@george1421 According to the documentation, it happens at startup. So the pass would be, as follows.
During the initial boot deploy the profile, and run it or restart. Upon successful deploy and join to MDM (Airwatch, or Hexnode) delete the provisioning profile
I am not currently running Fog. Our current computers are Macs with dual boot, so I deploy Naked Windows with provisioning profile set to execute and enroll into MDM. Then MDM deploys all of the software and compliance policies.
It was decided that OS X is not cost effective in the situations where students are not likely to run OS X. My goal moving forward is to avoid building thick images, for entire fleet, and do provisioning instead. I am very surprised that Provisioning is not as widespread as it should be.
I am all ears regarding possible Fog scenario :P