Zero-Touch macOS Provisioning Pipeline

Context

ShopBack's EUC team manually provisioned every new-joiner MacBook, hostname rename, user account creation, TOTP MFA enrollment, password seeding, sudo access. Each device took 15–20 minutes of hands-on engineering time. With hiring ramping across Singapore, this didn't scale.

Problem & Constraints

• Manual provisioning at 15–20 min per device
• Multi-region: devices shipped to Singapore, TST, and remote hires
• Security boundary: TOTP enrollment and credential seeding couldn't be outsourced
• No MDM budget for zero-touch deployment tools
• The team had JumpCloud, Google Workspace, and scripting, that was it

Approach

Built a pipeline that chained Google Apps Script (triggered from a Google Sheets row) with JumpCloud Commands pushed to the device. The script looked up the device serial number, generated a deterministic hostname, created the user binding, seeded a temporary password with forced reset, enrolled TOTP, and provisioned sudo, all before the user first opened the lid.

The key design decision was using Sheets as the trigger interface rather than building a custom webhook. Sheets was already in the team's workflow, so adoption was zero-friction. JumpCloud Commands handled the endpoint execution, avoiding the need for a separate agent or MDM.

Implementation

A Google Sheet served as the trigger interface, EUC entered the serial number and assignee email into a row. Apps Script called the JumpCloud REST API to: validate the device, create the system user, bind user to device, push a Command that ran a Bash script on the endpoint. The Bash script handled hostname rename (via serial-to-hostname map), local account creation, password seeding, and sudoers configuration. TOTP enrollment happened via JumpCloud policy, not script, the policy auto-applied to the new binding.

Outcome

• EUC fully removed from new-joiner onboarding
• Provisioning time: 15–20 min → 0 min hands-on
• Zero failed provisions in the first month of production use
• Pipeline handled all regions without modification

Reflection

The Google Sheets trigger was quick to build but fragile, a proper webhook or Slack slash command would be more reliable. The Bash script component on the endpoint had limited error reporting; adding structured logging with a callback to a Slack channel would make debugging easier. For a v2, I'd replace Sheets with a lightweight internal tool and add pre-provisioning validation of JumpCloud agent health.