Zero-Touch Deployment Case Study — 1,000+ Devices

Enterprise zero-touch deployment across macOS and Windows — Jamf Pro, Apple Business Manager, and Microsoft Intune Autopilot for a 1,000+ device fleet in a hybrid corporate and manufacturing environment.

The problem

Device setup was a technician-hours problem. Every new hire, every replacement, every RMA meant a person unboxing hardware, imaging or manually configuring it, installing a standard app set by hand, joining it to identity, and testing before it could ship. Across a fleet of this size and a normal rate of churn, that was a meaningful fraction of a full-time role spent on repetitive provisioning — and the results still drifted, because “the standard build” lived partly in a wiki and partly in muscle memory.

The goal was ship-to-user: a device goes from the vendor straight to the employee, and it configures itself on first boot — supervised, compliant, and with the right apps — with no technician touch.

Approach

Fix the layer below the MDM first. Apple Business Manager and the Windows equivalent are what make a device enroll automatically. I federated Apple Business Manager with Entra ID, linked every reseller and Apple Customer Number so purchases flowed in automatically, and set default MDM server assignment so new devices landed in Jamf (Apple) or Intune (Windows) without manual claiming.
Build the enrollment experience. For Macs, a Jamf PreStage that supervises the device, skips the Setup Assistant panes that generate support tickets, and shows a branded enrollment screen. For Windows, an Autopilot deployment profile (user-driven, Entra join) with a tuned Enrollment Status Page — a curated set of blocking apps and a realistic timeout so the first-boot experience doesn’t hang.
Codify the standard build. Every configuration profile, security baseline, and app moved out of the wiki and into scoped Jamf policies and Intune assignments. Smart Groups and dynamic device groups decide what a device gets based on its inventory, not a manual scoping step.
Pilot in rings. IT first, then a friendly department, then fleet-wide — each ring catching a different class of problem (driver quirks, line-of-business app behaviour, real-world network conditions).
Instrument it. A dashboard tracking enrollment success rate, time-to-productive, and which step in the ESP or PreStage was failing when one did.

What I built

Apple side: ABM federated to Entra ID, automated device assignment, a supervised PreStage with enrollment customization, configuration profiles for security and management payloads, and a Self Service catalog so users pull optional software themselves.
Windows side: Autopilot profiles, Intune compliance and configuration policies, Win32 and MSIX app packages with detection rules, update rings, and a hardened ESP.
Shared: Conditional Access wired so a device that fails to reach compliance during enrollment can’t reach corporate data until it does, and a Graph API / Jamf API reporting job that surfaces stuck enrollments before the user calls the help desk.

Results

~40% reduction in manual provisioning time per device — the technician touch on a standard deployment went from most of an afternoon to signing in and a compliance check.
Standard builds became genuinely standard — because the build is a set of policies, every device of a given type is configured identically, and the config is versioned and auditable.
Replacement and RMA turnaround dropped to the shipping time plus a first-boot, since no imaging bench was involved.
The enrollment dashboard turned “is onboarding working?” from an anecdote into a number the team watches.

What I’d tell someone starting this

The MDM configuration is the easy part. The two things that actually determine whether zero-touch works are the enrollment layer underneath it — ABM, reseller links, the two annual tokens you must never let expire — and the discipline of moving every “we always do this manually” step into a policy. Pilot in rings, and instrument the enrollment so a failure is a dashboard entry, not a support ticket.

← All projects · Discuss a similar rollout