Overview
A device set up this way is managed before anyone logs in. That changes three things:
- Security. Management is integrated into the device from the start, which means it cannot be removed and survives a wipe. A stolen device stays enrolled and cannot be activated by whoever has it.
- Employee experience. The device arrives with its apps and settings already applied. The new hire opens the box and starts working, instead of waiting for someone in IT to set it up — and every device is configured the same way.
- Efficiency. No manual setup per device, no travelling to remote offices, and no human error in the configuration.
How to use
Zero touch is configured per platform, and you need the vendor programme for each:
- Apple devices — configured through Apple Business Manager.
- Windows devices — configured through Autopilot and Entra.
Both require the device to be registered in that programme, which happens at purchase. A device bought outside those channels cannot be added afterwards.
Where procurement comes in
The reason zero touch is worth the setup is that it joins up with how you buy hardware. Devices ordered through the platform can be enrolled automatically, arrive pre-configured with your settings and applications, and you get one view of the deployment status for the whole fleet — whether each device was set up by hand or arrived ready.
Tips and Best Practices
- Apply it to new orders first, not to your existing fleet. Devices already in the field cannot be registered retroactively, so the fleet converts as hardware gets replaced.
- Set it up before the next hardware order, not after. Registration happens at purchase; a device that ships without it needs another enrolment method for its whole life.
- Buy through a channel that registers devices for you. It is the single decision that makes zero touch possible later.
- Keep employee enrolment as your fallback. Even with zero touch in place, you will always have devices that arrived another way.
Troubleshooting and FAQ
Troubleshooting
A device did not arrive configured. It is not registered in Apple Business Manager or Autopilot. Check the device's status in the relevant programme — if it is absent, it was bought outside a linked channel and needs a different enrolment method.
A wiped device lost its management. Then it was not zero touch. Management surviving a wipe is the defining property of zero touch; if it did not survive, the device was enrolled another way.
FAQ
-
Can we add existing devices to zero touch?
Not retroactively. Registration happens when the device is bought. Macs already in Apple Business are a separate case — see Migrate Macs with Apple Business.
-
Is it available on Android?
Not yet. Android devices use employee enrolment.
-
Can an employee remove the management?
No. That is the point of zero touch, and it is what distinguishes it from a profile the employee installed.