Zero-touch deployment means a new Mac goes from Apple or your reseller straight to the person who’ll use it, then sets itself up with your company’s settings, apps and security the first time it connects to the internet. Nobody in IT unboxes it, and nobody has to remember the dozen small jobs that usually get missed on a new starter’s first morning.
For a business that runs on Macs, it’s the setup we’d recommend for every company-owned machine. Below is how it works, what you need in place, and where it tends to trip people up.
The three pieces that make it work
Three things need to be connected for it to work.
Apple Business is Apple’s free portal for organisations. It replaced Apple Business Manager in April 2026, and it keeps a record of every Apple device your company owns. Once a Mac’s serial number is in your account, Apple knows that Mac belongs to you.
A device management service, or DMS (formerly MDM), tells the Mac what to do once it knows who it belongs to: which apps to install, which settings to lock down, whether to switch on FileVault encryption, and so on. Apple Business now has a basic one built in. Most of the Mac fleets Dr Logic looks after run on Addigy, which gives us finer control over patching, reporting and the day-to-day running of a fleet.
The buying channel is the piece people forget. Apple only adds Macs to your account automatically when you buy them from Apple or an Apple Authorised Reseller that has your organisation details. A Mac bought on someone’s personal card, or from a shop that isn’t linked to your account, won’t appear in Apple Business, so it can’t set itself up.
What happens from order to first login
This is the sequence for a new Mac.
- Order the Mac from Apple or an Apple Authorised Reseller. Give them your Apple Business organisation ID.
- Find the Mac’s serial number in Apple Business. Assign the Mac to your DMS, or set a default so all new Macs go there automatically.
- Send the Mac to the employee.
- The employee turns on the Mac and connects to Wi-Fi.
- The Mac contacts Apple, finds your organisation and enrols in your DMS. The employee can’t skip this step.
- The employee signs in. On macOS 26 and later, they can sign in with their work account during setup, if you configure this.
- Your DMS installs apps, applies settings and turns on security controls. The Mac is ready to use.
From the employee’s side, that’s a few setup screens and a short wait while apps arrive. If the Mac is ever wiped, it goes through the same process again the next time it starts up, because it’s still assigned to you in Apple Business.
What you need to set up first
The first Mac takes the most effort, and every Mac after that repeats it. You’ll need an Apple Business account linked to your DMS, and your organisation ID shared with whoever you buy Macs from. Then you build the configuration your Macs will receive: Wi-Fi, FileVault, the apps each team needs, your security tools, and which setup screens to skip so staff aren’t asked about Siri and Screen Time on day one.
Connecting Apple Business to Google Workspace or Microsoft Entra ID is worth doing at the same stage. Apple Business can then create Managed Apple Accounts for new starters automatically, which takes another manual job off the list.
Test it with one Mac before you trust it with a new starter. Erase it, go through setup as if you were the employee, and check that everything arrives.
A common snag at this stage is an Apple Business account set up years ago by someone who’s since left, so nobody’s quite sure which DMS the Macs point at or who holds the admin login. If that sounds like your setup, we’re happy to take a look at your device management and get it straightened out.
New starter on Monday and their Mac’s still in the box?
We’ll connect Apple Business and your DMS so the next Mac sets itself up before they’ve finished their coffee.
Macs that weren’t bought through Apple or a reseller
For the odd Mac bought elsewhere, Apple Configurator for iPhone can add a Mac to Apple Business by hand. The Mac needs Apple silicon or a T2 Security Chip and macOS 12.0.1 or later, and if it’s already been set up, you’ll have to erase it first.
There’s one difference to know about. For 30 days after a Mac is added this way and enrols, the person using it can release it from Apple Business and from management. After that, it behaves like any other zero-touch Mac. Configurator is fine for a handful of machines. For anything more, we’d fix the buying route so new Macs land in your account on their own.
Choosing where your Macs are managed
Apple Business’s built-in management is a reasonable fit for a very small team with simple needs. Once you have more people, more apps or a Cyber Essentials assessment to pass, you’ll want a dedicated DMS. Dr Logic recommends Addigy for most client fleets. Where a business needs what Jamf offers, Jamf sits alongside Apple Business in the same way: Apple Business records who owns the Mac, and Jamf manages it from there.
Moving from another DMS is also much less painful than it used to be. Since macOS 26, Apple Business can move Macs that were enrolled through zero-touch to a new DMS without erasing them. You can set a deadline, too, so the move happens even for the colleague who keeps clicking “Later”.
If you’d like your next new starter’s Mac to turn up ready to work, we can set up Apple Business and your DMS, test the process with you and leave your team with a routine they can repeat. Our Apple business IT support page explains how we work.
Related articles
FAQs
Is Apple Business free?
Yes. Apple Business is free for UK organisations, including the built-in device management. It replaced Apple Business Manager, Apple Business Essentials and Apple Business Connect in April 2026. Extras such as AppleCare+ for Business and additional iCloud storage are paid, and a separate DMS like Addigy or Jamf has its own licence cost.
Can we use zero-touch deployment for Macs we already own?
Partly. Macs bought from Apple or an Apple Authorised Reseller can often be added to your account retrospectively. Others can be added by hand with Apple Configurator for iPhone, as long as they have Apple silicon or a T2 chip. Either way, a Mac that’s already set up needs erasing before it enrols.
Do we still need a separate DMS now Apple Business has one built in?
For a very small team with simple needs, the built-in option can be enough. Most growing businesses want more control over updates, apps, reporting and security evidence, which is where a dedicated DMS comes in. Dr Logic recommends Addigy for most fleets, with Jamf where a business’s requirements call for it.
Can staff remove company management from a zero-touch Mac?
No. A Mac enrolled through zero-touch deployment can’t be removed from management by the person using it, and it re-enrols automatically if it’s wiped. Macs added by hand with Apple Configurator are the exception: the user can release them during the first 30 days after enrolment.
What do we need before the first zero-touch Mac arrives?
An Apple Business account, a DMS linked to it, and your organisation ID registered with Apple or your reseller. You’ll also need a configuration ready in your DMS, covering Wi-Fi, FileVault, apps and security tools. Test it on one Mac before sending any to new starters.
