Zero touch deployment for MSPs: A practical implementation guide

Zero touch deployment for MSPs means a client's new laptop ships straight from the vendor or reseller to the employee, enrolls itself in your MDM on first boot, and pulls its policies, apps and security settings without a technician touching it. On Windows that runs through Autopilot and Intune. On Apple, it runs through Apple Business Manager and Automated Device Enrollment.

The reason to care is margin. A 50-user onboarding quoted flat-rate can eat 150 technician hours before anyone does billable work. This guide covers how the Windows and Apple pieces fit together, what the tools cost, how to roll it out one client at a time, and where rollouts break.

Why manual device provisioning eats MSP margins

Manual device provisioning takes 1 to 3 hours per device. At a fully loaded technician cost of $75/hour, that is $75 to $225 per device before the client gets any value from the project.

A 50-user onboarding at 3 hours per workstation is 150 labor hours, or $11,250 at $75/hour. If you quoted the project at $15,000, you have $3,750 left for the actual work, which is how fixed-fee projects turn unprofitable and one more reason L1 tickets are killing your MSP.

Those hours go to imaging machines, setting policies by hand, and fixing the inconsistencies that manual work produces. An MSP that has automated deployment can quote the same project lower, deliver it faster and still keep its margin, so the cost of staying manual shows up in lost bids as well as in your own numbers.

Use the ROI calculator to see what manual provisioning costs your business.

What zero touch deployment means

Zero touch deployment means a device configures itself on first boot. The employee unboxes it, powers it on, signs in with work credentials and starts working, while everything else happens in the background. Addigy notes that the same approach also goes by touchless deployment, zero-touch provisioning and automated device enrollment.

There is a useful distinction between zero touch enrollment and zero touch deployment. Enrollment is only the MDM registration step, which gets the device into management. Deployment covers the full setup, including apps, security policies, network configuration and compliance settings, which makes the device ready for work.

The sequence on a typical device looks like this:

1. The device contacts the manufacturer's enrollment service (Apple Business Manager or Windows Autopilot).
2. It receives its MDM assignment and enrolls automatically.
3. The MDM pushes configuration profiles for Wi-Fi, VPN and security policy.
4. Required applications install silently.
5. Compliance checks confirm the device is configured correctly, and the user signs in.

This matters most for distributed and hybrid clients, because the device can ship directly from the vendor to the employee. There is nothing to stage in your office, no shipping devices back and forth, and no setup call to schedule with a remote employee.

The zero touch deployment stack for MSPs

A complete zero touch deployment setup for an MSP client needs a hardware enrollment program, an MDM and a cloud identity provider working together.

Windows: Autopilot and Intune

Windows Autopilot registers a device's hardware hash with the client's Microsoft Entra ID tenant before the device reaches the user. The flow runs like this:

• The OEM (Dell, HP, Lenovo) or your CSP registers the hardware hash to the tenant.
• The device ships directly to the employee.
• On first boot it contacts Microsoft, confirms its registration and starts Autopilot.
• It joins Microsoft Entra ID and enrolls in Intune automatically.
• Intune pushes policies, apps and configuration.
• The Enrollment Status Page (ESP) shows progress and blocks the desktop until required items finish.

Autopilot has three main deployment modes. In user-driven mode, the employee signs in with corporate credentials to complete setup. Self-deploying mode needs no user interaction at all, which suits shared and kiosk devices. Pre-provisioning, which Microsoft previously called white glove, lets IT or a partner stage apps and policies before the device ships, so the user waits less at first boot.

Microsoft now documents Windows Autopilot device preparation as a separate option alongside classic Autopilot, with its own requirements and reporting. Read the comparison in Microsoft's Autopilot documentation before you standardize a new client on either.

Apple: Apple Business Manager and Automated Device Enrollment

For Apple devices, Apple Business Manager combined with Automated Device Enrollment (ADE) provides the zero touch capability. Apple Business Manager is free; you need an Apple Customer Number or an authorized reseller relationship.

The workflow:

• Buy devices through an authorized Apple reseller, and they appear in the client's Apple Business Manager portal.
• Assign them to your MDM server (Jamf, Intune or another).
• Ship the device directly to the employee.
• On first boot, the device contacts Apple, receives its MDM assignment and enrolls as a supervised device.
• The MDM pushes configuration, apps and policies.

Supervision matters for corporate devices because it stops users from unenrolling from MDM, allows silent app installs and unlocks deeper restrictions. Without it, a user can remove the MDM profile and walk out of management.

Choosing the MDM layer

The MDM is the control plane for zero touch deployment. For most MSPs the choice comes down to the client's OS mix, and our Jamf vs Intune comparison goes deeper on that decision.

Microsoft Intune fits Windows-heavy clients and Microsoft 365 shops. It is included with Microsoft 365 E3/E5 or sold standalone, handles Windows very well, and manages Macs well enough for mixed environments.

Jamf Pro fits Apple-heavy clients. At $12.50/device/month for Mac or $5.75/device/month for mobile, it goes deeper on Apple than cross-platform tools. Jamf integrates with Apple Business Manager and ADE, and it can load a device with what each employee needs based on their cloud identity role using Smart Groups.

Iru (formerly Kandji), Addigy and Hexnode fill narrower roles. Iru sells identity, endpoint management and compliance automation in one platform and has a dedicated MSP offering. Addigy is built for MSPs managing several Apple clients; see our Addigy review for detail. For a wider shortlist, read the best endpoint management tools for MSPs.

Whichever you pick, the MDM does the same core jobs: it enforces encryption, password and firewall policy, deploys apps silently or through a self-service catalog, configures Wi-Fi, VPN and DNS, reports on compliance, and gives you remote lock, wipe and locate.

Identity and access

Zero touch deployment depends on a cloud identity provider, because the device joins that identity platform during setup and the user's sign-in flows through to every connected app.

Microsoft Entra ID integrates natively with Autopilot and Intune, so it is the default for Microsoft-centric clients. Okta and Google Workspace work for clients already invested in them, and most MDM platforms support several identity providers.

Pair identity with Conditional Access so only compliant devices can reach sensitive resources. Sourcepass recommends this alongside Microsoft Defender for Endpoint for EDR coverage, and applying it first to finance and admin roles.

How to implement zero touch deployment for MSP clients

Moving from manual provisioning to zero touch deployment takes a few weeks of setup per platform. This is the order that works.

Step 1: Audit your current onboarding costs

Track time per device across your last 5 to 10 client onboardings, including imaging, configuration, app installs, troubleshooting and rework. Then work out your fully loaded hourly cost: salary plus benefits, overhead, and the billable work that technician was not doing.

Compare the setup hours saved per device against what the MDM costs you. Remember that the MDM fee also covers ongoing patching, policy and compliance work, so setup savings are not the only return. The MSP onboarding checklist helps you track these numbers the same way on every client.

Step 2: Choose the MDM and enrollment programs

The client's environment decides the stack:

Environment Type	Recommended Stack	Monthly Cost per Device
Windows-only	Intune + Autopilot	$8-12
Mixed Windows/Apple	Intune for all, or Intune + Jamf	$8-20
Apple-only	Jamf Pro or Iru	$6-13

Intune is included with Microsoft 365 E3 ($36/user/month) or E5 ($57/user/month). Standalone Intune Plan 1 runs about $8/device/month.

Jamf Pro is $12.50/device/month for Mac and $5.75/device/month for mobile devices, with annual billing and a 25-device minimum.

Iru pricing requires a quote, but expect $8 to $15/device/month for the unified platform. Apple Business Manager is free but requires buying through authorized resellers. Vendor pricing changes often, so confirm current figures on each vendor's pricing page before you quote a client.

Step 3: Configure baseline policies and the Enrollment Status Page

Start with the security settings every device gets: disk encryption (BitLocker on Windows, FileVault on Mac), firewall on, automatic updates, MFA and password complexity. On Windows, use Windows Update for Business rings so you control when feature and quality updates land.

Then build role-based profiles. Sales staff usually need CRM plugins, presentation tools and VPN for travel, engineers need development tools and sometimes elevated permissions, and executives often get fewer restrictions plus premium apps. Target these with dynamic groups rather than per-device settings, which keeps every device on the same baseline.

Network settings should include corporate Wi-Fi certificates, VPN and DNS filtering. App deployment covers the standard suite (Microsoft 365, Slack, endpoint protection) plus role-specific tools, and account-side access belongs in the same plan; see Office 365 user provisioning.

Keep the required apps on the Enrollment Status Page to a minimum. Sourcepass recommends this so users finish enrollment quickly, with heavy apps delivered after provisioning.

Step 4: Set up vendor pre-registration

For Windows, work with the OEM (Dell, HP, Lenovo) or your CSP to register devices to the client's tenant before shipping. You will need to establish the relationship and supply tenant details, and some OEMs charge a small per-device fee.

For Apple, buy through an authorized reseller that supports Apple Business Manager and give them the client's Apple Customer Number or Reseller ID. Devices appear in the ABM portal within 24 hours of purchase.

Test the flow with a single device before placing a large order, and document the process for each vendor, because requirements vary.

Step 5: Pilot with a friendly client

Pick a client with 5 to 10 new hires coming up in the next quarter who trusts you and will give honest feedback. Track technical metrics (enrollment success rate, app install time) and experience metrics (user satisfaction, onboarding tickets), and compare time-to-productivity against your manual process.

Ask the new hires whether the instructions were clear and what confused them during setup. Write down every issue and how you fixed it, because that list becomes your runbook.

Step 6: Build the runbook, then scale

Start with one client and one platform. Rolling out Autopilot and Apple ADE across your whole client base at once multiplies the number of things that can fail at the same time.

Document every policy setting, every vendor contact and every decision before you add the next client, so the tenth deployment runs off what you learned in the first. For global clients, a procurement partner such as GoWorkwize or ZenAdmin can handle vendor relationships, international shipping and customs while you handle the configuration.

When zero touch deployment doesn't fit

Some devices will always need manual enrollment, and planning for them up front saves a scramble later. Fleet lists the common cases: devices bought from resellers that don't register them in Autopilot or Apple Business Manager, older devices that don't support zero touch protocols, one-off configurations that automated profiles can't express, and BYOD devices, where the user installs the MDM profile themselves.

For each client, keep a short manual enrollment procedure next to the zero touch runbook, and push procurement through registering resellers so the exceptions shrink over time.

What MSPs save with zero touch deployment

A worked example for a 50-device rollout at $75/hour:

Metric	Manual Process	Zero-Touch Deployment	Savings
Total labor hours	150 hours	5 hours	145 hours
Labor cost at $75/hour	$11,250	$375	$10,875
Average time to productivity	2-3 days	Same day	2-3 days
Onboarding support tickets	15-20	3-5	12-15 tickets

Vendor figures point the same way, though they come from vendors with something to sell. Addigy cites IDC research that zero touch deployment can cut device setup time by up to 50% and onboarding costs by as much as 70%, and reports a 60% reduction in manual setup hours per device for companies using MDM on Apple devices. JumpCloud puts a zero touch deployment at about fifteen minutes, against hours or days for traditional setup.

The labor savings usually justify the project on their own. Consistent configuration also means fewer onboarding tickets, faster time to productivity makes the client happier, and a documented zero touch process is something you can show in an RFP. Your best technicians would rather work on projects than image laptops, too.

Run your own numbers through the MSP ROI calculator.

Common zero touch deployment failure points

Zero touch deployment fails for predictable reasons, and most of them can be caught in the pilot.

Legacy line of business apps are the most common blocker, because some don't support silent install or MDM deployment. Package them through virtualization, keep a small pool of light-touch devices for the exceptions, or press the vendor to modernize.

Network problems during first boot can leave a device half-configured. Give users clear instructions to connect to Wi-Fi before Autopilot or ADE starts, and define offline fallback policies.

Vendors make mistakes. Devices arrive without pre-registration, or the hardware hash lands in the wrong tenant, so test every batch and keep buffer stock for critical start dates.

Policy conflicts cause enrollment failures and loops. Typical causes are overlapping configuration profiles, missing dependencies such as an app installing before the user account exists, and overly aggressive compliance rules.

Users get confused at first setup, which generates avoidable tickets. A one-page guide with screenshots cuts most of the "how do I" calls.

Testing on the wrong hardware hides problems until launch day. Validate on the exact model and OS version the client will receive, not on a virtual machine or a loaner.

After deployment: offboarding, RMM and the tickets that follow

Zero touch deployment covers the start of the device lifecycle, and the end deserves the same automation. When HR marks a departure, Intune can trigger a remote wipe or retire action that removes corporate data and cuts access; pair it with the account-side steps in our Microsoft 365 user offboarding guide.

MDM and RMM overlap, but they do different jobs. The MDM handles enrollment and policy enforcement, the RMM handles ongoing monitoring, patching and remote access, and the handoff point is when deployment completes and the device checks into your RMM. See RMM automation and unified endpoint management for MSPs for how the two fit together.

Your PSA should know when a device enrolls. ConnectWise, Autotask and HaloPSA can receive webhooks from MDM platforms, so an enrollment can open the onboarding ticket, assign tasks for app access, security training and the welcome meeting, and update the project timeline.

A configured device does not stop the tickets. The password resets, account unlocks and access requests start the week the new hire logs in. Rallied is an AI agent that closes those tickets in ConnectWise, HaloPSA or Autotask: it runs the fix in Microsoft 365 or your RMM and writes the notes and time entry back to the ticket. It costs $300/month with 2,000 credits included, a password reset counts as a standard ticket at 3 credits, and a ticket the agent couldn't finish is not charged. See how Rallied fits into your stack, read about Microsoft 365 management for MSPs, or request a demo.

For the account side of new hires, read how MSPs automate user onboarding in 2026.

Frequently Asked Questions

What is zero touch deployment for MSPs and why does it matter?

Zero touch deployment lets a new device ship straight to the employee and configure itself on first boot, using Windows Autopilot or Apple Business Manager plus an MDM such as Intune or Jamf. It matters because manual provisioning costs 1 to 3 technician hours per device, which is $75 to $225 at $75/hour and enough to wipe out the margin on a fixed-fee onboarding.

How much does zero touch deployment cost for an MSP?

Most of the cost is the MDM. Standalone Intune Plan 1 runs about $8/device/month, Jamf Pro is $5.75/device/month for mobile and $12.50/device/month for Mac, and Apple Business Manager is free. Vendor pricing changes, so check each vendor's pricing page before quoting a client.

Can zero touch deployment handle both Windows and Apple devices?

Yes. Windows uses Autopilot with Intune, and Apple uses Apple Business Manager with Automated Device Enrollment. For mixed clients you can run Intune for both platforms, or Intune for Windows and Jamf for Apple.

Can you do zero touch deployment without Intune?

For Apple devices, yes: Apple Business Manager works with Jamf, Iru, Addigy and other MDMs. For Windows, some other MDMs also support Autopilot-based enrollment; Fleet, for example, offers zero touch Windows enrollment through Microsoft Autopilot or Microsoft Entra ID. Confirm support with the MDM vendor before you commit a client.

What are the most common zero touch deployment failure points?

Legacy apps that can't install silently, network problems during first boot, vendors that skip pre-registration or register to the wrong tenant, conflicting policies that cause enrollment loops, and testing on hardware that differs from what the client receives. Devices bought outside registering resellers, older models and BYOD devices also fall back to manual enrollment.

How long does zero touch deployment implementation take?

Initial setup takes 2 to 4 weeks: choosing the MDM, configuring policies, setting up vendor relationships and testing. After that, each device takes minutes of employee time instead of hours of technician time; JumpCloud puts a zero touch deployment at about fifteen minutes.

Does zero touch deployment integrate with PSA and RMM tools?

Yes. Most MDM platforms offer APIs and webhooks that connect to ConnectWise, Autotask, HaloPSA and the major RMM platforms, so device enrollment can open onboarding tickets and trigger workflows. The device then hands off to the RMM for ongoing monitoring and patching.

What ROI should MSPs expect from zero touch deployment?

In a worked example of a 50-device rollout at $75/hour, labor drops from 150 hours to about 5, saving roughly $10,875. Vendor figures are lower but still large: Addigy reports a 60% reduction in manual setup hours per device and cites IDC research showing onboarding costs cut by as much as 70%.