Zero-Touch
Zero-T
Zero-Touch
Apple Device Deployments
for beginners

Smart, fast, modern
deployment
Is your organization receiving an influx of Apple devices? Are your employees remote and in need ofonboarded devices? Ready to move away from hands-on, time consuming deployment practices? Ormaybe you’re the only person responsible for deploying your entire fleet of Apple devices and you needa more efficient way of doing so?

Either way, you’ve come to the right place.

In this e-book:We simplify Apple deployment terminology andshow you exactly what it takes to automate Mac,
iPad, iPhone and Apple TV deployments in yourorganization.

A n ov e r v i e wof Apple’sd e p l oy m e n t
programs
Apple Business Manager (ABM) and Apple School Manager (ASM) offer key features needed to enablea zero-touch deployment strategy.
These programs assist in device enrollment by recognizing the serial number, and automaticallyenrolling that device into your mobile device management (MDM) server the first time it’s taken outof the box and powered on. They also allow you to procure app and book licenses from Apple andremotely deploy and manage them with your MDM solution.

Automatic device enrollment: To provide automated device
enrollment into a mobile device management (MDM) server.
Apps and Books: To purchase app licenses in bulk.
Through either program, you can set up devices and deploy apps without getting Apple IDs tangled up
in the works. Apple IDs are unique identifiers to know who the user of the device is. To make this extra
simple, Apple now allows for Managed Apple IDs which empowers IT to be fully in charge of setup andmanagement of the Apple ID — saving end users the need to create and remember their own ID andpassword.

A n ov e r v i e wof Apple’sd e p l oy m e n tprograms

Best of all, ABM and ASM are available at no cost; the only requirement is that you
procure your Apple technology from a supported vendor.

Out with the old.
Changes to Apple Business Manager and Apple School
Manager brought some new language in to replace
the old. Below, you’ll see what terminology has changed
over the years:
Device Enrollment Program (DEP) → Automatic device enrollment
Volume Purchase Program (VPP) → Apps and Books
DEP + VPP → Apple Business Manager (for businesses)
DEP + VPP → Apple School Manager (for schools)Benefits ofz e r o - to u c hd e p l oy m e n t sWith the knowledge of Apple’s deployment programs under your belt, it’s time
to dig into why you’ll love having a zero-touch deployment strategy in yourenvironment.
Not surprising, IT is busy. They constantly deal with incoming tickets, network
issues, provisioning accounts across various services, hardware requests,
software deployments, and general help notifications by any user at any time.
Add the task of unboxing each device, powering on and configuring prior
to deploying to users, and there is virtually no time for anything else. By
implementing a zero-touch deployment strategy, you will be able to save timeand money by automating and empowering users to accomplish these steps on
their own, without the help of IT.

Enrollment
options for
macOS
There are a few ways you can enroll devices.

For macOS

Description

User Experience

Best For
Providing users an out-of-box experience. With zerotouch deployment you can:Automatic zero-touchenrollment with AppleBusiness Manager orApple School Manager

Automatic enrollment
over the air

User receives shrink-wrappedbox, and the device is
automatically configured whenturned onUser-initiated enrollment

Rely on users toenroll their own Macs
via a URL your MDM
server creates

User visits a specific URL toconfigure their device

BYOD programs or when automatic zero-touchenrollment is not an option

Network scan

Scan your networkfor existing Macs anddeploy an enrollment
packageHands-on for IT — enrollment iscompleted remotely through yourMDM when Mac is on the samenetwork

Enrolling Macs en masse which are known to be on
the same network• Ship devices to remote employees• Speed up the onboarding process• Support education institutions with Mac programs

Zero-touch deployments via Apple School Manager or Apple Business Manager is the recommended way to enroll
Mac to save your organization time and preserve the user experience.

Enrollment
options formacOS
There’s Mac provisioning, and then there’s Mac provisioning
with Jamf Connect
Provisioning new Macs with the resources users need based on users’ cloud identity credentials makes
it even easier to provide an out-of-the-box experience tailored for each end user, connected with theircloud identity from the start. Supporting cloud-identity providers such as Okta, Microsoft Azure ActiveDirectory, Google Cloud and Apple’s enrollment customization feature, Jamf Connect provides animproved user experience during setup and the most complete, zero-touch, modern provisioning.

Additionally:• Improved login experience with a single set of credentials
across your users’ cloud-identity provider and Mac. Jamf
Connect extends this to cloud-identity providers and keeps
them in sync indefinitely.
• Organized Mac fleet for IT to manage — all users are
consistently using their cloud-identity credentials (usernameand password) across their device and applications.
• Multifactor authentication with each and every login, ensuring
the right person is on the right machine.
Jamf Connect

Enrollment
options fori O S , i Pa d O Sand tvOS

For iOS, iPadOS and tvOS

Description

Automatic zero-touchenrollment with Apple
Business Manager orApple School Manager

Automatic enrollment
over the air

User-initiated via URL*Not an option for tvOS

Rely on users toenroll their own
device via a URL yourMDM server creates

Apple Configurator

Enrollment througha Mac app thatconnects to devices
via USB

User Experience

Supervision

Providing users an out-of-box experience.
With zero-touch deployment you can:User receives shrinkwrapped box, and thedevice is automaticallyconfigured when turned onYes(wirelessly)

User visits a specific URL to
configure their device

Via Apple
Configurator,
but MDM isremovable

IT manages the setup
process and hands devices
to users

Best ForYes• Ship devices to remote employees• Speed up the onboarding process• Support education institutions withApple programs
Unmanaged devices currently in the fieldor devices that need to be reenrolled into
a new MDM server*Does not guarantee adoption

When Apple Business Manager or AppleSchool Manager are not an option*Time consuming**Note, some newer Apple TV hardware
does not have a USB port and will requirean ethernet cableZero-touch deployments via Apple School Manager or Apple Business Manager is the recommended way to enroll
iPad, iPhone and Apple TV devices to save your organization time and preserve the user experience.

Th e z e r o - to u c henrollment
wo r k f l ow
There are three basic steps to follow when implementing zero-touchenrollment: prepare, purchase and deploy.

Prepare1. Sign up for Apple

Business or AppleSchool Manager

2. Link account toyour MDM server

3. Configure

enrollment settings

Purchase
1. Order Apple

Deploy1. Send devices to

2. Assign devices for

2. Users unbox and*Must be purchased via Apple directlyor an authorized reseller

3. Devices enroll

hardware*enrollment

users

turn on device

into management
automatically

MDM formacOS, iOS,i Pa d O S a n dtvOS
Pairing MDM with Apple’s deployment programsYour MDM server communicates to devices via the Apple Push Notification service(APNs) and tells them how to behave. This maintains a constant connection to yourdevices, so you don’t have to. Commands, apps and profiles are all sent to thedevice remotely.
MDM software leverages the MDM framework built into Apple’s operating systems.
With your MDM solution, you can build configuration profiles based on the various
settings you’d like to deliver and push them to your devices over the air via APNs.
Configuration profiles are XML files and can be built inside of Jamf Pro.

Mobile devicemanagementfor macOS
Go beyond baseline control for macOS. macOS is a robust platform that needs additional
functionality control, for example, modifying a user account, sending terminal commands, anddeploying third-party apps and packages.
By leveraging client management, organizations can install a Mac agent, or binary, that is
automatically installed after enrollment and gives you more control over your managed Macs.
It adds a hidden admin account that grants you remote root access that enables you to run
advanced policies, custom scripts, install custom software, and a whole lot more.
Combining the MDM framework with the Mac agent gives you total control of configuration andmanagement of your Macs.

Install PKG/DMG

Enforce FileVault

Integrate with Cloud
Identity

Run Scripts

Customize Dock

Set EFI Password

Install Printers

Create Accounts

Set Software UpdateS e r v i c e b e yo n dd e p l oy m e n tArming your users with the tools they need doesn’t stop after the initial
deployment, and certainly shouldn’t stray from the zero-touch goal. Jamf Self
Service empowers end users with instant access to resources, content andtrusted apps through a single click – no help desk tickets needed.

• Access to the App Store,
B2B, in-house apps andthird-party software• Email, VPN and otherconfigurations• Help desk ticketing andhardware requests• Password resets andcompliance information• E-books, guides and videos• Basic maintenance andsystem diagnostics• Bookmarks and shortcuts• Software and OS upgrades• Printer mapping and drivers• Single Sign-on (SSO)
integration

IT customizes Self Service to fit the needs of their specific users and users seek out
exactly what they need and quickly download it for themselves.

IT taking care of users, so users can take care ofthemselves long after they get their devices.

P u r p o s e - b u i lt
Apple ecosystemmanagement

To get the most out of these deployment programs, you need an MDM software solution that
understands Apple. As the best-of-breed Apple enterprise management solution, Jamf is the producttrusted by businesses and schools that want to provide a consistent management experience acrossthe entire ecosystem.

With Jamf:
Reduce time spent

Reduce time installing andReduce volume of IT Helpprovisioning by

updating applications by

Desk tickets by

80%

90%

15%

Reduce the cost of

Reduce end-user

software application

productivity loss bylicenses by

10%

2%

When you let Apple Business Manager
or Apple School Manager automaticallyenroll your devices into management
and Jamf handles all the device settings
and app configurations, you can behands-off with all Apple deployments— giving you more time to focus
on projects that better serve theorganization.

See the benefits of utilizing Appleand Jamf for your automateddevice deployments andmanagement.
Start a free trial
or contact your preferred resellerof Apple devices to take Jamf fora test drive.