A remote hire's Mac arrives at their front door two days before their start date. They open the box, power it on, join their home Wi-Fi, and by the time they reach the desktop, the machine is already enrolled in the company's device management platform, encrypted, and configured with the apps and Wi-Fi profiles it needs. No one on the IT side touched that specific box. That's zero-touch deployment, and for a small business shipping even a handful of Macs a year, it replaces a genuinely tedious manual process with one that just works.
The catch is that "zero-touch" only looks effortless on the day it happens. Getting there means three pieces are already set up correctly: the purchase channel, Apple Business Manager, and the MDM platform that actually enforces policy.
1. What the old way actually cost in IT time
Before automated enrollment, deploying a new Mac meant someone on the IT side had it in hand first: unboxing it, running through setup, installing a management profile by hand, applying configuration, and then either handing it to the employee in person or reboxing it to ship. Every device meant a physical touch, and every remote hire meant a delay while the machine made a detour through IT before it reached them. For a five- or ten-person company adding a couple of Macs a quarter, that was manageable but wasteful. For a growing team hiring remotely, it became the bottleneck that decided how fast a new employee could actually start working.
2. How Apple Business Manager and zero-touch enrollment fit together
Apple Business Manager is the piece that ties a device's serial number to your business, usually automatically, the moment it's purchased through an authorized channel. That link is what makes the rest possible: it tells the device, the first time it connects to the internet during setup, that it belongs to a managed organization and should check in with that organization's MDM platform before finishing setup. This is Automated Device Enrollment, and it's what makes the process "zero-touch" instead of "fewer-touch." The device supervises itself into compliance before anyone at the company opens the box.
Apple Business Manager on its own doesn't enforce anything, though. That's the job of an MDM platform connected to it, such as Microsoft Intune, which ships with Microsoft 365 Business Premium at no extra license cost, or Google's device management tools for a Google Workspace environment. The MDM platform is where the actual policy lives: disk encryption required, a passcode enforced, company Wi-Fi and VPN profiles pushed automatically, and the ability to remotely wipe the device if it's ever lost.
3. What a small business needs to actually set this up
Three things, in order. First, an Apple Business Manager account, which is free to create and ties to your business's own domain and Apple ID, not a personal one. Second, a purchase channel that registers new devices to that account automatically: Apple directly, most authorized Apple resellers, and many carriers all support this at checkout. A Mac bought secondhand or through a channel that doesn't register devices can still be added and supervised, but it loses the true zero-touch benefit and needs a manual step. Third, an MDM platform connected to Apple Business Manager with at least one baseline enrollment profile built before the first device ships: encryption on, a passcode required, and whatever Wi-Fi or app configuration every new hire needs on day one. Build that profile once, and every Mac that follows inherits it automatically.
Where to start this week
If your business already has Microsoft 365 Business Premium or a Google Workspace plan with device management included, you likely already have the MDM half of this covered without buying anything new. This week, create the Apple Business Manager account if you don't have one, and confirm with whoever you buy Macs from that new purchases are registering to it automatically. Read this alongside our MDM guide for the policy side, and the identity hardening post and offboarding checklist for what happens to that same device on the way out the door.
None of this requires new budget for most small businesses already on Microsoft 365 or Google Workspace. It requires setting the connection up once, correctly, before the next new hire's laptop ships.
Frequently asked questions
What is Apple Business Manager?
A free, web-based portal from Apple that lets a business link its purchased Mac, iPhone, and iPad devices to its own device management platform. The link between a device and the business's account is usually created automatically at the time of purchase and stays with the device even through a full wipe and reset.
How does zero-touch enrollment actually work?
When a new Mac registered in Apple Business Manager connects to Wi-Fi during setup, it automatically checks in with Apple, recognizes it belongs to the business, and pulls down the company's MDM enrollment profile before the employee ever reaches the desktop. No IT visit or manual profile install required.
Do I need to buy Macs directly from Apple to use this?
No. Apple, most authorized resellers, and many carriers can register a device to your Apple Business Manager account at checkout. Devices bought secondhand or from an unauthorized source can still be added, but only manually, which loses most of the benefit.
Does a small business need a full MDM platform for this to work?
Yes, Apple Business Manager assigns the device, but an MDM platform enforces the actual configuration and encryption once it enrolls. Microsoft Intune, included with Microsoft 365 Business Premium, and Google's device management tools both connect to Apple Business Manager, so most small businesses already have this covered.
Shipping laptops to remote hires and still configuring them by hand first?
30 minutes with an engineer with DoD infrastructure experience. We'll look at how your Macs are deployed today and show you plainly what zero-touch enrollment would change.
Book your free assessmentPrefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.