Guide for Apple IT: Zero Touch Deployment for Mac

Posted on March 11, 2020

Keeping up to date with your company’s cybersecurity needs is a never-ending task. New cyber threats are always popping up – and so are new tools to combat them. One of the more recent tools that have gained traction among businesses is zero touch deployment.

More than just a buzzword, this deployment method offers businesses higher levels of security and efficiency while setting employees up with new devices. Essentially, zero touch is an automated deployment strategy that enrolls and secures devices during their initial setup, freeing up time for your employees and IT to work on more pressing matters than answering tickets or setting up devices themselves.

In this guide, we’re going to demystify this great Automated Device Enrollment strategy so you can put it to use for your macOS Devices, iPadOS, iOS, and tvOS– without having to physically touch the device.

Here’s an overview of what we’ll cover:

  1. What is Zero Touch Deployment?
  2. How Does it Work?
  3. Why is it Important?
  4. How Can I Implement it?

 

What is Zero Touch Deployment?

Whenever you hear “zero touch” in the IT sphere, it’s typically referring to an automated version of a process that was traditionally done manually. When we talk about “deployment,” we’re talking about preparing and configuring devices that will be used by employees. In this way, zero touch deployment is a new automated deployment strategy that businesses can use to prepare and configure devices for their employees.

In Apple’s own words, this deployment method lets you “automatically enroll devices in your mobile device management (MDM) solution without having to physically touch or prep the devices before users get them. And with your MDM solution, you can further simplify the setup process for users by removing specific steps in Setup Assistant, so users are up and running quickly.”

This definition captures a few essential pieces of the zero touch deployment puzzle: it’s easy, automatic, and wireless. For reasons we’ll see later in this article, using zero touch significantly lightens the deployment load for you, your IT team, and your employees.

Before moving on, here’s the working definition that we’ll use in this article, which will focus on Apple devices: zero touch deployment is an Automated Device Enrollment process that leverages Apple Business Manager and your mobile device management (MDM) solution of choice.

This comes with a host of benefits that we’ll explore in-depth later, but to make it clearer just how useful zero touch is, let’s take a look at how it’s different from other deployment methods that you may be familiar with.

Zero Touch Deployment vs. Manual Strategies

So, with a zero touch strategy in place, you can automate the deployment process so your employees can use their new Apple devices right out of the box. In order to understand how big of an improvement this is over traditional manual deployment processes, let’s take a moment to  compare them side-by-side:

  • Network Scanning: For macOS, you can use your MDM to scan your network for Mac devices and then, once you identify the ones that you’re looking for, you can use your MDM solution to deploy an enrollment package to them. As you can imagine, this isn’t a very streamlined method, it will take a bit of time, and there’s no guarantee that all of your business’ Mac devices are on the network when you need them to be. It also won’t result in a supervised or User Approved MDM state.
  • Apple Configurator: For iOS, you might use Apple Configurator 2 for device deployment – but if you run a business with more than a few devices, you’re going to have to set a lot of time aside. With Apple Configurator, you need a Mac, a cord, and all of the devices that you want to deploy standing-by. This method involves plugging each device into your Mac one-by-one and then enrolling and configuring them accordingly. Clearly, this isn’t ideal for scaling businesses, and a more streamlined – or automated – strategy is recommended, such as using Configurator to add your devices to Apple Business Manager for Automated Device Enrollment. If you’re curious how this works, Kandji has a support article that will walk you through the process.
  • User-Initiated Enrollment: You could also let your users enroll their own macOS or iOS devices via a web enrollment portal. This involves your employees accessing your server’s unique enrollment URL to complete the registration on a self-serve basis. While this is a great method, your employees may miss the request or complete the enrollment process incorrectly – leading to an incomplete adoption of the devices. It also won’t result in a supervised device state. In other words, IT might have a big day ahead of them, answering support tickets and walking employees through the process.
  • Zero Touch Deployment: Leveraging the capabilities of Apple Business Manager’s Automated Device Enrollment and your MDM solution, zero touch deployment lets you automatically configure new Apple devices during the initial Setup Assistant. That means users can enjoy the ease-of-use that Apple products are known for – and they can get to work faster. Rather than making your employees enroll their own devices, plug each one into your computer and enroll them manually, or conduct network scans to push enrollment packages to certain devices, zero touch establishes a hassle-free workflow from device purchase to deployment.

Compared to other deployment methods, the advantages of zero touch in terms of speed and automation are clear. If your business relies on Apple products, then finding an MDM solution that supports zero touch, like our product Kandji, and integrating it with Apple Business Manager is highly recommended. We’ll break down the ins and outs of how this strategy works in the next section.

For more information on all enrollment methods, including how to enroll macOS devices after they have already been set up, read this support article

 

How Does Zero Touch Deployment for macOS Devices Work?

Hopefully, it’s clear now that zero touch deployment offers a level of efficiency, versatility, and security that traditional deployment methods just can’t match – but how does it all work? Of course, zero touch deployment is going to look different depending on which platform or operating system you’re deploying it on, but for Apple devices, it can be accomplished by leveraging Apple Business Manager, formerly known as Apple’s Device Enrollment Program (DEP), and an MDM solution.

To do this, the organization purchasing the devices just has to integrate its MDM solution with Apple. This is done by linking the MDM to Apple Business Manager, a platform that points the devices to your MDM to enroll. Once this is done, each device the organization buys from Apple or a device-enrollment-enabled Reseller will be enrolled in the chosen MDM solution as part of Setup Assistant, without having to deal with the hands-on deployment methods that we discussed earlier.

This pairing between your Apple devices and MDM solution gives you a lot of powerful opportunities to send commands, apps, and configuration profiles to devices over the air. This is made possible by the constant communication between your devices via APNs (Apple Push Notification service) and your MDM server. This communication is at the heart of device management, letting you push apps and profiles to devices without having to interact with them physically.

To learn more about this process, or how to link devices to your MDM if they weren’t purchased through Apple Business Manager, you might want to check out our support article or our Apple IT guide to device enrollment.

 

Why is Zero Touch Deployment for Mac Devices Important?

The biggest advantages of implementing a zero touch deployment solution for Mac devices or other Apple devices are (1) how much time it can save on new device setup and (2) how it can improve endpoint security for your organization. We’ll take a closer look at both of these in this section.

Fast and Hassle-Free Deployment

When it comes to saving time, it’s important to emphasize just how fast a true zero touch deployment strategy can be. The traditional device setup process takes a lot of steps – from unboxing and creating an account for the user to enrolling the device, configuring it, accessing Wi-Fi and necessary devices or proxies, and installing apps that the user will need. This is especially true if you’re using the Apple Configurator method, which requires having all of your devices in the same room and plugging them into your Mac one-by-one. If your business is growing, this is going to take a lot of time.

The beauty of zero touch deployment is that you won’t have to have all of the devices in the same room as you, your employees won’t have to go through the process of manually logging into their MDM solution and enrolling them, and there’s no need to scan networks and push enrollment packages. Instead, your employees just take their devices out of the box, turn them on, and once they connect to the internet, enroll, and complete Setup Assistant, they’re ready to go.

Beyond being easier for you and your employees, this really takes a load off of IT’s back as well. Your IT team is already busy enough with support tickets, network issues, software deployments, and countless other activities that keep your business running smoothly, so having them unbox and configure new devices could become very disruptive. Implementing a zero touch deployment strategy lets you avoid this by using automation in place of manual processes.

Enhanced Endpoint Security

When it comes to security, zero touch deployment really shines. If you look back at some of the manual deployment methods that we listed earlier, you’ll see that they’re complicated, require advanced interactions from you or your employees to be completed, and take a lot of time. To you, this might be nothing more than an unoptimized process, but to malicious actors, it’s low-hanging fruit – a security vulnerability just waiting to be exploited.

While using manual deployment strategies, there’s a significant amount of time spent in “limbo” after the device is turned on but before it’s correctly enrolled and connected to your management solution. During this period, the new devices are vulnerable to cybersecurity threats (or of being missed for MDM registration entirely) until someone completes the deployment process.

Zero touch deployment avoids this security concern by quickly enrolling the device during the device’s initial Setup Assistant. Because the devices are automatically enrolled into the MDM during initial device setup, this period of vulnerability is minimized.

 

How to Implement Zero Touch Deployment

Now that we know what zero touch deployment is, how it works, and saw some of the advantages it can have for your business, let’s take a look at how you can implement it into your workflow. We’ll start with a general overview, and then we’ll show you the process step-by-step.

Generally speaking, zero touch deployment takes three major steps:

  1. Integrate Your MDM with Apple Business Manager: Before you can automate deployment, you need to establish a link between your MDM server and Apple Business Manager. This ensures that every device you buy will be automatically enrolled in your MDM during the initial device Setup Assistant. Once this link is made, you can configure your enrollment settings from your MDM solution.
  2. Assign Devices for Enrollment: Once you buy Apple devices, either directly from Apple or from an authorized reseller, you need to assign the device to an MDM for enrollment or set up automatic assignment. This is how Apple knows to enroll the device with your MDM during the initial device Setup Assistant. You don’t need to be in the same room with the device to assign it – it can all be done wirelessly.
  3. Send to User: Whether you’re sending a brand new Apple device directly to an employee’s doorstep or giving it to them in the office, neither of you have to worry about manually enrolling or configuring it. Your employee just has to turn on their new device, and once it connects to the internet, it will complete activation and enroll into your organization's MDM solution.

 

Implementing Zero Touch Deployment Before Setup

Now, let’s look at a more specific walkthrough of implementing a zero touch deployment strategy for brand new devices. Because different MDM solutions will require different steps to achieve zero touch deployment, we’re just going to give you an example of how it’s done using our MDM, Kandji.

1. Integrating Your MDM with Apple Business Manager: Before getting started, you need to make sure your MDM server is linked with Apple Business Manager. This is a pretty straight forward process:

add mdm server apple business manager

Image source: support.Apple.com

    • In Apple Business Manager, click “Settings” in the sidebar and then click “Device Management Settings. It should be located below “Organizational Settings.”
    • Click the “Add MDM Server” button and then enter a name for the server.
    • Upload the public key certificate file and then click “Download Server Token.”
    • Upload the server token in Kandji.

2. Assign the Devices: You can assign your Mac or iOS devices to the Kandji MDM server from inside of Apple Business Manager. Here’s what you need to do:

  1. In Apple Business Manager, click “Device Assignments” in the sidebar.
  2. Choose one of the three assignment options: (1) Serial Number, (2) Order Number, or (3) CSV File.Apple Business Manager add devices
  3. From the Perform Action pop-up menu, click “Assign to Server”.
  4. Select the Kandji MDM server that you want to associate the device with, and click “Done.”

Apple Business Manager assign to server

3. Confirm Devices are Listed Inside Kandji: Next, you want to make sure that all of the right devices have been assigned to your Kandji MDM server. To do this:

  1. Navigate to “Devices.”
  2. Click “Auto-Enroll Devices.” You should see a list of all assigned devices.

4. Turn on the Device: That’s it! Now, once your employees turn on their devices and connect them to the internet, a screen labeled “Remote Management” will appear during Setup Assistant to initiate enrollment.

Implementing Zero Touch Deployment for Mac After Setup

If you’re trying to sign up a Mac but it’s already past the Setup Assistant process, you can force another check to get another shot at enrolling it. To do this, just make sure that the device is assigned to the Kandji MDM server in Apple Business Manager, and then:

  1. Open Terminal and run the following command:
      • sudo profiles renew -type enrollment
  2. You’ll see a notification prompting to enroll the device into Kandji. Click it and follow the steps from there.

zero touch deployment mac after setup

For more step-by-step instructions for implementing zero touch in other scenarios, check out our support document for automated enrollment.

 

Rather than requiring a manual enrollment of devices, which could waste a lot of time and leave your devices vulnerable to cybersecurity risks, zero touch deployment immediately enrolls new devices to your MDM – protecting them the moment they’re set up. That means there aren’t any “gaps” in your business’ device enrollment security plan, and it lets you enroll workers faster than ever.

Here at Kandji, we built zero touch deployment into our Apple MDM solution so businesses can work faster and safer. Kandji works with Apple Business Manager, formerly the Device Enrollment Program (DEP), to automate device deployment, letting your employees use their devices right out of the box – without a visit to IT. Request access to Kandji today.