After MDM migration the Managed Account shows in Fleet, even though it wasn't successfully created

[spalmesano0]

• customer-verstappen: Slack thread. Includes screenshots and additional details.

Fleet versions

• Discovered: 4.91.0
• Reproduced:

Web browser and operating system: macOS

---

💥  Actual behavior

Fleet says that it created a Managed Account when the device was migrated from another MDM, and the MDM command was Acknowledged, but the _fleetadmin account isn't on the device.

# id _fleetadmin
id: _fleetadmin: no such user
# dscl . -read /Users/_fleetadmin
<dscl_cmd> DS Error: -14136 (eDSRecordNotFound)

Request:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Command</key>
    <dict>
      <key>PrimaryAccountFullName</key>
      <string>REDACTED</string>
      <key>PrimaryAccountUserName</key>
      <string>REDACTED</string>
      <key>LockPrimaryAccountInfo</key>
      <true />

      <key>AutoSetupAdminAccounts</key>
      <array>
        <dict>
          <key>hidden</key>
          <true />
          <key>passwordHash</key>
          <data>REDACTED</data>
          <key>shortName</key>
          <string>_fleetadmin</string>
          <key>fullName</key>
          <string>Fleet Admin</string>
        </dict>
      </array>

      <key>RequestType</key>
      <string>AccountConfiguration</string>
    </dict>

    <key>CommandUUID</key>
    <string>REDACTED</string>
  </dict>
</plist>

Response:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CommandUUID</key>
	<string>REDACTED</string>
	<key>Status</key>
	<string>Acknowledged</string>
	<key>UDID</key>
	<string>REDACTED</string>
</dict>
</plist>

🛠️ Expected behavior

The Managed Account should successfully be created. If it fails to be created, Fleet shouldn't say that it was successfully created.

🧑‍💻  Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Set up a macOS 27 device on another MDM.
2. Configure a fleet with a Managed Account.
3. Migrate the device over to Fleet.

🕯️ More info (optional)

N/A

[spalmesano0]

@georgekarrv Requesting a P2 on this as it sounds like the Managed Account is supposed to be created during an MDM migration, but is failing.