# Zero Touch Deployment for Apple devices

## What is Zero Touch Deployment?

Zero Touch Deployment, as the very term suggests, allows administrators to hand over the devices to the end users from the store directly. The device becomes part of the managed devices and the end user starts using the device instantly.

## Prerequisites

An **Apple Business Manager** account is required for Zero Touch Deployment.

## Steps for administrators to implement Zero Touch Deployment

**Note**: This is a one time configuration that administrators should implement, upon which the entire process of device enrollment becomes automated.

1. **Zero Touch Deployment for new and already enrolled devices**
   - **Device Enrollment using Apple Business Manager**

     The first step is to enroll your devices into Endpoint Central using Apple Business Manager. Apple Business Manager is a portal that allows administrators to enrol their macOS devices in Mobile Device Management (MDM) solutions. [Learn how to enroll macOS devices](https://www.manageengine.com/mobile-device-management/help/enrollment/apple_business_manager_enrollment.html).

     or

   - **Zero Touch Deployment for already enrolled devices**

     Zero Touch Deployment can be implemented for devices that are already enrolled into Endpoint Central without having to factory reset the device. [Refer to this document.](https://www.manageengine.com/mobile-device-management/how-to/mdm-enroll-mac-without-reset.html)

   **Benefits**: The end user cannot remove the ManageEngine MDM profile and the device will be enrolled automatically into Endpoint Central without the end user's intervention.

2. **Create an admin account**

   When the end user switches on the device, a default account is required. Even this process can be automated using MDM. [Learn how to create an admin account](https://www.manageengine.com/mobile-device-management/help/enrollment/apple_business_manager_enrollment.html?macwp#mac_account_settings).

   **Benefits**: End users have a seamless experience in using their device; instantly they can use it.

3. **Turn on AD Authentication**

   Users will be verified using AD Authentication. Consequently, the device will be mapped in MDM for that particular user automatically. [Learn how to turn on AD Authentication](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_device_authentication.html#Active_Directory_Authentication).

   After mapping, assign the device a group in MDM. The profiles, apps, and policies applied to that specific group will be deployed to the newly added device. [Learn how to create a group in MDM](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_creating_groups.html).

   - You can [create](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_creating_profiles.html) and [associate profiles](https://www.manageengine.com/mobile-device-management/help/mobile_device_management/mdm_associating_profiles_to_groups.html) to the target groups. [Refer to this document](https://www.manageengine.com/mobile-device-management-msp/mdm-policies-and-profiles.html) to know what profiles can be created for different Operating Systems.
   - You can install apps to the target groups. [Learn more](https://www.manageengine.com/mobile-device-management-msp/help/app_management/mdm_app_management.html).

   **Benefits**: The device is mapped to a particular user and the profiles and apps applied to a group are deployed to the newly added device automatically.

4. **Create a custom group in Endpoint Central**

   Create a dynamic group such that devices become part of it based on the operating system automatically. [Learn how to create a custom group in Endpoint Central](https://www.manageengine.com/products/desktop-central/help/configuring_desktop_central/creating_custom_groups.html).

   **Benefits**: Upon creating a custom group, you can

   - **deploy software packages**. [Learn how](https://www.manageengine.com/products/desktop-central/help/software_installation/create-software-packages.html).

     Deploy both MSI and EXE software packages. Even [pre- and post-deployment activities](https://www.manageengine.com/products/desktop-central/software-deployment-pre-post-deployment-activities-scenarios.html) can be configured.

   - **deploy configuration**. [Learn how](https://www.manageengine.com/products/desktop-central/help/configurations.html).

     Endpoint Central has predefined configurations for Windows, Mac and Linux devices. Users can deploy any configuration to the target devices.

   - **configure a Self Service Portal**. [Know more](https://www.manageengine.com/products/desktop-central/help/software_installation/self_service_portal.html).

     Software installation requests can be raised as a request to the administrators. A Self Service Portal helps users to choose and install the software they need without the intervention of an administrator.

   - **execute custom scripts**. [Know more](https://www.manageengine.com/products/desktop-central/help/computer_configuration/executing_custom_scripts.html).

     Administrators can deploy custom scripts to the target devices using Endpoint Central.

## Steps for end users

1. Switch on the macOS device.
2. Start using the device!

You have successfully automated the process of enrolling macOS devices into Endpoint Central.