Zero-touch enrolment for Apple devices: how it works

Key facts

• Automated Device Enrolment links a device to your organisation at the point of purchase, using the serial number.
• It only applies to devices bought from Apple directly, or from an Apple Authorised Reseller or carrier that has been linked to your Apple Business Manager account.
• Devices bought from a retail shop, a consumer electronics chain, a marketplace or secondhand will not appear, no matter what you do afterwards.
• Enrolment this way is mandatory for the user and cannot be skipped or removed by them, unlike enrolment they perform themselves.
• Devices enrolled this way are automatically supervised, which unlocks management controls that are otherwise unavailable.
• The supplier link has to exist before the order is placed. It does not apply retrospectively to past purchases.

Why it is worth setting up

The obvious saving is the hour or two per device that somebody currently spends unboxing, signing in, installing software and configuring settings. For a business onboarding a handful of people a year that alone is worth the setup.

The less obvious benefit matters more. A device enrolled this way is supervised, and the user cannot remove it from management. A device where the user enrolled themselves can be unenrolled by the user, which means your security settings, your encryption enforcement and your ability to wipe the device all depend on them not tapping the wrong thing. For a device holding client data that is a real difference rather than a theoretical one.

How it works, and what goes wrong

What is Automated Device Enrolment?

Automated Device Enrolment is the Apple mechanism that ties a device serial number to an organisation at the moment it is sold. When your supplier processes the order against your Apple Customer Number or reseller identifier, Apple records those serial numbers as belonging to you and they appear in your Apple Business Manager account, usually within a day and often before the courier arrives.

You assign those devices to a management platform inside Apple Business Manager. From then on, when the device is switched on and reaches Setup Assistant, it checks in with Apple, learns it belongs to your organisation, and is handed to your platform, which applies everything you have configured.

Why do my devices not appear in Apple Business Manager?

Nearly always because of where they were bought. Automated Device Enrolment only covers devices purchased from Apple directly using an Apple Customer Number tied to your account, or from an Apple Authorised Reseller or participating carrier whose reseller identifier you have added to your account.

A Mac bought from a retail store, a consumer electronics retailer, an online marketplace, or secondhand from a staff member simply is not in the system, and there is no way to make it appear after the fact through this route. Those devices can still be added by hand, with a significant caveat, which is covered on the existing devices page.

The second cause is timing. The link between your supplier and your Apple Business Manager account has to exist before the order is placed. An order processed the week before you set the link up will not appear, and cannot be backdated.

How do you link a reseller to Apple Business Manager?

Inside Apple Business Manager, under the enrolment settings, your organisation has a unique identifier that you give to your supplier. Your supplier has their own reseller identifier that you enter into your account. Both sides have to be in place, which means a short conversation with whoever you buy hardware from rather than something you can complete alone.

If you buy from more than one supplier, and most businesses do, each one needs linking separately. This is also the moment to decide whether you keep buying the way you do now. If your current supplier is not an Apple Authorised Reseller, nothing you buy from them will ever enrol automatically, and that is a reason to change supplier rather than a limitation to work around.

What happens when the user opens the box?

They turn the device on, choose a language and join a network, and then instead of the usual personal setup they see a screen saying the device is managed by your organisation. Depending on how you have configured it, they sign in with their work credentials, and the device installs your apps, applies your security settings, connects to email and is ready to work.

You control how much of Setup Assistant they see. Most of the consumer steps, the Apple ID prompts, Siri, analytics, screen time and the rest, can be skipped so the person goes from power button to working device in a few minutes with no decisions to make.

What if we bought the devices from a retail store?

They will not enrol automatically and they never will. You have three options. Add them manually using Apple Configurator, which works but gives the user a 30 day window in which they can remove the device from management. Leave them with user-driven enrolment, which gets your settings applied but leaves the user able to unenrol. Or accept the position for the devices you already have and change purchasing for everything from here on.

For most businesses the practical answer is the third one combined with the first. Fix procurement so future devices are right, and add the current fleet by hand knowing the caveat.

Getting it right from here

Set up Apple Business Manager first if you have not already, as covered in the setup guide. Then link every supplier you buy Apple hardware from, and make it a rule that Apple purchases go through a linked Apple Authorised Reseller. The rule is the important part, because one laptop bought in a hurry from a retail store is a device that will never be properly managed.

If your Apple devices are being set up by hand, or you are not sure whether your supplier is linked, 4iT sorts out the Apple Business Manager side, links your suppliers and configures enrolment so the next device you buy sets itself up. Request a callback or get in touch.