Device security guidance

Zero touch cuts down on administrator time required to enrol each device and the likelihood for mistakes, as well as securing unenrolled devices in transit to users. The strength of these benefits grows with the number of devices to deploy.

In some cases, zero-touch enrolment may also provide additional security benefits. For example, on iOS, devices deployed through Apple Business Manager can be prevented from unenrolling from Mobile Device Management by the end user. It also means that wiped devices can't be re-used if lost or stolen, even if activation lock is not enabled.

End-users also benefit by receiving a brand new, boxed device, which hasn't been opened or pre-used by an administrator.

Specific requirements for each zero-touch enrolment programme vary, but in general:

• You'll need Mobile Device Management (MDM) infrastructure which supports the zero-touch enrolment programme you want to use.
• You'll need an entirely automated, over-the-air device management process that does not require administrators to manually configure each device - follow NCSC's detailed platform guidance and guidance from your MDM supplier.
• You'll need to decide how you'll do asset tracking, as your administrators will not be able to label each device before distribution.

Due to its security and administration benefits, the NCSC strongly recommends that large organisations use zero-touch enrolment programmes relevant to their devices.

For Windows devices

If you use MDM management of Windows 10, you should use Windows Autopilot. For traditional Windows domains with Group Policy management, manually re-imaging is likely to continue to be the best approach.

Where you are managing firmware settings on your devices, you may still need to manually configure these options on each device, as a standardised way to do this remotely has not yet been created.

For other devices

Follow the manufacturer guide for the exact process to follow. At a high level, you'll need to:

• Register for a zero-touch enrolment programmes for your chosen devices.
• When you buy new devices, let your supplier know they need to assign the devices to your zero-touch enrolment programme account, and provide them with the details
• Configure your Mobile Device Management services to automatically enrol new devices provisioned using zero-touch enrolment, including setting up policies to automatically apply to new devices.
• You'll need to provide user guidance on steps to take when receiving a new device, as your administrators won't be setting up devices before they reach the end user.

You may also want to:

• Try and retrospectively enrol your current fleet of devices into the chosen zero-touch enrolment programme so that if they are wiped they can be easily re-enrolled.
• Create an exception process for devices that can't be zero-touch enrolled, so they can be added to your Mobile Device Management infrastructure.

More information on zero-touch enrolment can be found on the various manufacturer websites:

Guidance articles:

• Purchasing devices
• Bring Your Own Device (BYOD)
• Choosing devices