the internet during this step. It is common and it is not a sign anything is broken. Stop as soon as it works:

  1. Just try again. Re-scan the orb. A surprising share of failures clear on the second attempt. Do this before anything else — it costs ten seconds.
  2. Join Wi-Fi manually, then back out. Go forward through Setup Assistant until you reach the Wi-Fi picker and connect. Then back up all the way to the language screen. Advance again and the orb reappears, this time with a working connection.
  3. Restart the Mac. Worst case. You have lost nothing — the machine is still freshly erased, so you land back at the language screen and start Phase 3 over.

None of these risk the enrollment. Nothing has been assigned yet, so there is nothing to corrupt.

Stop — do not press Restart

This is the step that breaks the whole process if you get it wrong. Being in Apple Business Manager is not the same as being assigned an enrollment profile in Intune. The Mac asks Apple "do I have a profile?" exactly once, during Setup Assistant.

If you restart now, Intune does not know the machine exists yet, Apple answers "no profile," and the Mac sets itself up as an ordinary personal computer. It will never retroactively enroll. The only recovery is to erase and start over from Phase 2.

Apple's own guidance is explicit: do not proceed through Setup Assistant after adding a device manually until it has been assigned. Shut Down parks the machine safely while you do Phase 4.

4

Assign the enrollment profile in Intune Unverified

On site · ~15 min to 12 hours · Requires Intune admin rights

  1. Go to the enrollment program tokens page.
    Intune admin center → Devices → Enrollment → Apple
    → Enrollment program tokens → Intune Thermory → Devices

    ADE devices do not appear under Devices → All devices until they have finished enrolling. Before that they exist only on this page. Look in the wrong list and you will think the process failed when it hasn't.

  2. Click Sync, then wait. Budget for this taking a while.

    In practice it has landed in about 15 minutes. Microsoft documents up to 12 hours as normal, and the automatic sync only runs about every 24 hours. If nothing shows, click Sync again — the manual button can be triggered once every 15 minutes. Keep clicking it; do not sit and wait on the automatic cycle.

  3. Find the serial number you wrote down in Phase 1.

    The list may hold several machines with nothing to tell them apart but the serial. This is why step 1 of Phase 1 matters.

  4. Check the box next to that serial and click Assign profile.

    Select the macOS enrollment profile for Thermory.

  5. Confirm the profile shows as assigned before moving on.

    Do not power the Mac on until you can see it.

Plan the day around this — the one unpredictable step

Everything else in this SOP is measured in minutes. This is not. Observed: ~15 minutes. Documented worst case: up to 12 hours.

Consequence: a Mac can sit shut down after Phase 3 for as long as needed. Nothing expires, nothing is lost. If a machine hasn't appeared by end of day, leave it off, assign the profile whenever it surfaces, and power it on the next morning for Phase 5.

So run Phases 1–3 on every machine first, as a batch, and let them all sync while you work. Do not take one machine end-to-end and then start the next — you will spend the day watching a sync page.

How the sync actually works

Apple does not push to Intune. Intune pulls from Apple Business Manager, automatically about once every 24 hours. The 15-minute figure is the throttle on the manual Sync button — it is not a background cycle. If nobody clicks Sync, a device can sit invisible for most of a day even though ABM already has it.

5

Power on and let it enroll Unverified

On site · time depends on software payload size

  1. Power the Mac back on.

    Only now that the profile is confirmed assigned in Phase 4.

  2. Let it connect and complete Setup Assistant.

    It should pull the enrollment profile from Intune and begin installing the required software.

  3. Land at the desktop and verify.

    If bookmarks were exported in Phase 1, import the HTML file from OneDrive now.

Expected end state — to be confirmed Monday

OneDrive and Outlook signed in automatically. Desktop and Documents begin downloading from OneDrive. Required Thermory software installed.

This has not been proven yet. Shawn will validate Monday once admin rights are granted and will update this document.

Before Deployment

Open Items

What still has to be true before this workflow can run end-to-end on site.

ItemStatusDetail
Intune admin rights Blocker Shawn can see devices in Intune but cannot assign enrollment profiles. Until granted, Phase 4 cannot be performed or verified. Expected Monday.
Profile assign + remove tested Blocker Paco and Russell must confirm they can both assign and delete profiles from machines — not just view them. Test before traveling, not on site.
End-user post-enrollment experience Unverified What the user sees after enrollment, and whether OneDrive and Outlook truly auto-sign-in, is untested.
ABM default MDM server Unverified Addigy still appears as a selectable MDM. Confirm the ABM default server for Mac points at Intune Thermory, not Addigy, so nothing auto-assigns wrong.
ABM accounts live Unverified Paco and Russell must accept invites and complete Managed Apple Account setup before travel.

Reference

The Certificate Confusion

Apple's naming makes these sound like the same thing. They are not, and mixing them up is why enrollment appears to silently fail.

Apple MDM Push Certificate (APNs)
From identity.apple.com, uploaded to Intune. One per tenant. This is Intune's permission to talk to Apple devices at all. Expires annually and must be renewed with the exact same Apple ID that created it — renew with a different account and every Apple device in the tenant drops off management. Having this does not make devices appear.
ADE token / enrollment program token
Not a certificate, despite the naming. Intune issues a public key (.pem), you upload it to Apple Business Manager when creating the MDM Server, ABM returns an encrypted token (.p7m), you upload that to Intune. This is what makes the device list sync. Also expires annually.
Device Management Service = MDM Server = token
Three names for one link — Configurator calls it the first, ABM the second, Intune the third. "Intune Thermory" is ours. If the name in Configurator does not match a live token in Intune, devices land in ABM and Intune never sees them.