Mac after reboot only allows one account to logon
FileVault is the clear case where the system will boot to a pre-OS screen and show you only the file vault enabled accounts. When you sign in and authenticate as one of these accounts, that unlocks a decryption key that allows the OS to be readable and starts the actual OS boot process.

You can determine which accounts have been enabled in FileVault by examining that system preference once you’re logged in to the running OS.

Since you managed MDM and JAMF - here is an article with great technical data on the need for a secure token to be provisioned for each FileVault enabled account:


https://derflounder.wordpress.com/2018/01/20/secure-token-and-filevault-on-apple-file-system/


Your IT team should investigate JAMF Connect which extends the typical log in screen to let any AD allowed account log in. It also can be provisioned so that membership in an AD group maps to an admin local account or a non-admin local account. It’s an amazing tool and far better than binding which can have many down sides.


https://www.jamf.com/products/jamf-connect/