A device comprising: one or more processors;; a configuration interface executable by the one or more processors to communicate a public device identification, ID, to a provisioning service, the public device ID being cryptographically associated with a private key securely stored in the device, a user being identified as an owner of the device based on an ownership record and the public device ID, one or more device configuration parameters specific to the user and the device being stored in association with the ownership record; a payload manager executable by the one or more processors to receive an encrypted configuration payload from the provisioning service, the configuration payload containing the one or more device configuration parameters specific to the user and the device, the encrypted configuration payload being encrypted using the public device ID cryptographically associated with the private key securely stored in the device; a decryption engine executable by the one or more processors to decrypt the encrypted configuration payload using the private key securely stored on the device and cryptographically associated with the public device ID communicated to the provisioning service; and a device configuration manager executable by the one or more processors to configure the device according to the one or more device configuration parameters received in the configuration payload, characterized in that the configuration interface is further executable by the one or more processors to, upon receiving power at the device, communicatively connect to a provisioning channel associated with a provisioning channel ID stored on the device prior to receiving the power at the device, the public device ID being communicated via the provisioning channel and the encrypted configuration payload being received via the provisioning channel. one or more processors;; a configuration interface executable by the one or more processors to communicate a public device identification, ID, to a provisioning service, the public device ID being cryptographically associated with a private key securely stored in the device, a user being identified as an owner of the device based on an ownership record and the public device ID, one or more device configuration parameters specific to the user and the device being stored in association with the ownership record; a payload manager executable by the one or more processors to receive an encrypted configuration payload from the provisioning service, the configuration payload containing the one or more device configuration parameters specific to the user and the device, the encrypted configuration payload being encrypted using the public device ID cryptographically associated with the private key securely stored in the device; a decryption engine executable by the one or more processors to decrypt the encrypted configuration payload using the private key securely stored on the device and cryptographically associated with the public device ID communicated to the provisioning service; and a device configuration manager executable by the one or more processors to configure the device according to the one or more device configuration parameters received in the configuration payload, characterized in that the configuration interface is further executable by the one or more processors to, upon receiving power at the device, communicatively connect to a provisioning channel associated with a provisioning channel ID stored on the device prior to receiving the power at the device, the public device ID being communicated via the provisioning channel and the encrypted configuration payload being received via the provisioning channel.