There are five ways to get a device under management, and the right one depends on your existing setup, your platform mix, and whether IT or the employee drives it. Most companies end up with two: zero touch for new hardware, employee enrolment for everything else.

Feature/Functionality

Overview

Start here before your first rollout. Employee enrolment always works on every supported platform, so it is your safe default and your fallback. Everything else is faster or more controlled, but has a prerequisite.

Zero touch is the one worth aiming for. The device enrols the first time it is switched on — through Apple Business on Apple hardware, through Windows Autopilot with Entra on Windows. Two consequences that matter more than the convenience: the employee cannot remove management, and the device enrols itself again after a wipe.

What each one costs you

Zero touch gives the most control: the device cannot be activated without authenticating, which protects you against theft, and management survives a wipe. The price is initial setup in Apple Business or Autopilot, and it does nothing for devices that were never registered there. On Android it covers company-owned, fully managed devices only.

Employee enrolment needs no infrastructure at all and covers every platform. The price is that it depends on someone doing it, and on a computer the employee needs administrator rights. On iPhones and iPads there is one extra condition: turn on Require authentication to enroll in MDM > Settings first, or the devices enrol with no owner, because they all share a single enrolment link and nothing else identifies the person.

Account-driven enrolment keeps work and personal data cryptographically separate, which makes it the easiest conversation to have about a personal phone. The price is federating your identity provider with Apple Business.

Silent agent deployment needs no employee interaction, which is what makes it the migration tool. One catch on macOS: the agent installs silently but the employee still has to accept the management profile. If you want genuinely touchless, that is zero touch.

Apple Business migration reassigns devices already in Apple Business without wiping them — the only method that works on machines already out in the field. It now covers iPhones and iPads as well as Macs, and it needs macOS 26 or iOS/iPadOS 26 and later on both sides.

How to use 

Pick by platform

1. macOS. Zero touch for new devices bought through an authorised reseller. Apple Business migration for machines already in Apple Business on macOS 26+. Silent deployment if you already run a package tool. Employee enrolment as the fallback.
2. Windows. Zero touch through Autopilot for new devices. Silent deployment for migrations. Employee enrolment as the fallback.
3. Linux. Silent deployment if you have a package tool, otherwise employee enrolment.
4. iPhone and iPad. Zero touch for devices bought through a reseller and assigned in Apple Business. Apple Business migration for devices already there, on iOS 26+. Account-driven enrolment for personal devices where privacy matters. Employee enrolment as the fallback — with Require authentication to enroll on, so the phones arrive assigned.
5. Android. Zero touch for company-owned, fully managed devices. Employee enrolment for everything else, including personal devices on a work profile.

Troubleshooting and FAQ

Troubleshooting

• A device cannot use zero touch. It was never registered in Apple Business or Autopilot. Registration happens at purchase, so a device bought outside those channels cannot be added retroactively — use employee enrolment or silent deployment instead.
• Silent deployment finished on a Mac but the device is not managed. Expected. The agent installs silently, but the management profile still needs the employee to accept it.
• Apple Business migration is not offered for a device you know is in Apple Business. Check the operating system version. The method needs macOS 26 or iOS/iPadOS 26 and later.
• iPhones enrolled, but none of them has an owner. They were enrolled with Require authentication to enroll off. The enrolment link is the same for every employee, so without that sign-in nothing identifies who installed the profile.
• Account-driven enrolment does not appear as an option. Your identity provider is not federated with Apple Business.

FAQ

1. Which method should we default to?
   Employee enrolment. It works on every platform and needs no prior setup.
    
2. Can we mix methods?
   Yes, and most organisations do — zero touch for new hardware, silent deployment for the existing fleet, employee enrolment for anything outside both.
    
3. Does migrating wipe the device?
   No. Apple Business migration and silent deployment both keep the employee's data, apps and session.
    
4. Can an employee remove management after a zero-touch enrolment?
   No, and a wipe does not remove it either — the device enrols again on first boot.
    
5. Does zero touch work on Android?
   On company-owned, fully managed devices. Personal Android devices use employee enrolment with a work profile.