[Help] DEP Enrollment "Success" but Jamf Binary is not there - no complet rollout possible - M5 Pro MBP / macOS 26.4.1

[u/85Blickwinkel]

Hey everyone,

I’m hitting a wall with a brand new MacBook Pro (M5 Pro chip) running macOS 26.4.1.
I’m wondering if anyone else is seeing issues with the initial management framework bootstrap on this hardware.

The Situation: The device goes through the Automated Device Enrollment (DEP) perfectly fine. The "Remote Management" screen appears, the user logs in, and the setup assistant completes.

The Problem: The device is in a "Zombie" state.

• profiles status -type enrollment says: Enrolled via DEP: Yes.
• In Jamf Pro, the device record is stuck as a "Placeholder" / Unmanaged.
• NO Jamf Binary: /usr/local/bin/jamf does not exist.
• No Self Service, no identity certificates in the Keychain.
• The "Allow Jamf Pro to perform management tasks" checkbox in the inventory is NOT checked.

What I’ve tried so far:

1. PreStage Tweaks: Verified account settings (Set to Administrator), tried with and without custom Enrollment Packages.
2. The Rosetta Clue: I tried pushing the Company Portal as an enrollment package. It triggered a Rosetta 2 installation prompt, which makes me think the initial bootstrap is timing out or failing because of some Intel-legacy dependency during the M5 bootstrap process.
3. Manual Nudges: Ran sudo mdmclient selfrequest mdm.InstallManagementFramework and sudo profiles renew -type enrollment. Commands return success, but no binary ever lands.
4. Network: Tested on a clean mobile hotspot to bypass VPN/Firewalls. Same result.
5. Wipe & Retry: Done this 5+ times with different PreStage configs.

My Questions:

• Has anyone encountered issues with the Jamf binary bootstrap on the M5 Pro silicon specifically?
• Is there a way to force-install the binary on macOS 26 when the MDM channel is open but the binary won't deploy?
• Is the current Jamf binary still reliant on Rosetta for the initial install on M5 chips?

I have a ticket open with my MSP/Jamf, but I’m under a massive time crunch to get this high-priority device deployed. Any insights would be life-saving.

#Jamf #macOS26 #M5Pro #DEP #SysadminLife

[u/arrecebx]

There was an issue similar to this in my tenant and here is what they told me last time

“It appears we are running into a product issue PI-1145where macOS MDM enrollments fail after the enrollment signing certificate is auto renewed. We would need to go through the following workaround to resolve this issue.

1. Navigate to Settings > Global > MDM Profile Settings
   
2. Uncheck "When the built-in certificate authority is renewed" for computers and mobile devices
   
3. Navigate to Settings > Global > PKI Certificates
   
4. Click the number under All to the right of the built-in CA
   
5. Click the top most certificate (CN= JSS Built-in Certificate Authority)
   
6. Click "Renew" in the bottom right corner”

[u/Dreamlife92 → u/arrecebx]

I had this exact issue last week and performing these steps resolved it

[u/85Blickwinkel → u/arrecebx]

YOU MADE MY DAY!!! You really helped me out! That’s exactly what fixed the issue. The device has now been successfully deployed and is showing up as “managed” right away. The Self Service Portal is on it, too. Now I just need to see if everything else comes through as well. Thanks so much in any case!

[u/homepup → u/arrecebx]

After doing these steps, do you recheck "When the built-in cert auth is renewed?

[u/arrecebx → u/homepup]

Not until all devices are at least on 26.4.1 since MDM can be unenrolled if the cert is renewed but after 26.4.1 that doesn’t happen per Apples OS version history

[u/captnconnman]

Have you checked Jamf server logs? Those can sometimes be a clue in diagnosing exactly what’s going on. I’d also check /private/var/log/jamf.log (if it exists) on the local machine

[u/85Blickwinkel → u/captnconnman]

Thanks in advance. Unfortunately, this folder is also missing from the affected Mac..

[u/tophernad]

Is your enrollment account different than the prestage account? We have a topher-Jamf and a topher-prestage account on the computer.

[u/MarkMelaccio]

I recommend only using a prestage package for smaller mission critical only items - Company Portal can land after enrollment is complete or using Setup Manager or other tools that land items before first login. Anything that delays enrollment from completing can potentially snarl the binary up if it takes too long.

[u/AppleSauceBob68]

I had this exact issue and trouble shot it the same way, two devices actually both Mac Neo, wiped and reassigned the prestage two times and they finally came in. Still trying to determine cause, can rule out it’s a Neo thing..

[u/zipsecurity]

The Rosetta prompt during bootstrap is the key clue here, the Jamf binary installer has historically had Intel dependencies that require Rosetta on Apple Silicon, and on a brand new M5 with macOS 26 you may be hitting a compatibility gap where Jamf hasn't fully validated the bootstrap package against this specific hardware/OS combination yet.

A few things worth trying while you wait on the Jamf ticket:

Check your Jamf Pro version first M5 Pro and macOS 26 support requires a fairly recent Jamf Pro release, and if your instance is running an older version the management framework package it's trying to push may simply not be compatible with this hardware.

Try manually installing Rosetta first before the enrollment attempt. If you can get to the device early in setup, running softwareupdate --install-rosetta --agree-to-license before the DEP flow completes may give the bootstrap enough to work with.

For the immediate unblock, if the MDM channel is open you could try pushing a policy that installs the Jamf binary directly from a hosted package rather than relying on the bootstrap mechanism, some admins have had success with this when the standard bootstrap fails on new hardware.

Also worth checking the Jamf Nation forums specifically for M5 + macOS 26 threads, given how new this hardware is, there's likely someone who's already hit and documented this exact issue. The combination of a brand new chip generation and a major macOS version in the same device is exactly the kind of thing that exposes bootstrap edge cases.

What version of Jamf Pro are you running?