Zero-touch enrolment for business phones

What zero-touch enrolment is

Without zero-touch enrolment, setting up a company phone means unboxing it, signing in, installing a management app, accepting prompts and configuring email and apps, phone by phone. It takes time, and it relies on every step being done the same way every time.

With zero-touch enrolment, the device is registered to your organisation before it ever reaches you. When it is switched on and connects to the internet, it checks in with the manufacturer's service, finds that it belongs to your business and is handed to your MDM, which applies your settings and apps. The employee signs in with their work account and the phone is ready.

The phrase "zero-touch" is used generally, and specifically for the Android programme. Apple calls its version Automated Device Enrolment, and Samsung calls its version Knox Mobile Enrollment. They work in a similar way.

The three main programmes

Which programme you use depends on the phones you buy. Many businesses use two or all three, all feeding the same MDM.

Apple Automated Device Enrolment

Apple says Automated Device Enrolment is designed for Apple devices an organisation owns, and lets it configure and manage them from the moment someone removes the device from its box. On supervised devices you can stop users removing the management profile, hold the device in Setup Assistant until critical settings and apps arrive, skip Setup Assistant screens and require a minimum operating system version. See Apple Business Manager, now Apple Business.

Samsung Knox Mobile Enrollment

Samsung says Knox Mobile Enrollment can add thousands of Samsung devices at once, enrolling them into your MDM automatically, including again after a factory reset. Devices bought from resellers in its Knox Deployment Program are uploaded to Samsung's system for you to approve, and devices bought separately can be set up with a QR code scan. Samsung describes Knox Mobile Enrollment as free to use, with some extra security features needing a Knox Suite Enterprise Plan. See Samsung Galaxy phones for business.

Android zero-touch enrolment

Android zero-touch enrolment covers supported Android devices from a range of manufacturers, on Android 9 or later, bought through participating resellers. Where zero-touch is not available, Android also supports enrolment by QR code, NFC or a token from your MDM provider.

Why businesses use it

Zero-touch enrolment pays off from the first batch of phones:

• Ship straight to staff. Phones can go from the supplier to an employee's home or site without passing through an office.
• Consistent set-up. Every phone gets the same settings and apps, because the MDM applies them rather than a person.
• Harder to bypass. On supervised iPhones the management profile cannot be removed by the user, and Samsung says Knox Mobile Enrollment re-enrols a device after a factory reset.
• Faster replacements. A replacement for a lost or broken phone sets itself up the same way as the original.
• Cleaner leavers. Because the business owns and manages the device, it can be wiped and reissued without the leaver's help.

The role of the seller

Zero-touch enrolment only works if the device is registered to your organisation at the point of sale. That is the seller's job, which is why buying company phones through a business channel matters.

The process is broadly the same for each programme. Your organisation creates an account with the programme (Apple Business, Samsung's Knox portal or the Android zero-touch portal) and gives its identifier to the seller. Samsung, for example, describes the IT admin and the reseller exchanging their Knox Customer ID and Reseller ID. When you order, the seller registers each device's identifiers to your account, and you assign a profile that points the devices at your MDM.

The networks describe their own services:

• EE Business describes enrolling devices into your chosen platform (Apple Business Manager, Android zero-touch enrolment or Samsung Knox Mobile Enrollment), which then populates your MDM automatically.
• Three Business describes onboarding for its Three Device Management service through Apple Business Manager and Samsung Knox Mobile Enrolment.

Phones bought on a personal account or from a high-street shop are usually not registered to any business account, which is a common reason enrolment does not happen. When you buy phones for your business, we can help pass your programme details to the supplier with the order, where the supplier and device support it.

What you need before you start

Have these in place before the first phones are ordered:

• An MDM. A device management service that supports each programme you plan to use. Samsung publishes a list of the MDM products Knox Mobile Enrollment supports; check your MDM's own documentation for Apple and Android support.
• Programme accounts. Apple Business for iPhones, a Knox account for Samsung devices and an Android zero-touch account for other Android phones, as needed.
• Links between them. Your MDM connected to Apple Business with a current token, and enrolment profiles set up in the Knox and zero-touch portals.
• Your organisation's identifiers. The account IDs your network or reseller needs to register devices to you.
• Work accounts. Staff accounts in your directory, such as Microsoft Entra ID, so people can sign in during set-up.
• Policies and apps. The settings, restrictions and apps each group of users should receive.

How to set up zero-touch enrolment: step by step

1. Choose your MDM and confirm it supports Apple Automated Device Enrolment, Knox Mobile Enrollment and Android zero-touch as needed
2. Create your programme accounts: Apple Business, Samsung Knox and Android zero-touch
3. Link each programme to your MDM: upload the Apple token, and create enrolment profiles in the Knox and zero-touch portals
4. Build your policies, apps and settings in the MDM, grouped by role
5. Give your network or reseller your organisation's identifiers, and ask for devices to be registered to your account when ordered
6. Approve the registered devices and assign them to the right profile or service; Samsung lets you approve uploads from a trusted reseller automatically
7. Test with one phone of each type, from switch-on to a working phone, before ordering in bulk
8. Roll out, and keep the Apple token and any other credentials renewed on schedule

Expect the first set-up to take some time; after that, each new phone adds very little work.

Phones you already own or bought elsewhere

Existing phones can usually be brought under management too, using these routes:

• iPhones and iPads can be added to Apple Business with Apple Configurator for iPhone or Mac. Apple notes a 30-day provisional period after the device is given to a user, during which it can be released from management.
• Samsung devices bought outside the Knox Deployment Program can be set up for Knox Mobile Enrollment with a QR code.
• Other Android phones can be enrolled by QR code, NFC or an MDM token during set-up, usually after a factory reset.
• Personal phones used for work should use a lighter enrolment, such as a work profile on Android or user enrolment on iPhone, rather than full device enrolment.

If you are refreshing your fleet anyway, it is often simplest to enrol new phones properly and retire the old ones.

Common problems and how to avoid them

Most zero-touch problems come from a handful of causes:

• Phones not registered. The phone was bought through a channel that does not register devices to business accounts, or the order did not include your identifiers.
• Expired token. The link between Apple Business and the MDM lapses after a year, and new iPhones stop enrolling.
• No profile assigned. Devices appear in the portal but are not assigned to an MDM or enrolment profile.
• Changing MDM part-way. Apple warns this may mean erasing and re-enrolling every device, so choose carefully first.
• Devices sold or returned while still registered. Release devices from your account before they leave the business, or the next owner may find them locked to your management.

A short test with one device of each type, before a bulk order, catches most of these.

How Forever Communications helps

We supply EE Business and Three Business, and can also supply O2 Business and Vodafone Business lines, and through Forever Group the device management software to go with them. For zero-touch enrolment, we can:

1. Help you choose an MDM that supports the programmes you need, and quote for Sophos Mobile or IBM MaaS360 licences if they suit
2. Help you set up Apple Business, Samsung Knox and Android zero-touch accounts and link them to your MDM
3. Pass your organisation's identifiers to your device supplier with your order, where the supplier supports it
4. Help test enrolment on the first devices before you roll out

We will be clear about which parts we handle and which stay with your IT team or MDM provider. Contact us for help with zero-touch enrolment.