The iMac Pro has a new feature called Secure Boot, that I’m presuming will be added to future Mac models as they are released.

Secure Boot makes sure that the startup disk is “a legitimate, trusted Mac operating system or Microsoft Windows operating system”.  Secure Boot can also prevent the Mac from booting from an external drive.

The setting for Secure Boot can only be changed while booted into Recovery mode, by clicking on Utilities, and selecting Startup Security Utility.

By default Secure Boot is set to “Full Security”, which restrict the Mac from only booting from its primary startup volume and Apple recovery volumes.  The “Disallow booting from external media” choice is also set by default.  Options include:

The Secure Boot feature is something that all Mac support professionals need to know about, because changes the game when it comes to booting from external service drives or cloned volumes.

Even if an iMac Pro has Secure Boot set to “No Security”, it can’t boot from a NetBoot, NetInstall, or NetRestore image.  Apple confirms that in this support article.  Rumor has it that the forthcoming macOS 10.13.4 update will remove this restriction, allowing Mac Pros to boot from network images.  It should be noted however that Apple is now saying that network imaging can only be used to re-install the OS, and that upgrading the OS via a network image isn’t recommend or supported.