Zero-touch deployment for Apple devices, explained

Picture a new starter's first morning. A sealed MacBook box is on their desk. They open it, turn it on, join the Wi-Fi, sign in — and by the time they've made a coffee, the laptop has configured itself: their apps, their email, the company's security settings, all of it. No IT visit. Nobody touched the machine before them.

That's zero-touch deployment. And once you've got it, you never want to go back.

The old way (and why it's painful)

For years, setting up a work laptop meant a technician physically getting hold of it first. Wipe it, install a "gold image", add the apps, apply the settings, test it, then hand it over or courier it out. Every single device. Every new hire.

It works, but it doesn't scale, and it falls apart the moment people aren't in the office. Ship the laptop to IT, IT sets it up, IT ships it to the employee — that's two extra journeys and several days before anyone's productive. Multiply that across a growing team and it's a real drag on time and money.

How zero-touch actually works

Two things make it possible: Apple Business Manager and an MDM like Jamf Pro.

• Apple Business Manager (ABM) is Apple's portal for organisations. When you buy devices — direct from Apple or through most authorised resellers — they get automatically assigned to your organisation's account.
• Your MDM is linked to ABM. So the moment one of your devices is switched on and hits the internet, Apple tells it: you belong to this company, enrol with their MDM.

From there it's automatic. The device pulls down its configuration, security policies and apps based on who it's for, and lands on a known-good setup — the same every time. Apple calls this Automated Device Enrolment; most people just call it zero-touch.

The key shift: the device configures itself, over the air, wherever it happens to be. IT never needs to physically hold it.

What you get out of it

• New starters are productive on day one instead of waiting on setup.
• It scales without extra effort — five devices or five hundred, it's the same process.
• Everything's consistent. Every device starts from the same baseline, so nothing drifts out of policy and there are no "well, this one was set up differently" surprises.
• Remote just works. Ship straight to the employee's door. No routing hardware through an office first.
• Offboarding is clean too. When someone leaves, the device can be wiped and reassigned to the next person just as easily.

"We didn't buy our Macs through Apple — can we still do this?"

Usually, yes. Devices bought through most Apple Authorised Resellers can be added to Apple Business Manager. And devices already out in the wild — the ones people are using right now — can still be enrolled and managed, even if they can't all get the full switch-on-and-go experience retrospectively. It's worth an audit of your fleet to see what fits where.

Setting it up properly matters

Done well, zero-touch is invisible — it just happens, and you stop thinking about device setup entirely. Done badly, it's a half-configured mess that creates a new headache for every new hire. The difference is in how carefully the enrolment workflows, ABM links and configurations are built in the first place.

That's the part we handle. We set up Apple Business Manager, link it to Jamf, and build the enrolment pipeline so every device — new or existing — follows the same clean path into management.

If onboarding a new Mac is currently a job that lands on someone's desk every time, it doesn't need to be. Book a call and we'll map out what zero-touch would look like for your fleet.