Zero-touch enrollment

How it works

The mechanism relies on a registration made before the device ships. When an authorized reseller sells you a device, it uploads the serial or IMEI to the manufacturer's enrollment program: Apple Business Manager for Apple hardware, the Android zero-touch portal for Android (launched by Google in 2017 with Android 8.0), Windows Autopilot for PCs. You assign each device to your MDM server in that portal.

On first boot, the device connects to Apple, Google or Microsoft, learns it belongs to your company, and is redirected to your MDM. The user sees a short screen ("this device is managed by Acme"), maybe a login, then the wizard finishes with apps and settings already applied.

Because enrollment happens before the wizard ends, the device is supervised (Apple) or fully managed (Android) from the start. A factory reset sends it straight back to the same flow.

Why it matters for a fleet

The most obvious benefit is time. A batch of 200 phones can be shipped directly from the reseller to 200 employees. Nobody in IT unboxes anything.

The less obvious benefit is control. A device that re-enrolls after every reset can't be wiped and resold by a departing employee. Combined with Activation Lock or factory reset protection, it's the strongest anti-theft posture available on consumer hardware.

There's a dependency to accept: the purchase channel. Devices bought from a random online marketplace won't be in the program. Apple Configurator lets you add existing iPhones manually; Android has no equivalent, though Samsung's Knox Mobile Enrollment covers Samsung devices bought elsewhere.

How Appaloosa handles it

Appaloosa is registered as an MDM server in Apple Business Manager, Android zero-touch and Windows Autopilot. You link your accounts once, assign devices to Appaloosa in each portal, and they enroll at first boot with the security policies, apps and kiosk settings of their group. The setup steps for each program are documented from the Mobile Device Management page.