Yeah - this actually poses a problem. Have you ever thought about not to perform a pre-setup and ship the new device directly to the user. This is, what we are doing, since all of our Macs are in Apple’s DEP, we simply have them run the initial setup on their own. This way, they can connect their Macs to their home WiFi networks.
However, this still doesn’t solve the issue of logging into the Mac, if it has no internet connectivity afterwards, if the user didn’t have the Duo Mobile app on a phone. The only way around that would be to make MacLogon work with HOTP tokens, which you could generate fronm the admin console and pass to the client after verifying her/his identity, e.g. on the phone.
I had raised a case for that and had been told, that they (Duo support) would bring this up with their engineers, but it may be worth raising a ticket on your own, to Duo know, that there’s more demand for this.
