Guide for Apple IT: Zero-Touch Deployment for Mac

Posted on April 8, 2022

As the world moves to remote and hybrid work, zero-touch deployments have become more important than ever. 

Handing out Mac computers to new employees on their first day in the office is no longer the default. Now you can drop-ship computers directly to new hires, wherever they’re working. With zero-touch deployments, you can preconfigure those shipped computers so they enroll in your device management solution on the first startup; your desired apps and settings can then be implemented remotely. And because those settings can include your preferred security configuration, zero-touch can bolster your organization’s safety as well as streamline deployments.

In this guide, we’ll explain how zero-touch works and how to implement it. Note that, for the purposes of this guide, we’ll focus on zero-touch for Mac computers. But it’s also available for iOS and iPadOS devices.

What Is Zero-Touch Deployment?

Let’s start by defining what we mean by zero-touch deployment. The phrase means exactly what it sounds like: Your IT department has to touch your new devices zero times when deploying them to employees. Or, in Apple’s own words, this deployment method lets you “automatically enroll devices in your mobile device management (MDM) solution without having to physically touch or prep the devices before users get them.” "Zero-touch" means nobody in IT touches the computer; end-users do.

The key to zero-touch—as well as several other aspects of managing Apple devices efficiently—is Apple Business Manager (or Apple School Manager, if you're in the education world; for simplicity's sake this guide refers to Apple Business Manager throughout).

Devices you’ve bought from Apple itself or from an authorized reseller or carrier automatically appear in Apple Business Manager. If you’ve configured it correctly, when one of those devices is turned on for the first time and connects to the internet, it checks with an Apple service to see if it’s been assigned to your device management solution. 

If it has been, the device contacts that solution and downloads an enrollment profile. That profile can include information about your device management solution, certificates, and instructions on which Setup Assistant steps to show or skip in the initial setup process. The profile can also prevent users from removing the device from management. 

Now that it’s enrolled, the device can download other profiles from your management solution, and those profiles can install apps and configure settings. 

This initial process—better known as Automated Device Enrollment, or ADE—is not exactly the same as zero-touch deployment. The main difference: Zero-touch means no IT person has physically touched the device before the user does. ADE means only that the device is enrolled automatically, regardless of whether or not an IT person physically touched it. Zero-touch relies on ADE.

There are, of course, other ways to deploy devices. You can, for example, use the Apple Configurator app on an iPhone to deploy Mac computers. But that’s hard to scale, and it's anything but zero-touch for IT. You can also have users navigate to a web portal and enroll there—but that puts extra onus on users; with macOS Big Sur and later, they must log in with administrator status and affirmatively accept enrollment; it’s not like they just can click a button and, boom, they're enrolled. 

Compared to these other deployment methods, zero-touch is clearly the easiest for IT. But there are cases where it isn’t appropriate—specifically, when the device isn’t owned by the organization, when it’s already in use, or when it's shared among multiple users, none of whom are ultimately responsible for it. In those cases, zero-touch isn’t the answer. But for new employees, especially those working remotely, it’s ideal.

Why Zero-Touch Deployment Matters

There are three good reasons to consider zero-touch deployments for your organization: Time savings, money savings, and improved security.

Faster Deployments

The old in-person deployment process took a lot of steps: Unboxing the device, creating a user account to enroll it, configuring it, and installing apps that the user will need. If your business is growing and you’re deploying a lot of devices at once, this is going to take a lot of time. 

With zero-touch, you spend some up-front time configuring Apple Business Manager and your device management solution. It then takes some time to correctly order your drop shipments. But once that’s done, your initial deployments run automatically. With the time saved, your IT team can get on with more important projects.

Automating deployments can save your users time, too: They don’t need to manually enroll by a web portal. They just take the computer out of the box, turn it on, connect to the internet, and complete Setup Assistant; then they’re ready to go. They might even feel more responsibility for the device than if it was handed to them already configured.

Money Savings

In addition to saving your team time, it can save your company money. Think about the shipping involved in less automated workflows: The vendor ships the computer to you, and you then do your configuring and ship it to the user. That’s two shipping hops you’re paying for instead of one. And because management is implemented as soon as the computer is first turned on, you can deal with many problems remotely, rather than having the user ship it back to you for fixing.

Enhanced Security

Zero-touch deployments can make your organization more secure in two ways: First, it pretty much guarantees that new devices are enrolled and managed from the first startup; there isn’t a gap between first use and enrollment. Second, because devices are managed from the get-go, you can immediately download all the security settings and apps you want users to have. Third, depending on how you configure that initial ADE payload, you can make its management profile unremovable, so users can’t manually opt out of having their computers under your management.

Having users set up their own Mac computers also avoids another problem: If someone in IT sets up a device for a user, that usually means they need to know the user’s password—even though users are never supposed to divulge their password to anyone.

How to Implement Zero-Touch Deployment

The exact steps to implementing zero-touch deployments will vary depending on your device management solution, but here’s how the process works in general.

First, you need to set up Apple Business Manager. That means integrating your device management solution with it; here’s how to do that. You also need to enter your Apple customer ID and/or the reseller number of your Mac computer vendor. That latter step ensures that every device you buy is assigned to your device management solution, so when it first boots up it knows where to look for enrollment information. Apple explains to do that how here. 

ADE top_editpngSecond, you need to configure Automated Device Enrollment in your device management solution. Here, for example, is how to do it in Kandji. Later, to be sure it’s working, you can navigate to Devices in the Kandji web app, then look at the Automated Device Enrollment section.

Once you’ve got the pieces in place, you can start ordering devices from your vendor of choice and have them shipped directly to employees. When they turn on their devices and connect them to the internet, a screen labeled Remote Management will appear during Setup Assistant to initiate enrollment—all without you ever opening a box, typing on a keyboard, or tapping on glass.

About Kandji

Here at Kandji, we built zero-touch deployment into our Apple device management solution, so businesses can work faster and safer. Kandji’s integration with Apple Business Manager and support for ADE is just one way it can make an IT team’s life better. From deployment to retirement, Kandji keeps your Apple devices safe, offering great features like pre-built security settings, one-click compliance, and plenty more.

Editor's note: This story was substantially revised April 8, 2022.

 

Share post

The Latest in Apple Enterprise Management