Building macOS machines in Izzy for HLT

How the Hardware Lifecycle Team (HLT) builds Managed MacOS machines for staff upgrades and incidental requests.

Summary

How the Hardware Lifecycle Team (HLT) builds Managed MacOS machines for staff upgrades and incidental requests. This process MAY be used by anyone on campus building a MacOS machine with requisite Izzy access, but is EXPECTED to be used by members of HLT when building MacOS machines.

Environment

• MacOS

• Izzy 

• DEP 

• MDM 

Directions

Follow the Izzy Documentation on how to build a Mac, noting the preferred options for the Izzy configuration section below:

Please note: 

• HLT submits all serial numbers for MDM assignment to the Izzy team when they are first inventoried, so you may skip past these steps if the machine is TDX inventoried. 

• There is a separate process for building a Mac shipped to a user's home 

• When staging, select the most appropriate department from the list of available options, found under each Regional Support Group’s header (LSATS-groupname). 

  • If unsure, confirm by contacting the public slack channel for the support group. 

Izzy Configuration

System Details

• Izzy Name: <FirstName> <LastName>'s <Function> <Computer-Type> (Hostname)

  • ex: Jean‑Luc Picard's Staff MacBook Air (L-SERIAL)

  • ex: Anakin Skywalker’s Research MacBook Pro (L-SERIAL)

• System Name: L-SERIAL

  • This follows the automatic and standard naming conventions for Windows builds through HLT

• Assigned to: <FirstName> <LastName> <UniqName>

• Asset Tag: Ignore unless this is a Capital asset (a device that costs over $5000)

• Support Group: In accordance with the Build Toolbox

• Note: Staff Upgrade (unless building for some other request - leave blank)

• TDX Asset ID: unique number generated by TeamDynamix when entering into the asset system

• Policy Domain: Select the option with “IronIzzy” for whatever Group the machine was staged with. We want all machines to be encrypted, but some exceptions (such as shared machines) may exist.

• Limit to AD groups: This can be ignored