Zero-Touch Provisioning: Shipping Ready-to-Work Devices

The hidden cost of the imaging bench

Somewhere in most IT departments there is a bench: a stack of new laptops, a USB drive full of images, a labeling machine, and a technician spending two to four hours per device unboxing, wiping, imaging, joining the domain, installing applications, and testing before the machine can ship to a user. It feels like work getting done. It is actually one of the most expensive and least scalable habits in modern IT operations.

The math is unforgiving. A technician who provisions four machines a day at a fully loaded cost of, say, seventy dollars an hour is spending well over a hundred dollars of labor per device before anyone has touched a keyboard. Now add the shipping leg: the device goes from the vendor to your office, sits on the bench, then ships again to a remote employee — two shipments, extra days of delay, and a golden image that was already out of date the moment it was captured. Multiply that across a distributed workforce and onboarding surges, and manual imaging becomes a genuine drag on both cost and time-to-productivity.

Zero-touch provisioning removes the bench entirely. The device ships straight from the manufacturer or distributor to the employee's front door, and it configures itself the first time it connects to the internet. No image, no domain-join ritual, no second shipment. Below is how it actually works across the three major platforms, and what has to be true underneath it for the model to hold.

How zero-touch enrollment works across platforms

Every zero-touch program relies on the same idea: the device's hardware identity is registered with a cloud service before the user ever powers it on, so first boot pulls policy from your management platform instead of a factory default. The plumbing differs by ecosystem.

• Windows — Autopilot. The device's hardware hash is registered to your tenant (increasingly pre-registered by the OEM or reseller at purchase). On first boot the machine reaches the Autopilot service, joins your identity provider, enrolls into your MDM, and applies policy before the user ever reaches the desktop. The user signs in once with their corporate identity and the Enrollment Status Page holds the desktop until the baseline is in place.
• Apple — Apple Business Manager and Automated Device Enrollment. Devices bought through Apple or an authorized reseller are linked to your organization's ABM account automatically. On activation they enroll into your MDM in supervised mode, which cannot be removed by wiping the device — the supervision survives a factory reset, which is exactly what you want on a company asset.
• Android — zero-touch enrollment. Devices purchased through a participating reseller are bound to your enterprise mobility management platform, deploying as a fully managed device or with a managed work profile from the first boot, with no QR codes or manual steps.

Figure: the entire path from factory to a ready-to-work device runs as one automated pipeline — no technician touches the hardware.

The common thread is that enrollment binds the device to your platform in a way the end user cannot casually undo. That binding is what turns provisioning from a one-time setup event into a durable management relationship. It also means the device can never quietly fall out of inventory, which is the foundation the rest of the program depends on. This is the operational heart of modern endpoint and device management: you manage the fleet by policy, not by physical possession.

Drop-ship direct to the employee

The most visible payoff is logistics. Because the device configures itself, it never needs to pass through your hands. You place the order, the reseller registers it to your tenant, and it ships to wherever the person actually is.

For a distributed workforce this changes the onboarding experience entirely:

1. Order and register. Procurement orders the standard hardware model; the reseller or OEM registers the hardware ID to your management platform.
2. Drop-ship to the user. The sealed box goes directly to the employee's home, arriving before their start date.
3. Self-service first boot. On day one the employee opens the box, connects to Wi-Fi, and signs in with the corporate identity that was provisioned as part of their identity and access lifecycle.
4. Automated build-out. The device pulls its configuration profile, encryption, security agents, and application set unattended, typically reaching a working state in well under an hour.

The result: a new hire in a different time zone is productive on their first morning without a single support ticket and without IT ever seeing the machine. It also compresses replacement cycles — a failed laptop can be replaced by a drop-shipped unit that rebuilds itself, rather than a multi-day round trip to a staging desk.

Baseline configuration and app deployment via MDM

Zero-touch is not just about getting a device online; it is about getting it to a known-good state and keeping it there. The management platform defines one baseline and enforces it on every device regardless of where it lives. A defensible baseline includes:

• Full-disk encryption with escrowed recovery keys — BitLocker, FileVault, or native mobile encryption — with the recovery key held in your platform so the device is both protected and serviceable.
• A hardened configuration aligned to a recognized benchmark such as the CIS baselines: screen-lock timeouts, disabled legacy protocols, and no local admin rights by default, rather than a homegrown config nobody documented.
• Automated application deployment. The productivity suite, browser, VPN or SASE client, collaboration tools, and any role-specific software install themselves from the platform. Required apps deploy silently; optional apps sit in a self-service company portal the user can pull from on demand.
• Continuous patch enforcement for the OS and third-party applications, with defined deadlines and a reboot fallback when users keep deferring. Known, patchable vulnerabilities remain a leading initial-access vector in the Verizon DBIR year after year, and a device you never physically see is the hardest to keep current by hope alone.

The discipline that separates a real program from a demo is compliance drift reporting: the platform continuously checks each device against the baseline and flags the ones that have fallen out of it, so you are managing an exception list rather than trusting a setup that happened months ago.

Security and compliance, baked in from first boot

The strongest argument for zero-touch is not convenience — it is that security becomes the default state of every device instead of a step someone might skip. A manually imaged laptop is only as secure as the technician's checklist that day. A zero-touch device is encrypted, hardened, agent-protected, and enrolled before the user reaches the desktop, every single time.

That consistency pays off in several ways:

• Detection everywhere. Endpoint detection and response agents deploy as part of the baseline, so every device streams telemetry into monitoring from the moment it exists. Enrollment is also the natural place to wire endpoints into a managed detection and response service so those alerts are actually watched around the clock, not just during business hours.
• Conditional access that means something. Because enrollment proves the device is managed, encrypted, and compliant, your identity platform can make that a condition of access — an out-of-compliance device loses reach into sensitive systems until it remediates. That is a Zero Trust control, enforced automatically.
• Audit-ready evidence. For frameworks like SOC 2, HIPAA, or PCI DSS, auditors want proof that every endpoint meets a defined standard. A management platform that provisions to a baseline and reports drift is that proof, without assembling screenshots by hand.
• Clean offboarding and re-provisioning. The same supervision that made setup automatic makes retirement automatic: remote-lock or wipe over the internet, confirm the wipe, and re-enroll the device for the next user.

Where to start

You do not need to rebuild everything at once. Sequence it: register your standard hardware models with the vendor's zero-touch program, stand up an MDM or UEM platform with a single enforced baseline, wire enrollment to your identity provider so drop-shipped devices authenticate on first boot, then layer EDR and conditional access on top. Each step reduces cost and risk on its own, so the imaging bench shrinks well before the program is fully mature.

intSignal designs and runs zero-touch provisioning as part of our managed IT and helpdesk service — vendor enrollment, enforced baselines, silent app deployment, and security built in from first boot — so your team can hire anywhere and ship a ready-to-work device to their door. If you want to retire the imaging bench for good, talk to our team.