Zero touch means a Mac, iPhone or iPad enrols itself the moment someone switches it on, straight out of the box. To get there you connect your Apple Business account to the platform once, and then make sure every Apple device you buy ends up in that account. This article covers both halves.

Feature/Functionality

Overview

Apple renamed Apple Business Manager to Apple Business in April 2026. Anything you read elsewhere that says "Apple Business Manager" or "ABM" means the same service.

You need Device Manager or Administrator rights on an Apple Business account before you start. If your company does not have one, create it at business.apple.com.

The connection is a one-off exchange of two files: you give Apple a public key from the platform, and Apple gives you back a token that proves the link.

How to use 

Connect Apple Business

1. Get the public key.

Go to MDM > Settings and click Apple in the Platforms section. Under Apple Business, click Add, then download the public key. Keep the file to hand.

2. Register the platform as an MDM server in Apple Business.

In Apple Business, click your account name at the bottom left and open Preferences.

1. Find Device Management Services and click Add.
2. Name the server something you will recognise later.
3. Tick Allow this MDM server to release devices. Without it you cannot release devices from Apple Business later (see below).
4. Under MDM Server Settings, upload the public key from step 1 and save.
5. Select the server you just created in the sidebar and click Download Token.

3. Upload the token.

Back in the Add Apple Business window, click Upload Apple Business token (.p7m) and pick the file Apple gave you. The two systems are now linked.

4. Point your existing devices at the new server.

Apple devices already in your account are still assigned to whatever server they were on before. In Apple Business, open Your Devices > All Devices, then use Edit MDM Server to move them all across.

5. Make it the default for everything you buy next.

Still in Preferences, open Your MDM Servers > Default MDM Server Assignment and click Edit. Set every entry to the new server, then click Done. Skip this and tomorrow's delivery lands on the old server.

Get devices into Apple Business

A device can only use zero touch if Apple knows it belongs to your company. There are three ways to get it there.

If you go through a reseller, agree the registration before you place the order. A reseller who is not Apple-authorised, or who forgets to assign the devices to your account, leaves you with hardware that can never do zero touch.

The Apple Configurator route is the fallback. The device has to be wiped and physically plugged into a Mac, which makes it fine for a handful of machines and painful for a hundred. Apple documents the procedure in Add devices to Apple Business Manager using Apple Configurator.

Release a Mac from Apple Business

Release a Mac from Apple Business when it leaves your company for good, for example before you sell it or send it back. After the release, a wipe or a reinstall no longer enrols that Mac automatically.

The action is only offered on Macs enrolled through zero touch, and only to admins allowed to edit equipment.

1. Go to Devices and open the device details page.
2. Click Actions > Release from ABM. It sits in the Advanced part of the menu.
3. Click Release to confirm.

There is no undo from the platform. Once released, only Apple or your reseller can put the Mac back into Apple Business.

You can also release the Mac while you unenrol it: in the Unenroll window, tick I want Factorial IT to release this device from my ABM. The Mac is released first and unenrolled afterwards. The tick box also applies when you click Already removed MDM manually?.

If Apple Business refuses the release, an error appears and the Mac is not unenrolled. A Mac that has already left Apple Business is released without any error.

Every release, and every failed attempt, is recorded as Release from ABM in the device's Logs tab.

What the employee sees

Worth knowing before you promise it to anyone, because the experience is the selling point:

1. The employee unboxes the Mac and switches it on.
2. The Remote Management screen appears, saying the device is managed by your company.
3. If Require authentication to enroll is on in MDM > Settings, they sign in with their work account here. If it is off, they do not.
4. The Mac finishes setting itself up, already configured and already in your inventory.

Two conditions before that works: the employee has to be onboarded already, and the Mac has to be registered in Apple Business and assigned to the right server.

Macs already in use are a different job

Zero touch covers devices arriving from the factory. A Mac already in use under another MDM does not get there through this article — use the Apple Business migration instead.

The trap is quiet: without a migration deadline set, those Macs never show the migration prompt at all. Nothing appears to fail; nothing simply happens.

Troubleshooting and FAQ

Troubleshooting

• A new Mac arrives and does not enrol itself. Either the device was never registered to your Apple Business account, or the default MDM server assignment still points at the old server. Check the device in Apple Business first — if it is not listed there at all, the reseller did not register it.
• Existing devices did not move to the new server. Reassigning in Your Devices > All Devices only covers the devices selected at that moment. Devices added since then follow the default assignment rule instead.
• You cannot upload the token. The .p7m file has to come from the server you created with your own public key. A token downloaded from a different server will not match.
• Release from ABM fails with an error. Apple Business refused it, usually because the MDM server was registered without Allow this MDM server to release devices. Edit the server in Apple Business, turn it on and try again. The Mac stays enrolled until the release goes through.
• I cannot find Release from ABM on a Mac. The Mac was not enrolled through zero touch, or your role does not let you edit equipment.

FAQ

1. Can we add a device to Apple Business after we have already bought it?
   Only with Apple Configurator, and only by erasing it and connecting it to a Mac. A reseller cannot register a device retroactively.
    
2. Do we have to buy hardware through the platform to use zero touch?
   No. Any Apple-authorised reseller works, as long as they assign the devices to your Apple Business account when you buy them.
    
3. Does zero touch survive a wipe?
   Yes. That is the point of it — the device re-enrols on its own at the next setup screen, so wiping a machine does not take it out of management.
    
4. Can we undo a release from Apple Business?
   Not from the platform. Only Apple or your reseller can add the Mac back to Apple Business.
    
5. Is "Apple Business Manager" something different?
   No, it is the old name for Apple Business. The two refer to the same service.