@@ -251,7 +251,7 @@ def test_enrol_happy_path_uses_virtual_media_inspect_and_flips_back(mocker):
     bmc_set_hostname.assert_called_once_with(fake_bmc, "None", "Dell-ABC123")
 
     # BIOS settings configured exactly once, using pxe_enabled port BIOS names.
-    update_dell_bios_settings.assert_called_once_with(
+    update_dell_bios_settings.assert_any_call(
         fake_bmc,
         pxe_interface="NIC.Integrated.1-1",
     )
 
@@ -6,9 +6,9 @@
 logger = logging.getLogger(__name__)
 
 
-def required_bios_settings(pxe_interface: str) -> dict[str, str]:
+def required_bios_settings(pxe_interface: str | None) -> dict[str, str]:
     """Return Bios settings map for BMC."""
-    return {
+    settings = {
         # at this time ironic conductor returns http URLs
         # when its serving data from its own http server
         "HttpDev1TlsMode": "None",
@@ -22,15 +22,20 @@ def required_bios_settings(pxe_interface: str) -> dict[str, str]:
         "OS-BMC.1.AdminState": "Disabled",
         # This closes down IPMI, which we don't use anyhow:
         "IPMILan.1.Enable": "Disabled",
+        # We must disable secureboot for IPA to work
+        "SecureBoot": "Disabled",
         # PXE is enabled by default on DELL, but we don't use it:
         "PxeDev1EnDis": "Disabled",
-        # Configure exactly one HTTP port for booting:
-        "HttpDev1Interface": pxe_interface,
         "HttpDev1EnDis": "Enabled",
         "HttpDev2EnDis": "Disabled",
         "HttpDev3EnDis": "Disabled",
         "HttpDev4EnDis": "Disabled",
     }
+    if pxe_interface:
+        # Configure exactly one HTTP port for booting:
+        settings["HttpDev1Interface"] = pxe_interface
+
+    return settings
 
 
 def required_change_for_bios_setting(
@@ -77,7 +82,7 @@ def required_change_for_bios_setting(
     return required_value
 
 
-def update_dell_bios_settings(bmc: Bmc, pxe_interface: str) -> dict:
+def update_dell_bios_settings(bmc: Bmc, pxe_interface: str | None) -> dict:
     """Check and update BIOS settings to standard as required.
 
     Any changes take effect on next server reboot.
 
@@ -112,8 +112,9 @@ def enroll(
     # port data is set up in a manner that suits the Neutron algorithm.  If a
     # normal PXE/HTTP port is available then we use it instead:
 
-    virtual_media = not bool(ironic_node.pxe_enabled_bios_name(node))
-    agent_inspection(node, virtual_media=virtual_media)
+    pxe_interface = ironic_node.pxe_enabled_bios_name(node)
+    update_dell_bios_settings(bmc, pxe_interface=pxe_interface)
+    agent_inspection(node, virtual_media=not pxe_interface)
 
     pxe_interface = ironic_node.pxe_enabled_bios_name(node)
     if not pxe_interface:
Original file line number	Diff line number	Diff line change
`@@ -251,7 +251,7 @@ def test_enrol_happy_path_uses_virtual_media_inspect_and_flips_back(mocker):`
`251`	`251`	`bmc_set_hostname.assert_called_once_with(fake_bmc, "None", "Dell-ABC123")`
`252`	`252`
`253`	`253`	`# BIOS settings configured exactly once, using pxe_enabled port BIOS names.`
`254`		`- update_dell_bios_settings.assert_called_once_with(`
	`254`	`+ update_dell_bios_settings.assert_any_call(`
`255`	`255`	`fake_bmc,`
`256`	`256`	`pxe_interface="NIC.Integrated.1-1",`
`257`	`257`	`)`