Enrolment and provisioning
Company phones, tablets and Mac computers that enrol themselves when switched on, with the right apps and settings, whether they come from a reseller or out of your storeroom.
At a glance
What it is
Zero-touch, QR code, Knox Mobile Enrollment and Apple Automated Device Enrollment set-ups that take devices from the box to ready-to-use.
How to start
Tell us what you need in your own words. You talk to the developers who would build it and get a written, line-item estimate.
Get a project estimateEvery managed device has to be enrolled once: linked to your organisation, given its management agent and handed its first policy. The method you choose decides how much hands-on work each device needs, whether a factory reset brings it back under management, and whether a staff member can remove it.
For new devices, the lowest-effort routes are Google's zero-touch enrolment for Android, Knox Mobile Enrollment for Samsung devices, and Apple's Automated Device Enrollment through Apple Business (formerly Apple Business Manager) or Apple School Manager. The reseller registers the devices to your account, and they configure themselves on first start.
For devices you already own, a QR code or the afw#setup code on Android, and Apple Configurator for iPhone, iPad and Mac, bring them into the same management after a reset.
We choose the methods for each device type, set up the portals and configurations with you as the account owner, and build the console views that show every device from purchase order to first check-in.
Comparison
| Suited to | Reset needed | Hands-on effort per device | After a factory reset | |
|---|---|---|---|---|
| Zero-touch enrolment (Android) | New company devices with Google Play services, bought from a participating reseller; Android 9 or later, supported Android 8 devices, or Pixel phones on Android 7 | Runs at first setup, new or reset | Minimal: switch on and connect to a network | Enrols again automatically while the device stays registered |
| Knox Mobile Enrollment (Samsung) | Samsung phones and tablets uploaded by a participating reseller, or, on Android 10 or later, enrolled with a Knox Mobile Enrollment QR code during setup | Runs at first setup, new or reset | Minimal with reseller upload; a QR scan otherwise | Enrols again while the device stays registered |
| QR code (Android) | Devices you already own on Android 7.0 or later, bought through any channel | Yes | Tap the welcome screen six times, then scan | Scan again |
| afw#setup code (Android) | Devices you already own, for Android Management API-based set-ups | Yes | Type the code at the account sign-in step of setup | Enter the code again |
| NFC tap (Android) | Fully managed set-up only, from a programmer device, where both devices have NFC | Yes | Tap the two devices together | Tap again |
| Work profile by app or link (Android) | Staff-owned phones | No | Staff follow a link or install the management app | Not applicable |
| Automated Device Enrollment (Apple) | iPhone, iPad and Mac bought through Apple or a participating reseller or carrier | Runs at first setup, new or erased | Minimal: connect to a network and the device finds your MDM during setup | Enrols again after erase |
| Apple Configurator (Apple) | iPhone, iPad and Mac you already own, added to Apple Business or Apple School Manager | Yes, the device is erased | Connect to a Mac, or scan with an iPhone running Apple Configurator | Enrols again, unless the user released it during the 30-day provisional period |
What is included
Platform: Google, Samsung and Apple portals
Platform: Admin dashboard
Platform: Managed devices
Platform: Admin dashboard
How it works
This is the zero-touch or Automated Device Enrollment path. QR-code enrolment starts at step four, with a reset device.
Devices are ordered with your zero-touch, Knox or Apple customer details, so the reseller can register them to you.
The reseller adds the serial numbers or IMEIs to your zero-touch, Knox or Apple Business account.
Each device, or the whole order, is given a configuration: which management service and which group or role.
The device connects to Wi-Fi or mobile data and, during setup, learns that it belongs to your organisation.
Android installs the management app; Apple devices enrol their built-in MDM client. The first policy is applied.
Required apps, Wi-Fi, certificates and restrictions install before the home screen appears, where the set-up supports it.
The device shows as enrolled against its purchase order, and IT can see any that have not been switched on yet.
Platforms
Android Enterprise devices, iPhone and iPad, Mac computers, and the console where enrolment is tracked.
Android phones, tablets and rugged handhelds with Google Play services, managed through Android Enterprise: company-owned devices as fully managed, dedicated (kiosk) or work-profile devices, and personal phones through a work profile only.
Organisation-owned or shared iPhone and iPad devices enrolled in MDM through Apple Business or Apple School Manager, supervised for Single App Mode and stricter restrictions.
Mac computers enrolled in MDM for configuration profiles, app and package installs, disk encryption settings and software update rules, set up at first power-on when the purchase is linked to Apple Business.
Back-office panels for operations, support and finance teams: orders, users, content, reports and permissions.
Technology
Each platform has its own enrolment service; our console ties them to your purchase records, so no device gets lost between the reseller and the site.
Device management
A Google cloud API for device-management products: your console sets the rules, and a Google app on each Android device applies them.
Used for
Device management
Built-in Android APIs that let one trusted app control a company device: kiosk lock, silent app updates and restrictions, even without Google Play.
Used for
Device management
The Apple portal for organisations, now called Apple Business: devices bought from Apple or linked resellers are assigned to your MDM and set up at first power-on.
Used for
Device management
The management channel built into iPhone, iPad and Mac: an MDM server sends settings, apps and commands, and devices apply them remotely.
Used for
Backend
A structured way to build back ends on Node.js, so large business systems stay organised, testable and easy to hand over.
Used for
Data
A reliable database for the records your business runs on: orders, payments, bookings and stock, kept accurate and easy to report on.
Used for
Web
Builds interactive screens in the browser, such as dashboards, admin panels and portals, that respond instantly as your team works.
Used for
Plain-English glossary
Confirm they take part in zero-touch, Knox Mobile Enrollment or Apple's programme, and give them your customer details with every order.
Choose which management service and group new devices join if nobody assigns them, so an unassigned device still ends up managed.
Devices need internet during setup. Plan Wi-Fi details or mobile data at each site, and allow the enrolment services through your firewall.
Import them from invoices, so the console can match devices to orders and sites.
List which will be reset and enrolled by QR code or Apple Configurator, and back up anything stored on them first.
Product preview
Sample screens: names, prices and figures are examples, not client data.
Work
Device management & kiosk solutions
An illustrative console for school tablets: iPad devices through Apple School Manager and MDM, Android™ tablets through Android Enterprise, with class-based rules teachers can follow.
Runs on
Built with
Device management & kiosk solutions
An illustrative kiosk product for retail chains: locked Android tablets for catalogues and price checks, a staff launcher, and a console to enrol, update and monitor every device.
Runs on
Built with
Industries
Cost drivers
One method for all devices is simplest. Mixing zero-touch, Knox, QR codes and Apple enrolment means more configurations and more testing.
Existing devices need backup, reset and re-enrolment, often on site, which takes more effort than new devices from a reseller.
An enrolment queue matched to purchase orders, automatic grouping and alerts is development work; portal configuration alone is not.
Every site needs a working network at first start; guest Wi-Fi sign-in pages and firewalls can block enrolment and need testing.
Android, iPhone and iPad, and Mac each have their own portal, enrolment flow and test cycle.
Estimates are written from your scope, with the effort and assumptions behind each line item.
How pricing worksProcess
Models, OS versions, resellers, and how many devices are new or already in use.
You getEnrolment method per device type
Your zero-touch, Knox and Apple Business or Apple School Manager accounts set up and linked to your management service, with your organisation as the account owner.
You getLinked portals and configurations
Two or three devices of each model enrolled by each method, including a reset to prove re-enrolment.
You getTested configurations
Purchase order and serial number import, enrolment queue and group rules, built and tested.
You getEnrolment dashboard
Site guides, a help line for the first days and a daily list of devices that have not yet enrolled.
You getRollout tracker
Services
The disciplines a project like this draws on.
Software shaped around how your business runs, from approvals and inventory to billing and reports, replacing spreadsheets and disconnected tools.
Back-office dashboards built around your team's daily tasks: order queues, approvals, catalogue management, payouts, reports and audit logs.
Secure, documented REST and GraphQL APIs, plus integrations that connect your apps to payment, logistics, GST, messaging and business systems.
Native Android apps in Kotlin and Jetpack Compose, designed for entry-level phones, patchy networks and the background limits of popular Android brands.
Native iPhone and iPad apps in Swift and SwiftUI, built to Apple's review guidelines and privacy rules and tested on the devices your customers use.
FAQ
Only if the seller takes part in zero-touch and can register those devices to your account; devices bought from ordinary consumer retail cannot be added. For devices outside the programme, we use QR-code or afw#setup enrolment after a factory reset. That gives the same management, but someone has to start each device, and a later reset needs the same step again.
Google states that its zero-touch APIs are free to use, and Samsung offers Knox Mobile Enrollment without a licence (some advanced options need a paid Knox plan), although some resellers charge for registering devices or bundle it with other services. The main costs sit elsewhere: your management service (an EMM licence or your own console), the devices themselves and the set-up work. Apple's programmes have their own terms, which we check for your organisation at the time.
With zero-touch, Knox Mobile Enrollment or Apple's Automated Device Enrollment, the device enrols into your management again during setup, so a reset does not free it. With QR-code or afw#setup enrolment, a reset removes management and someone must enrol it again. That is why we block reset from the settings menu on company-owned devices, and set factory reset protection tied to company accounts, which asks for an approved account after a reset from the recovery menu.
Not from a device enrolled through Automated Device Enrollment with a non-removable enrolment: it is supervised and the management stays. Devices added later with Apple Configurator have a 30-day provisional period in which the user can release them. Devices a user enrolled manually, and personal devices using User Enrollment, can be removed by the user, which also removes the managed apps and data.
Yes, or mobile data. Zero-touch, QR and Apple enrolment all contact online services during setup, and the first apps download straight away. Guest Wi-Fi that asks you to accept terms in a browser often blocks enrolment. We give your IT team the list of services the firewall must allow, and an Android QR code can carry the Wi-Fi details so nobody types a password on each device.
Yes. Zero-touch and Knox configurations can pass extra details to the management app, and Apple Business can assign devices to an MDM server by order or device type. Our console then maps each device to a group by serial number, purchase order, site code or the QR code used, so a tablet for Store 12 arrives with Store 12's apps and settings.
Related
Next step
Tell us how many devices, which models and where you buy them. We will recommend enrolment methods and send a line-item estimate.
