How to Roll out macOS on Apple Silicon with Golden Gate: 2026 MDM Guide

How to Roll out macOS on Apple Silicon with Golden Gate: 2026 MDM Guide

Rolling out macOS on Apple Silicon Macs has a different workflow compared to older Intel-based devices. With the T2 security chip removed and Apple’s silicon security architecture, IT teams need a new approach to device enrollment. Whether you manage 10 or 1000 Macs, this guide will help you leverage Golden Gate to deploy macOS on Apple Silicon Macs in 2026

What is “Golden Gate” for macOS Rollout?

"Golden Gate” refers to Apple’s zero-touch deployment solution using Apple Business Manager, MDM (Mobile Device Management), and Declarative Device Management. Specifically for Apple Silicon-based Mac computers, “Golden Gate” enrollment process lets you configure devices right out-of-the-box. New Macs are unboxed, connected to WiFi, and immediately set up with macOS, apps, and security settings. There is no imaging or installing from external USB drives required. Essentially,

• Golden = Golden Master configuration for apps/settings
• Gate = Activation Lock activation gateway

Apple requires several components to roll out macOS on Apple Silicon computers. 

Before we proceed to the step-by-step guide, let’s first review the requirements.

Requirements for Rolling Out macOS on Apple Silicon

To deploy macOS on Apple Silicon Macs using Golden Gate, you need:

Apple Business Manager account (free): 

You need an Apple Business Manager account where purchased devices appear. Ask your Apple reseller to enroll you to their account in Apple Business Manager.

MDM solution:

 You need to have an MDM solution (Jamf Pro, Kandji, Mosyle, Microsoft Intune, etc.) that supports Declarative Device 

Management for Apple Silicon

Apple Silicon Mac computers

M1, M2, M3, or M4 MacBook Pro, MacBook Air, Mac mini, or iMac

Internet/WiFi access: 

Devices must connect to the Internet at first boot to activate the device and enroll in Apple Business Manager

Step-by-Step: Roll Out macOS on Apple Silicon Using Golden GateOverview

There are 4 basic steps to configure and deploy macOS on Apple Silicon computers with Golden Gate.

Step 1: Adding Devices to Apple Business Manager

When purchasing or receiving Apple devices, ensure they appear in your account on Apple Business Manager. When ordering from an Apple reseller, ask them to add devices to your account. New devices typically appear in Apple Business Manager within 24 hours of purchase.

Step 2: Preparing macOS Configuration in Your MDM

In your MDM software (Jamf Pro, Kandji, Mosyle, etc.), create a new configuration called PreStage Enrollment that specifies:

Setup Assistant: Skipping Apple ID, Siri, and Screen Time while enabling FileVault

• Account creation: Create a local administrator account
• Apps: Assign Microsoft 365, Chrome browsers, VPN clients, and security 
• Policies: Enabling Gatekeeper, disabling boot from USB, and setting a 6-digit passcode

Step 3: Declaring Device Management Policy for Apple Silicon

Previously, deploying Apple software updates, security settings, and account restrictions required creating Profiles. Apple Silicon Macs use a new management method called Declarative Device Management (DDM).

In your MDM, enable declaration of the following device management policies:

Updates.

Security

Account Management

These policies allow the MDM server to instruct macOS computers even when they are offline.

Step 4: Mac Enrollments with Zero TouchShip Mac computers to your employees’ 

physical addresses. When a Mac is first turned on, it connects to WiFi and checks in with Apple Business Manager. Using the Apple Business Manager, the MDM server will automatically configure the Mac with the desired applications and policies. End-users will only have to log in to their local administrator accounts to begin using the computers.

5 Best Practices for Rolling Out macOS on Apple Silicon in 2026

1. Always use automated device enrollment (not Apple Configurator)

Do not use Apple Configurator 2 to enroll more than 10 Macs in Apple Business Manager because it is time-consuming for large volumes of devices. Instead, use the 

.Apple Business Manager and MDM to automatically enroll all your Apple Silicon Mac computers.

2. Leverage Rosetta 2 translation in your macOS rollout

Some legacy apps may only be available in Intel x86 format. You can use Rosetta 2 to transparently translate apps on Apple Silicon Macs. Configure Rosetta 2 to silently install itself when a user runs an Intel app for the first time.

3. Enable FileVault + Secure Boot

Apple Silicon Macs have Secure Boot enabled by default. To pass security audits (e.g., SOC2, HIPAA), always configure your macOS devices to use Full Security in your MDM. This will also enable FileVault encryption on Apple Silicon Macs.

4. Use Declarative Device Management for testing macOS updates

Use the built-in Declarative Device Management (DDM) tools within your MDM to defer macOS updates for 30 days. This lets you test new features and security updates on 5 pilot macOS devices before releasing it to your other 500 devices.

5. Use Real-Time Reporting for auditing compliance

Using your MDM real-time reporting tools, track the percentage of successfully enrolled devices  installations. For companies in heavily regulated industries (e.g., finance, healthcare), ensuring all macOS devices are enrolled in your MDM is critical for passing security audits.

Common Issues and Solutions for macOS Rollout on Apple Siliconissue

• Potential Causes
• Solution
• Devices are not enrolled in MDM

Devices were not added to Apple Business ManagerVerify that serial numbers are visible in Apple Business Manager. Re-sync your MDM server if necessary

Apps fail to install

No Internet access during initial device setup

• Ensure WiFi connection is allowed during Setup Assistant
• Activation Lock appears
• Previous user failed to remove their information

Ask the user to “Bypass Activation Lock” in Apple Business Manager

Slow macOS device rollouts

Large applications are being installed on day 

Save applications in stages using self-service options

FAQ: macOS Rollout on Apple Silicon Macs

Q: Can I do imaging on Apple Silicon Macs like before?

A: Unfortunately, Apple has eliminated imaging on Apple Silicon devices. You must use Apple Business Manager and MDM (Mobile Device Management) to enroll the devices. This is why the new zero-touch enrollment is called “Golden Gate.”

Q: What is the best MDM for managing Apple Silicon Macs in 2026?

A: For enterprise-grade support, Jamf Pro is the best MDM for Apple Silicon Macs. For small businesses, Mosyle or Kandji may be more affordable options. Microsoft Intune is also a good option for organizations that want to manage Apple devices alongside Windows computers.

Q: How long does it take to roll out macOS on Apple Silicon Macs?

A: With the new zero-touch enrollment, it only takes 10-15 minutes for one person to configure a single Mac from unboxing to login. With 1000 Macs, it would take about one week for one person to configure all devices with Golden Gate.

Q: Can I roll out Apple Silicon Macs to my remote workers?

A: Yes, that’s the point of zero-touch enrollment. You can configure a Mac to enroll on your WiFi network and ship it directly to your remote worker’s house.

Final Thoughts

Golden Gate makes deploying macOS on Apple Silicon Macs both time-saving and secure. This zero-touch enrollment drastically reduces IT costs and complexity. I recommend that all IT teams move away from imaging USB drives and switch to Apple Business Manager and MDM for managing Apple Silicon Macs.