How to set up zero-touch deployment for Apple devices

Your IT team sets up the management settings before the device reaches the person who'll use it. When it's switched on for the first time, the device contacts Apple, learns which management service it's assigned to and enrols there. The person may still need to join a network, sign in and go through the setup screens you haven't skipped.

How long this takes depends on what has to download, how good the network is, how long the sign-in checks take and how many apps you require. Time the whole thing on your own devices, from first start until the person can work.

Connect Apple Business to the management service you've chosen. Check that your supplier adds new devices to your Apple Business account and that each device is assigned to the right MDM. Then set up the enrolment profile, how user accounts are created, the security settings and the app licences.

Decide what has to be finished before the person sees the desktop or Home Screen. Then take a freshly enrolled device and check that every app, certificate and security setting is there.

Test with a device that has the same assignment and settings as the ones you hand out. Start from the state a new person will get it in, straight out of the box or freshly erased. Try the networks people will set up on, home Wi-Fi included, because a setup that works in the office can still fail at home. Check that sign-in works, the required apps install, FileVault is on for Macs and the person can reach the work services they need.

Write down every failure. Give people a way to reach support that doesn't depend on a working company device, since that may be the device that's stuck. Run the test again whenever you change the enrolment settings, the identity setup or an essential app.

On supported Apple platforms, Automated Device Enrollment lets you supervise devices, and supervised devices accept stronger management controls. For compatible iPhone and iPad models, Apple Configurator is a second way to supervise them. Which controls you get depends on how the device was enrolled and on the operating system.

For devices you already own, check the purchase records, whether each one is eligible and that its data is backed up before you erase or migrate it. A device that already shows up in Apple Business still needs the right assignment and enrolment settings before it will enrol on its own.

Watch for failed enrolments, and for certificates and tokens that are close to expiry. If one of them runs out, new devices can stop enrolling. Check app installs separately, because a device can check in with the MDM while its apps are still missing. And write down how to recover when setup stops because of a network failure or an account problem.

If devices are shared, the handover from one person to the next is part of the deployment too. Shared iPad and shared iPhone setups handle sessions and data removal differently, so plan and test each one separately.

Apple Platform Deployment · Software updates