[ikornaselur]

You buy the hardware through an Apple business portal and Apple will register the machine to your MDM server. The first thing the laptop does when being set up is to check if it should download MDM configuration.

We do this for all Macs and iPhones for our employees, we buy them directly through our Apple business portal and it all automatically registers to our JAMF account.

[jjav]

Any technical resource/paper with the details on this?

This seems ripe for exploiting for nefarious purposes. With Apple having built it, all it takes is one court order targeting a serial# and it auto-installs full remote control spyware on that mac?

[astockwell]

Yep, it's based on device certs.