macOS first time setup instructions (experienced IT audience)

Mac deployment
Windows deployment
Mac returned-device refresh
Windows returned-device refresh
macOS setup instructions

This document explains what to expect when booting a new or freshly erased Mac for the first time, how Apple Accounts interact with local macOS accounts (and why that matters for recoverability), how to set secure defaults, and how to install a small baseline toolset.

High-risk pitfall: If a company-owned Mac is signed into a personal Apple Account (especially with Find My / Activation Lock enabled), IT may be unable to re-activate the device after a wipe without that individual. This is the single most common "surprise brick" failure mode in small and mid-size orgs.

Contents

1) First boot / Setup Assistant overview

When a Mac is new (or has been erased), it boots into Setup Assistant. Setup Assistant is the guided wizard that collects enough information to (a) activate the Mac, (b) create the first local user, (c) optionally sign into an Apple Account, and (d) enable various privacy/security and cloud features.

What you will typically see (order varies by macOS version, hardware, and whether the device is managed by ABM/MDM):

  1. Language and region (sets locale and time zone defaults).
  2. Accessibility options (VoiceOver, zoom, etc.).
  3. Network connection (Wi-Fi/Ethernet). For Apple silicon / T2 Macs this can be mandatory for activation.
  4. Remote management / MDM enrollment (if the device is owned in Apple Business Manager and assigned to MDM). This is where a corporate-owned Mac may display that it is managed by an organization.
  5. Migration Assistant prompt (transfer from another Mac/Time Machine/Windows). You can skip and do it later.
  6. Apple Account sign-in (optional but often shown). This controls iCloud, App Store sign-in, Find My, etc.
  7. Create the first local macOS user (this user is an administrator by default on non-managed Macs).
  8. Location Services, Analytics, Siri, Screen Time, Touch ID (if present), Apple Pay (optional).
  9. FileVault (disk encryption) is frequently enabled automatically in modern macOS, but you should still verify it.

Operationally: the first local account created is your "break-glass" account unless you deliberately change that. Plan that part.

Apple documentation for Setup Assistant

IT reality check: if the device is in Apple Business Manager (ABM) and assigned to MDM, Setup Assistant is no longer "just a wizard" - it is part of the ownership and management chain.

2) Apple Accounts (Apple ID) - how they work and how not to get locked out

A Mac has at least two identity layers:

You can use a Mac without an Apple Account, but many workflows (App Store apps, iCloud Keychain, Find My) require one. In business environments you should decide up front whether you want:

Official Apple docs: Apple Account

Recoverability for company-owned devices

If your goal is "the company must always be able to recover and re-deploy this Mac", plan for these items:

  1. Ownership and enrollment (best): purchase through Apple/authorized reseller so the Mac appears in Apple Business Manager, then assign it to your MDM. This provides a real recovery path for management and (depending on configuration) Activation Lock handling.
  2. Avoid personal Activation Lock: Activation Lock is tied to an Apple Account via Find My. If Activation Lock is enabled under an employee's Apple Account and that person leaves (or loses access), the Mac can become unrecoverable.
  3. FileVault recovery: If FileVault is enabled (it should be), ensure you can recover the disk if the user forgets their password. That usually means escrow the recovery key in MDM, or store it in a controlled secret vault.

Activation Lock references

FileVault references

Practical company pattern (small org, no ABM/MDM yet): use a company-controlled mailbox for the Apple Account, store 2FA recovery info in your secret vault, and be explicit about whether Find My / Activation Lock is allowed.

Multiple local user accounts, including a privileged but hidden account

For IT operations, a common pattern is:

Standard break-glass account (recommended)

Create a dedicated IT-controlled local administrator account for emergency access and recovery. Store credentials in your approved secret vault; do not share with end users.

Notes:

Apple docs for creating accounts:

To create a hidden admin account (so it doesn't show up in the login window user list), you can:

  1. Create the admin account normally (System Settings - Users & Groups).
  2. Hide it using Directory Services (Terminal). Example: 
    sudo dscl . create /Users/itadmin IsHidden 1
    After this, the user typically can still log in by selecting "Other..." at the login window and typing the username.
Do not create a hidden admin account as your only recovery mechanism. If you hide the only admin account, forget its password, and also do not have a FileVault recovery key escrowed, you can lock yourself out in a way that requires Apple-level recovery. Always have at least one documented recovery path: MDM, FileVault recovery key, or a second admin.

3) Secure defaults (baseline hardening)

Below is a sane baseline that maps well to typical business security requirements. If you have MDM, enforce these via configuration profiles and compliance reporting rather than manual clicks.

3.1 OS updates

3.2 Disk encryption (FileVault)

3.3 Screen lock and authentication

3.4 Network and sharing

3.5 Least privilege and admin usage

3.6 Browser defaults (high-level)

4) Installing Firefox, Chrome, and an OpenVPN client

On macOS, most third-party apps ship as a .dmg (drag-and-drop to /Applications) or a signed .pkg installer. For security, download only from official vendor pages, and avoid random "download portals".

4.1 Firefox

4.2 Chrome

4.3 OpenVPN client

There are two common choices:

Operational notes for VPN clients on macOS:

If you are doing large-scale deployments, use MDM to deploy the VPN configuration profile and certificates. Hand-importing .ovpn files does not scale and is hard to audit.

5) Common failure modes and how to avoid them

5.1 Activation Lock / Apple Account lock-in

5.2 Apple Account 2FA dead ends

5.3 FileVault recovery failures

5.4 Wi-Fi onboarding problems

5.5 Gatekeeper / notarization prompts confuse users

5.6 Wrong account boundary (work vs personal)

Last updated: 2026-03-11. This is an operational guide; validate against current macOS behavior and your organization policies.