Mac Deployment SOP

Step Zero · Do This At Every Desk

Look Up The Person. Match The Serial.

Two questions decide everything that follows: who is this machine for, and does its serial number match what the roster says. Answer both before you erase anything.

Path A — Already registered

Erase and hand back

16 machines · already in ABM, already ADE-enrolled

Phase 1 — back up, ask about bookmarks, sign out of iCloud
Phase 2 — Erase All Content and Settings
Phase 3 — skip. No Configurator, no orb.
Phase 4 — skip. Profile is already assigned.
Phase 5 — power on, it self-enrolls, user signs in

Path B — Not registered

Full enrollment

11 machines · not yet enrolled in ABM

Phase 0 — Configurator set up before you travel
Phase 1 — back up, bookmarks, sign out of iCloud
Phase 2 — Erase All Content and Settings
Phase 3 — scan the blue orb with Configurator
Phase 4 — assign the profile in Intune, then wait
Phase 5 — power on, it enrolls, user signs in

Confirm the serial before you erase

Read the serial off the machine ( → About This Mac) and match it against the roster. This is the one check that decides which path you're on — the roster is keyed on serial, not on name, so the serial is what tells you whether this machine is already registered.

The fleet is MDM-managed and the roster reflects the current assignments, so this should match every time. It takes five seconds and it is the difference between a ten-minute job and a thirty-minute one.

If a serial doesn't match the roster, stop and check with Shawn before erasing. Don't guess the path — a mismatch means the record and the machine disagree, and that is worth knowing before the machine is wiped.

27 Macs

Employee	Location	Serial	Path
Alicia Alexyn	Batavia	FVFFTTJVQ6L4	Path A
Eric Britson	North Carolina	J1YWXXD3H7	Path B
Sonya Buie	Wilmette	C02F54RDQ05P	Path B
Steven Butler	Colorado	TFJ6H714P9	Path B
Brooke Chartraw	Batavia	FVFF5F8DQ05F	Path B
Robert Credi	Batavia	Y9WJ6LHC44	Path B
Cristian De Rosa	Batavia	MF9F7GF9K0	Path A
Michelle Golino	Batavia	FVFFTWWHQ6L4	Path A
Jessica Golino-Smith	Batavia	FVFFV2MRQ6L4	Path A
Meg Hartman	Batavia	JTY6LG6Y46	Path A
Whitney Henderson	Batavia	FVFH2SL8Q6L4	Path A
Stephanie Kelver	Batavia	VWKP406NXM	Path B
Daniel Kent	Texas	LCLXDGCHXD	Path B
Mandy Krol	Arkansas	FVFFTQSQQ6L4	Path A
Lauren Kurkowski	Batavia	HRTJC9NKQ6L4	Path B
Sean Leary	Batavia	L2YMQ7HQFQ	Path A
Jake Mingle	Batavia	FVFH2RN8Q6L4	Path A
Katherine Mullen	Batavia	W0502PW1QX	Path A
Emma Pangrazio	Batavia	KT61W04J6J	Path A
Robert (Bobby) Reid	Colorado	FVFFV56TQ6L4	Path A
Levi Scott	Texas	FWQ120X1G7	Path A
Matt Stansell	North Carolina	HRTJ70S9Q6L4	Path B
Jessica Streiff	Batavia	JWVTDWDWLF	Path B
Kimberly Thompson	Batavia	FVFFVZ83Q6L4	Path A
Brandie Waite	Batavia	FVFJG0BDQ6L4	Path B
Darren Wales	Texas	FVFH5N31Q6L4	Path A
Ed Wilkosz	Batavia	J9YPGJMGKP	Path A

Stephanie Kelver and Sonya Buie

Stephanie Kelver — VWKP406NXM and Sonya Buie — C02F54RDQ05P are not in Apple Business Manager yet. Both run Path B, full enrollment, same as the other nine in that group. Nothing special to do — they are called out here only because they were asked about.

Where this roster comes from

Built from the Thermory Devices inventory — the In ABM and Enrolled Via ADE columns. The source sheet stays authoritative; if the two ever disagree, believe the sheet and tell Shawn.

Macs only. The five Windows devices in the inventory — Angela Brownlee, Mark Challinor, Karen Hirata, Anna Rossi, and the Wilmette conference room — are out of scope for this SOP.

The Workflow

Six Phases, In Order

Path A runs Phases 1, 2 and 5 only. Path B runs all six — and Phase 4 is the one that can stall, so plan the day around it.

Pre-work — before you travel Path B

Complete all of this before arriving on site. None of it can be done at the desk.

Only needed for the 11 Path B machines

Apple Configurator is only used to add a Mac that isn't in Apple Business Manager yet. The 16 Path A machines never touch it. Set it up before you travel regardless — it costs ten minutes at home and cannot be done at the desk.

Accept the Apple Business Manager invitation.
Shawn has sent an invite to create your Managed Apple Account. It ends in @thermoryusacom.appleid.com — this is not your normal Apple ID and not your Thermory email. Complete setup fully, including two-factor.
Install Apple Configurator on your iPhone.
Free from the App Store. Requires iOS 16 or later. The iPhone app is the one that can enroll Macs — the Mac version cannot.
Sign in to Apple Configurator with the Managed Apple Account.
Not your personal Apple ID. The Settings screen should show THERMORY USA, LLC as the organization.
Configure the two settings shown below.
Set once, then leave alone. If either is wrong, every enrollment silently goes to the wrong place.
Confirm you can actually manage devices in Intune.
Before you fly: verify you can assign and remove an enrollment profile on a test machine. This is the current blocker — see Open Items.

Apple Configurator Settings showing organization THERMORY USA, LLC and Share Wi-Fi checked — **1 — Organization + Share Wi-Fi.** Must read **THERMORY USA, LLC**. Check **Share Wi-Fi**.

Apple Configurator showing Device Management Service Assignment set to Specific with Intune Thermory selected — **2 — Assignment.** Scroll down. Choose **Specific** — not None, not Default. Then **Intune Thermory**.

Choose Device Management Service list showing Addigy and Intune Thermory, with Intune Thermory checked — **3 — Pick the right one.** Addigy is the old system. The check must be on **Intune Thermory**.

About the Wi-Fi network

The screenshots show YASK because that was Shawn's network at the time. Yours will differ — and that matters: whatever network the iPhone is on is the network it hands to the Mac. Before you start, put the phone on the network the Mac should end up on.

The single most common mistake

Addigy is still listed as a device management service. We are migrating off it. If a Mac gets assigned to Addigy instead of Intune Thermory, it enrolls into the wrong MDM and you erase and start over. Verify Specific → Intune Thermory before the first machine, and spot-check after any app update.

Prep the Mac Path A Path B

On site · ~5 minutes · Both paths · Do not skip step 1

Write down the serial number, then look it up in the roster. Do this first.
→ About This Mac. Once the Mac is erased you cannot read the serial from the OS — and this one number decides both which path you're on and, on Path B, how you find the machine again in Phase 4's list of serials.

Confirm the serial matches the person you're standing with. If it doesn't match, or isn't in the roster at all, the machine is Path B. If several machines are running at once, label each serial with the user's name.
Confirm Desktop and Documents are fully synced to OneDrive.
Open the OneDrive menu bar icon and confirm it reads "Up to date" — not "Syncing." Anything unsynced is gone permanently after Phase 2.
Ask about bookmarks.
This is the one thing users reliably panic about afterward. Two cases:

Signed in to Chrome with their Thermory USA account — nothing to do. They sign back in on the rebuilt machine and bookmarks, extensions and history come back on their own.

Not signed in — export before erasing. Chrome → Bookmarks → Bookmark Manager → ⋮ → Export Bookmarks. Save the HTML file into OneDrive, not the Desktop, and import it after Phase 5.
Check for anything else outside Desktop and Documents.
Mainly Downloads and anything saved to a local-only folder. OneDrive folder redirection does not cover these.
Sign out of iCloud and Find My.
→ System Settings → [Apple Account] → Sign Out. Skip this and Erase All Content and Settings will demand the user's personal Apple ID password mid-wipe — and if they don't remember it, you are stuck with a half-erased machine.

Erase the Mac Path A Path B

On site · ~5 minutes, mostly unattended · Both paths

Open System Settings and run Erase All Content and Settings.
→ System Settings → General → Transfer or Reset → Erase All Content and Settings
Let it restart and complete.
Not time-intensive. The Mac reboots and comes back at the Pick a Language screen. Leave it there.

Path A stops here — skip to Phase 5

If this machine is Path A, it is already in Apple Business Manager with an enrollment profile assigned. Do not open Apple Configurator. Do not look for the blue orb. Just walk it forward through Setup Assistant — it will find its own profile and enroll itself. Go straight to Phase 5.

Phases 3 and 4 exist to put a machine into that state. A Path A machine is already there.

Add the Mac to Apple Business Manager Path B only

On site · ~2 minutes · Path B only · The step that must be timed correctly

Leave the Mac on and advance past Pick a Language.
The enrollment target appears in the gap between the language screen and the country screen.
Watch for the blue orb.
A floating blue shape made of many dots, slowly rotating. This is the Mac broadcasting that it is available for Configurator enrollment.
Open Apple Configurator on the iPhone and point the camera at the orb.
Hold steady until it registers. The Mac is added to Apple Business Manager and assigned to Intune Thermory. Your iPhone's Wi-Fi credentials are handed over at the same time.
Confirm the "Added" screen, then choose Shut Down — not Restart.
Go to Phase 4 and come back to power it on.

Mon Jun 6 9:41 AM

Add this Mac to Your Organization

Position this image in the frame of Apple Configurator.

Pair Manually Back

The target. Appears between the language and country screens. Point the Apple Configurator camera at the blue dot cloud. If you can see Pair Manually, you're on the right screen.

Mon Jun 6 9:41 AM

✓

Added

This Mac has been added to “Thermory USA, LLC”.

Assign this Mac to an MDM server in Apple Business Manager to configure its enrollment settings and enable Automated Device Enrollment.

Restart Shut Down

Confirmation. Read the second line carefully — it is telling you the job is only half done. Being in ABM is not being assigned. That assignment is Phase 4 and has not happened yet. Choose Shut Down, not Restart.

If it won't connect — work this list in order

The Mac sometimes has trouble reaching the internet during this step. It is common and it is not a sign anything is broken. Stop as soon as it works:

Just try again. Re-scan the orb. A surprising share of failures clear on the second attempt. Do this before anything else — it costs ten seconds.
Join Wi-Fi manually, then back out. Go forward through Setup Assistant until you reach the Wi-Fi picker and connect. Then back up all the way to the language screen. Advance again and the orb reappears, this time with a working connection.
Restart the Mac. Worst case. You have lost nothing — the machine is still freshly erased, so you land back at the language screen and start Phase 3 over.

None of these risk the enrollment. Nothing has been assigned yet, so there is nothing to corrupt.

Stop — do not press Restart

This is the step that breaks the whole process if you get it wrong. Being in Apple Business Manager is not the same as being assigned an enrollment profile in Intune. The Mac asks Apple "do I have a profile?" exactly once, during Setup Assistant.

If you restart now, Intune does not know the machine exists yet, Apple answers "no profile," and the Mac sets itself up as an ordinary personal computer. It will never retroactively enroll. The only recovery is to erase and start over from Phase 2.

Apple's own guidance is explicit: do not proceed through Setup Assistant after adding a device manually until it has been assigned. Shut Down parks the machine safely while you do Phase 4.

Assign the enrollment profile in Intune Path B only Unverified

On site · ~15 min to 12 hours · Path B only · Requires Intune admin rights

Go to the enrollment program tokens page.
Intune admin center → Devices → Enrollment → Apple
→ Enrollment program tokens → Intune Thermory → Devices

ADE devices do not appear under Devices → All devices until they have finished enrolling. Before that they exist only on this page. Look in the wrong list and you will think the process failed when it hasn't.
Click Sync, then wait. Budget for this taking a while.
In practice it has landed in about 15 minutes. Microsoft documents up to 12 hours as normal, and the automatic sync only runs about every 24 hours. If nothing shows, click Sync again — the manual button can be triggered once every 15 minutes. Keep clicking it; do not sit and wait on the automatic cycle.
Find the serial number you wrote down in Phase 1.
The list may hold several machines with nothing to tell them apart but the serial. This is why step 1 of Phase 1 matters.
Check the box next to that serial and click Assign profile.
Select the macOS enrollment profile for Thermory.
Confirm the profile shows as assigned before moving on.
Do not power the Mac on until you can see it.

Plan the day around this — the one unpredictable step

Everything else in this SOP is measured in minutes. This is not. Observed: ~15 minutes. Documented worst case: up to 12 hours.

Consequence: a Mac can sit shut down after Phase 3 for as long as needed. Nothing expires, nothing is lost. If a machine hasn't appeared by end of day, leave it off, assign the profile whenever it surfaces, and power it on the next morning for Phase 5.

So run Phases 1–3 on all eleven Path B machines first, as a batch, and let them all sync while you work. Do not take one Path B machine end-to-end and then start the next — you will spend the day watching a sync page.

Then fill the wait with Path A machines. Those have no sync step and no unpredictable stall, so they can go one at a time, start to finish, while the Path B batch works through Intune in the background. If the day gets short, Path A machines are the ones you can reliably finish.

How the sync actually works

Apple does not push to Intune. Intune pulls from Apple Business Manager, automatically about once every 24 hours. The 15-minute figure is the throttle on the manual Sync button — it is not a background cycle. If nobody clicks Sync, a device can sit invisible for most of a day even though ABM already has it.

Power on and let it enroll Path A Path B Unverified

On site · Both paths · time depends on software payload size

Power the Mac back on.
Path A: the machine never shut down — it is sitting at Pick a Language after Phase 2. Just carry on through Setup Assistant.

Path B: only now that the profile is confirmed assigned in Phase 4.
Let it connect and complete Setup Assistant.
It should pull the enrollment profile from Intune and begin installing the required software.
Have the user sign in, then verify before you walk away.
They sign in with their Thermory USA account. Confirm the Mac is actually managed — → System Settings → General → Device Management should show a Thermory profile. No profile means enrollment did not happen, and the fix is to erase and start over, so check it while you are still standing there.

If bookmarks were exported in Phase 1, import the HTML file from OneDrive now. Confirm Desktop and Documents are downloading back from OneDrive.

Expected end state — to be confirmed Monday

OneDrive and Outlook signed in automatically. Desktop and Documents begin downloading from OneDrive. Required Thermory software installed.

This has not been proven yet. Shawn will validate Monday once admin rights are granted and will update this document.

Item	Status	Detail
Path A end-to-end test	Blocker	Erase one Path A machine and confirm it re-enrolls on its own and lands in Intune Thermory, not Addigy. These machines were enrolled before the migration, so their ABM assignment may still point at the old MDM. Prove it on one machine before running the other fifteen.
Roster verified	Confirmed	Checked against a refreshed export of the inventory on July 20, 2026. All 27 serials and both path assignments match.
Intune admin rights	Blocker	Shawn can see devices in Intune but cannot assign enrollment profiles. Until granted, Phase 4 cannot be performed or verified. Expected Monday.
Profile assign + remove tested	Blocker	Paco and Russell must confirm they can both assign and delete profiles from machines — not just view them. Test before traveling, not on site.
End-user post-enrollment experience	Unverified	What the user sees after enrollment, and whether OneDrive and Outlook truly auto-sign-in, is untested.
ABM default MDM server	Unverified	Addigy still appears as a selectable MDM. Confirm the ABM default server for Mac points at Intune Thermory, not Addigy, so nothing auto-assigns wrong.
ABM accounts live	Unverified	Paco and Russell must accept invites and complete Managed Apple Account setup before travel.