Zero-touch deployment: new Macs that set themselves up

What zero-touch deployment means

Zero-touch deployment is the everyday term for Apple’s Automated Device Enrollment. A newly purchased device is assigned to your organisation in Apple Business. On first start it checks in with Apple, recognises the assignment and connects to your management service.

IT never has to unbox it. The device ships directly to the person who will use it, at the office or at home.

Requirements

• Apple Business: your organisation is enrolled (formerly Apple Business Manager).
• Eligible purchases: devices were bought from Apple or a participating authorised reseller in your company’s name, and the reseller is linked to Apple Business.
• Management service: an MDM such as Mosyle, Jamf or Iru, or the device management built into Apple Business.
• Assignment: Apple Business defines which service receives new devices by default.
• Internet on first start: the device needs a connection during set-up, via Wi-Fi or Ethernet.

How set-up works

1. You order the device from the linked reseller; the serial number appears in Apple Business automatically.
2. Apple Business assigns the device to your management service.
3. The employee switches the Mac on and connects it to the internet.
4. The Mac recognises the assignment and shows that it is managed by your organisation.
5. Depending on your settings, the employee signs in with their work account, for example via Microsoft Entra ID or Google Workspace.
6. Apps, Wi-Fi profiles, printers, encryption and security policies install automatically.
7. Unneeded Setup Assistant steps are hidden through your MDM.

Why it is more secure than manual set-up

Automatically enrolled devices are supervised, which allows stricter controls than on personal devices. Above all, management cannot simply be removed: even if someone erases the device, it re-enrols in your management service on the next start.

That matters when a device is lost or stolen. It stays assigned to your organisation and can be locked or wiped, and Activation Lock is managed centrally instead of being tied to a personal Apple Account.

Adding devices later

Devices bought privately, at retail or from unlinked resellers do not appear automatically. With Apple Configurator you can still add iPhones, iPads and Macs to Apple Business.

Taking devices back and reissuing them

When someone leaves, you erase the device remotely. It restarts in Setup Assistant and enrols again on next start. For iPhone and iPad, iOS and iPadOS 17 added Return to Service: after erasing, the device joins Wi-Fi by itself and sets itself up again without anyone touching it.

Common pitfalls

• Reseller not linked: check before ordering that your reseller has your organisation ID.
• No default assignment: without a default service, new devices appear in Apple Business but never reach your MDM.
• Guest Wi-Fi with a login page: captive portals block set-up. Use a normal network or Ethernet.
• Too many apps on first start: large packages slow set-up down. Install essentials first, the rest afterwards.
• No pilot: test every change to enrolment profiles on one device before enabling it for everyone.