macOSLAPS VS ProfileManifestsMirror

LAPS isn't natively supported but once again there's a third-party solution

As others have mentioned, a second account with admin privileges might be your best bet. If you're going to go that route, you may want to implement macoslaps along with that. Macoslaps randomizes the local admin password which comes in handy if you need to give the password to someone. It used to be only for Active Directory joined Macs but now can be used without an active directory (via MDM). Here's the link for more info: This goes on the clients - https://github.com/joshua-d-miller/macOSLAPS

We use MacOSLAPS on our Mac clients to randomize the admin password on those machines: https://github.com/joshua-d-miller/macOSLAPS

And that implementation is why when I set this up at $oldJob I set the RemovePassChars key to all ambiguous characters I had run into on the Microsoft product.

I believe setting something like macOSLAPS up will also resolve the issue since the automatically created local account would authenticate and update it's password silently.

There are a variety of alternatives, such as https://github.com/joshua-d-miller/macOSLAPS

You can make custom profiles in Jamf using the same json imazing uses/same repo. This will give you access to all of the keys available in the software. I think the reason they say it’s not enterprise software is there is no central control like chrome or edge. https://github.com/Jamf-Custom-Profile-Schemas/ProfileManifestsMirror

If you are using Jamf, this custom settings json should help with the vast majority of what you are wanting to do.

It might be easier to use a custom settings json. Here is one from a source that Jamf featured on their blog last year.

You should look into using Custom Settings json files to handle this. Here's one from a Jamf recommended source that I use in my environment. It works really well, and it's much easier to understand at a glance than a plist is.

If you're using Jamf Pro, you may be better off using a Custom Settings JSON to apply these settings.

Are you wanting to completely disable it or just skip it during initial sign in? This custom settings json should help with the latter, and if you then restrict access to the "Screen Time" preference pane that should be a roundabout way to fully disable it.

Rather than putting the energy towards this script, you should start working on how to deploy the official one. All of the config settings are available now. If you are using Jamf, you can even use this custom settings json to handle like 90% of the work. The only major thing to know in advance is that the settings "KFMOptInWithWizard" and "KFMSilentOptIn" are looking for your tenant ID.

If you're using Jamf, this custom settings json should help with managing most of those kinds of settings.

One and done setup, though a Custom Settings json file can really streamline any modifications you have to do down the line.

I believe WebAppInstallForceList is the setting you are looking for. It looks like that is included in this custom settings json though I have not verified that it will work.