Remote Device Management for SMBs: Every OS, One Workflow

Zero-touch deployment (ZTD) is automated device provisioning that requires no manual IT setup once the device is powered on. Hardware is registered to an OEM portal at purchase. On first power-on, the device checks in with that portal, gets routed to your MDM, and downloads the configuration profiles, apps and security policies tied to that user’s role.

Three prerequisites, the same on every OS:

1. An authorized reseller that can pre-register the device to the relevant OEM portal
2. The OEM portal itself: Apple Business Manager, Microsoft Autopilot, or Android Enterprise zero-touch
3. An MDM/UEM platform wired into the portal

The OEM programs are free from Apple, Microsoft and Google. The MDM, procurement integration and rollout work are not. This article covers how the three OS programs work, what the out-of-box experience looks like, and how to roll zero-touch out on a 1–3 person IT team.

Zero-touch vs traditional manual deployment

The old way:

1. Procure the device
2. Receive it at the office (or the IT lead’s home)
3. Image the OS
4. Install management agents
5. Configure policies and apps by hand
6. Ship to the employee
7. Walk the employee through plugging it in
8. Manually enroll into the MDM during a video call

The zero-touch way:

1. HR creates the new hire in the HRIS
2. The device, ordered through a zero-touch-eligible channel, ships sealed directly to the employee and configures itself on first power-on

Eight steps to two. Even if your “old way” only takes 90 minutes per device, multiply that by 30 hires per quarter and you’ve burned a full work-week on a process that should have been automated.

The other win is consistency: every device gets the same baseline, regardless of who was on call when it shipped.

‍

What zero-touch deployment looks like on each OS

Apple-only writers describe ADE in detail. Windows-only writers cover Autopilot. The reality for 2026 SMBs is mixed-OS fleets. You need all three to fit one workflow.

Apple: Apple Business Manager and Automated Device Enrollment (ADE)

Apple Business Manager (ABM) is the OEM portal for any organization buying Apple devices. For ABM to pre-register a device automatically, the hardware has to be purchased through Apple Business or an authorized Apple reseller enrolled in the program. Retail-channel devices are not auto-linked to ABM. They can be enrolled manually, but they don’t ride the zero-touch flow out of the box.

Automated Device Enrollment (ADE) is the mechanism inside ABM that routes a device to your MDM on first power-on. The device sees the ABM record, learns which MDM to talk to, and enrolls automatically. ADE is the current name for the program formerly known as the Device Enrollment Program (DEP). If a vendor’s docs still reference “DEP”, treat that as a freshness signal worth noting.

For BYOD or personally-owned devices, Apple offers Account-Driven User Enrollment, which is a separate flow keyed off Apple ID rather than serial number. Most company-owned deployments use ADE.

Windows: Microsoft Autopilot

The Windows zero-touch story has three moving parts that often get conflated:

• Microsoft Entra ID is the identity provider (formerly Azure AD)
• Microsoft Intune is Microsoft’s MDM
• Windows Autopilot is the zero-touch deployment service that ties hardware to Entra ID and routes the device to an MDM

Autopilot can route to Intune by default, or to a third-party MDM through partner integration. Hardware is registered through OEMs (Dell, Lenovo, HP, Microsoft Surface) using the device’s hardware hash. The hash can be uploaded manually for devices already in your possession, or pre-loaded by the reseller for new orders.

On first boot, the device authenticates against Entra ID and applies role-based configuration during the out-of-box experience (OOBE).

Android: Android Enterprise zero-touch enrollment

Android zero-touch enrollment is Google’s equivalent program. Devices purchased through a zero-touch reseller are linked to your organization’s zero-touch account at the moment of purchase.

When the device is powered on, it downloads the configured Device Policy Controller (DPC) from your MDM, applies the work profile or fully managed configuration, and is ready for the user. Works across major Android OEMs (Samsung, Google Pixel, Motorola, Sony, and others certified for Android Enterprise).

‍

Cross-platform comparison

If you’re running a mixed fleet, the platform question becomes: does your MDM speak to all three of these portals from one console?

Primo states support for Apple Business Manager and Windows Autopilot on its procurement page. Android zero-touch is supported at the OS layer (Primo manages Android devices) but pre-registration of Android hardware to the zero-touch portal isn’t a publicly-claimed part of the procurement workflow as of writing. For Android-heavy fleets, confirm coverage during your demo.

The end-user out-of-box experience (OOBE)

Done well, this is what the new hire actually sees:

1. Sealed box arrives at the new hire’s address, two to three days before start date
2. On Day One, they unbox, plug in, power on, connect to Wi-Fi
3. The device asks them to sign in with their work credentials
4. They authenticate through your IdP (with MFA)
5. They wait while policies, apps and configurations install — this often takes 15–30 minutes, depending on the apps in the role profile, network speed and policy payload
6. They land on a ready-to-use desktop with email, chat, calendar and role-based apps already signed in

No download links. No “install this then install that”. No screen-share with IT to fix the SSO loop. If the new hire is offline during this window, the device waits patiently. The flow resumes the moment they connect to Wi-Fi.

‍

HR-triggered zero-touch onboarding in practice

Zero-touch on the device is one half. The trigger upstream is the other half.

1. HR creates the new hire in an HRIS such as BambooHR, HiBob, Factorial, Eurécia, Deel, Dayforce, Charlie, ADP or Gusto
2. The HRIS event fires into your remote device management platform
3. The platform places the hardware order with the reseller, including pre-registration to the OEM portal where supported
4. The device ships to the new hire’s address
5. The platform provisions the IdP account and role-based SaaS access in parallel
6. On Day One, the employee powers on, authenticates through the IdP, and lands on a fully configured machine

Primo states this directly: “HR triggers it. Primo executes it.” and the procurement workflow runs returns and wipes from the same HR events. So the same trigger that fires onboarding also fires offboarding, and parity stays intact.

For the full operational playbook around steps 1, 5 and the Day One experience, see the IT onboarding checklist for lean IT teams.

‍

The procurement layer most zero-touch guides ignore

This is the part that gets glossed over in vendor docs, and the part that quietly breaks zero-touch in practice.

For ADE, Autopilot or Android zero-touch to work, the hardware has to be ordered through a reseller that supports OEM pre-registration. Retail or consumer-channel devices generally aren’t auto-linked to your OEM portal. You’d have to enroll them manually after the fact, which costs most of the zero-touch benefit.

What goes wrong without procurement integration:

• IT manually uploads hardware hashes for Windows devices after they arrive
• IT manually adds serials to ABM after delivery (and hopes the device hasn’t already been set up)
• International orders get stuck in customs because the reseller doesn’t ship to the destination country
• Devices arrive with the wrong OS image, language or region

Primo’s procurement workflow handles this end-to-end: sourcing through authorized resellers (“partners with manufacturers and authorized repair centers”), shipping to 60+ countries in around 5 business days, configuring apps and security before the device leaves the warehouse, and triggering returns automatically from your HR workflows.

‍

A zero-touch deployment rollout plan for SMB IT teams

If you’re going from manual to zero-touch this quarter, here’s the rollout sequence that won’t break your live onboarding flow.

1. Standardize role-to-device-profile mapping. Designer → MacBook Pro M-series with design tools. Sales Rep → MacBook Air or comparable Windows laptop with the sales stack. Define this once.
2. Connect the HRIS. Pipe the new-hire event from your HR system into your RDM platform.
3. Configure the OEM portals you need. ABM if you’re on Apple. Autopilot if you have Windows. Android zero-touch if mobile is in scope. Most teams don’t need all three on day one.
4. Define MDM configuration profiles per role. Encryption, password policy, app baseline, restrictions, idle-lock. Test one role end-to-end before duplicating.
5. Pilot with one department. A team of 5–10 hires per quarter is ideal. Watch what breaks.
6. Extend to all hires. Once the pilot runs for a month without IT intervention, roll out the same flow to everyone.
7. Set up the reverse workflow for offboarding. Same RDM, same HRIS trigger, mirror actions: remote wipe, return label, SaaS access revocation.

Timelines vary by team and platform. For a 1–3 person IT team with a single primary OS, a few weeks of focused work is realistic; multi-OS rollouts with custom configuration profiles take longer. Anything that needs a multi-quarter rollout suggests the platform is too heavy for the team running it.

‍

Can you do zero-touch deployment without Intune?

Yes — and for most SMBs, it’s the more practical path.

Microsoft Autopilot is the zero-touch deployment service. Intune is Microsoft’s MDM. The two are often bundled in Microsoft’s documentation, but Autopilot supports partner MDM integration, meaning third-party MDMs can receive devices from Autopilot in the same OOBE flow.

The trade-offs:

• With Intune: tightest integration, single Microsoft admin surface, full feature parity with Microsoft’s roadmap. Strong fit if your stack is already Microsoft-led (Entra ID, Microsoft 365, Defender).
• With a partner MDM: single console across macOS, Windows, Linux, iOS and Android, lighter to deploy, often a better fit for mixed-OS SMB fleets where Microsoft isn’t already the centre of gravity.

Autopilot itself depends on Microsoft Entra ID plus an MDM service to receive the device. A platform like Primo enrolls in that MDM-service role: your Windows devices ride the Autopilot flow into Primo’s console, where they’re managed alongside Mac, Linux, iOS and Android. Confirm exact Entra/Autopilot licensing requirements with Microsoft for your stack. They vary by edition.

‍

Zero-touch offboarding and access cleanup

Zero-touch shouldn’t end at first login. The same automation should run in reverse on exit.

When the HRIS marks the employee as terminated, the RDM platform should:

• Trigger a remote wipe (full or selective depending on ownership)
• Generate a return label and email it to the employee
• Revoke IdP access (which cascades through every SSO-connected app)
• Deactivate accounts on apps not behind SSO
• Mark the asset for reassignment or retirement in inventory

Same workflow, same trigger, opposite direction. Primo states this directly: “Revoked automatically on their last day to prevent security breach.” and “Returns, wipes, and reassignments triggered automatically by your HR workflows.”

A device wipe alone isn’t offboarding — identity cleanup is the other half. Pick a platform where both live in the same console.

‍

Frequently asked questions

What is zero-touch deployment?

Zero-touch deployment is an automated method for provisioning devices without manual IT setup. When a new device is powered on and connected to the internet, it identifies itself to the organization’s MDM platform via an OEM portal (Apple Business Manager, Windows Autopilot, or Android Enterprise), then automatically downloads configurations, apps and security policies.

How does zero-touch deployment work?

The device’s hardware identifier (serial number or hardware hash) is registered with the OEM portal at purchase through an authorized reseller. When the employee powers on the device, it checks in with the OEM portal, which routes it to the organization’s MDM. The MDM applies role-based configuration profiles automatically.

What is the difference between zero-touch deployment and zero-touch enrollment?

Zero-touch enrollment is the enrollment step. The device automatically joins the MDM. Zero-touch deployment is the full workflow, which also includes pushing apps, security policies, and identity configuration so the device is ready to use. Enrollment is one piece of deployment.

What is Apple Automated Device Enrollment (ADE)?

Automated Device Enrollment is Apple’s mechanism for zero-touch deployment of Macs, iPhones, iPads and Apple TVs. Devices bought through Apple Business or an authorized Apple reseller enrolled in the program are automatically linked to the organization’s Apple Business Manager account and routed to the configured MDM on first power-on. ADE replaced the legacy Device Enrollment Program (DEP).

What is Windows Autopilot?

Windows Autopilot is Microsoft’s zero-touch deployment service for Windows devices. It registers devices with Microsoft Entra ID and routes them to Intune or a partner MDM, then applies role-based configuration on first boot. Devices can be sourced through OEMs that pre-register hardware hashes, or hashes can be uploaded manually.

Can you do zero-touch deployment without Intune?

Autopilot itself requires Microsoft Entra ID and an MDM service to route the device to. Intune is Microsoft’s MDM, but Autopilot also supports partner MDM integration, meaning a third-party MDM enrolled in the Autopilot partner programme can play that role for mixed-OS SMB fleets that don’t want a separate Microsoft-only console. Confirm exact Entra and Autopilot licensing requirements with Microsoft.

What is Android Enterprise zero-touch enrollment?

Android zero-touch enrollment is Google’s program for automatic Android device deployment. Devices purchased from a zero-touch reseller are pre-registered to the organization’s account. On first boot, the device downloads the configured device policy controller (DPC) from the MDM and applies all required policies.

Is zero-touch deployment only for large enterprises?

No. Apple Business Manager, Windows Autopilot and Android Enterprise zero-touch are free programs from the OEMs — the cost is the MDM platform and the procurement workflow that pre-registers hardware. The main prerequisite is buying hardware through an authorized reseller that supports zero-touch registration.

‍

See zero-touch deployment running end-to-end on a mixed-OS fleet, with procurement and offboarding in the same console.

Primo now has an MCP server.

A device gets flagged. You need to know who it's assigned to, when it was last active, whether there's an open ticket on it, and what access that employee currently has.

You open Primo. You look up the device. You check the employee profile. You cross-reference the ticket queue. You piece it together.

That's four steps for a question that should take one.

Here's the same thing with Primo's MCP server connected to your AI assistant: you type "what's going on with this device?" and get back the device details, the assigned employee, their onboarding status, and any related tickets. One prompt. Full context. No tab-switching.

That's what we shipped.

MCP: Model Context Protocol

MCP (Model Context Protocol) is an open standard that lets AI assistants like Claude, ChatGPT, or Cursor connect directly to external tools. Instead of answering from training data, your AI queries your actual systems in real time.

With Primo's MCP server, that means your AI assistant can talk directly to your IT fleet. Devices, employees, accessories, tickets: all accessible from the AI tools you already have open.

Why it hits differently with Primo

Most IT tools that support MCP give you access to records. Primo gives you access to a connected data model.

Because Primo ties devices, employee lifecycle, SaaS access, and ticketing into one operational system, a single prompt can cross all of those layers at once. When you ask about a device, it comes back linked to an identity. When you ask about an employee, you get their full IT footprint: what they have, what they can access, what's pending.

That's the difference between querying isolated records and querying a unified IT operations platform.

It also means you can get a compliance-ready view of your entire fleet in one prompt. Preparing for an ISO 27001 audit and need to know which devices aren't enrolled or which employees still have active access after offboarding? That's a question your AI can now answer across your whole fleet, not just device by device.

A few things you can do from a single prompt today:

• Pull a device's full IT history (enrollment date, successive assignments) alongside the employee it's assigned to ;
• List all open tickets filtered by status, priority, or assignee ;
• Check which employees joined this month and whether their devices are provisioned ;
• Spot accessories that are unassigned or overdue for return ;
• Search across your entire fleet without opening a single filter.

And when you're ready to move beyond read-only, write access lets you create tickets, add comments, update status and assignee, and perform device actions like locking or wiping directly from your AI client.

What your AI can do in Primo

One note on device actions: locking and wiping are irreversible. Write mode is there for teams who want speed, but it's worth confirming before you act.

Getting connected

Authentication runs through OAuth. No API key to generate or manage, you sign in with your existing Primo account and you're done.

The server URL is https://api.getprimo.com/mcp. By default it runs in read-only mode. To enable write access, use https://api.getprimo.com/mcp?readOnly=false.

Setup is the same across clients: go to the MCP Servers section in your settings, add the URL, and complete the OAuth flow. Full instructions for Claude, ChatGPT, and Cursor are in the Primo help center.

A good place to start

Read-only prompts are the fastest way to build trust in the workflow before moving into writes. Try these:

"Show me all devices that haven't been active in the last 30 days."

"What open tickets are currently unassigned?"

"List employees who joined this month and check whether their devices have been provisioned."

Once that feels natural, write access opens up the rest.

The MCP server is live now. Get started at https://api.getprimo.com/mcp, or head to the help center if you want step-by-step setup instructions for your AI client.

‍

The benefits of automation are well known to modern businesses. For decades, companies have found ways to turn slow, repetitive processes into efficient, self-executing systems. Which lets teams focus on impact, rather than repeating the same low-value tasks. 

Onboarding and offboarding are both high-value processes made up of low-impact touchpoints. Getting team members up to speed quickly really matters. How you create their email account or reset security permissions doesn’t.

Which is why automating these manual steps makes such a big difference. Automated onboarding and offboarding takes low-value work off your plate, and lets you focus on what is important. It also makes both processes faster, easier, and eliminates basic errors. 

In this article, we look at how automation can improve your onboarding and offboarding processes—particularly for IT operations. Then we meet two companies who successfully automated their own IT onboarding, and saw tangible benefits. 

‍

What are employee onboarding and offboarding processes?

Onboarding and offboarding are the practical, functional, and cultural processes associated with welcoming and farewelling company employees. Onboarding typically includes teaching new hires about the company culture, training in your specific ways of working, and giving them the hardware and software tools they need to execute. 

Offboarding is the change process at the end of an employee’s time with your company. This can include exit interviews, farewell celebrations, and regaining possession of company property like computers, phones, and access cards. 

‍

Key steps in IT onboarding

The IT onboarding process is often slower than you’d like. It involves numerous distinct steps, which can really add up if handled individually and manually. These include:

• Setting up user profiles and permissions
• Ordering new devices
• Configuring applications, software, and security updates on these devices
• Delivering devices to new employees
• Training employees on compliance, cybersecurity, and optimal use
• Monitoring device performance and troubleshooting issues

‍

IT is just one aspect of an employee’s onboarding, and can be taken for granted by hiring managers. Your goal is to make all of the above happen smoothly, quickly, and with no extra work for yourself or the new hire. 

For help, see our short checklist for efficient IT onboarding. 

‍

What IT offboarding involves

While the IT onboarding process may be neglected, offboarding is often overlooked altogether. Retrieving devices from departing employees is essential both for asset management and security. 

Key steps include: 

• Locking devices the moment employees no longer need them
• Wiping personal data or returning devices to factory settings
• Returning physical devices to the office or supplier
• Checking a device’s state for reuse
• Preparing devices to be redeployed

All of this adds up, and is always more complicated with remote or distributed teams. In a traditional office setting, it’s pretty simple to have an employee hand in their devices on their last day. It’s more challenging if that employee is in another city, state, or country. 

‍

Why automate employee onboarding and offboarding? 

In general, the best processes to automate involve a number of manual steps and little added value from having people handle each one.

Key benefits of automating your IT onboarding and offboarding include: 

• Time saved for IT teams and hiring managers, who no longer need to manually work through each of those steps we saw above. 

• Faster onboarding for new employees, who don’t need to wait for people to set up their profiles or order devices.

• Near-instant offboarding, because devices can be locked or wiped immediately with a simple click.

• Fewer errors, including skipped or forgotten steps, faulty devices, or losing track of devices when an employee leaves. 

• More consistent experiences, as every employee follows the same automated process at the beginning and end of employment. 

Overall, automation creates more streamlined and efficient internal processes. And for something as common and recurring as onboarding and offboarding, efficiency gains can really add up.

How modern SMBs automate onboarding and offboarding — and why it works

To illustrate with tangible examples, let’s take a look at two companies that prioritize automation in the onboarding and offboarding process. 

Like many growing companies, both faced real challenges in scaling IT operations. Even as modern tech companies, they had few resources specifically for IT operations. They needed to create efficient, easily-replicable processes to get new employees up and running, and to smoothly offboard team members at the end of their work. 

Best modern SMBs have understood that a great onboarding experience comes from the collaboration between HR and IT teams — and these two companies made that alignment a core part of their approach. As we’ll see, the secret to success lay in choosing the right tools and partners to take the weight off their very busy leaders.

‍

‍

Faume: Near-instant IT operations for a distributed workforce 

Founded in 2020, Faume is a technical logistics solution that lets brands create resale services for their products. Faume works with world-famous logos like Hugo Boss, The Kooples, Aigle, and Bash to bring second lives to items and make consumer commerce more sustainable.

Faume’s 30-person team includes remote staff across France. CTO and Co-founder Jocelyn Kerbouc’h needed a simple way to deploy and manage devices for this distributed workforce ahead of scaling post-Series A.

‍

Before: False starts with IT providers

Faume initially leased computers in the hopes of getting additional support and a streamlined service. But this was far more expensive than the cost of buying—they were asked to pay up to €2,500 for a €1,200 computer. And worse, they still regularly encountered malfunctioning devices and frustrating errors. 

They pivoted to buying from Apple directly, tracking devices manually in a Notion doc. This was certainly more cost effective, but added more administrative effort to the onboarding process. 

As a co-founder wearing multiple hats, Jocelyn couldn’t afford this extra admin. Faume needed a more robust IT operations solution that could deliver devices at the right price, while also tracking their use and ensuring security. 

‍

Today: Centralized IT onboarding & offboarding

The big switch was finding an IT operations provider that lets Jocelyn order, configure, and deliver employee devices in a few clicks. Using Primo, Jocelyn sets password rules and updates, and pre-configures applications so that computers arrive ready to use. 

“Thanks to Primo, onboarding new employees now takes us half the time it used to,” says Jocelyn.

Faume has essentially automated the onboarding process, and offboarding is just as simple. When an employee leaves, Jocelyn can lock and wipe their computer remotely. Departing employees receive a shipping box and can easily return computers from anywhere. 

The result is a more efficient, secure IT environment for Faume. And Jocelyn can put all his energy into building and leading his business.

Read the full Faume story here.

‍

‍

Dalma: Efficient operations with no IT team

Dalma is France’s fastest-growing pet health insurance company. Its tech-enabled platform already insures more than 40,000 European cats and dogs, with no signs of slowing down. 

Founded in 2021, the 70-strong team has grown quickly to deliver this popular and worthwhile service. While that’s good for business (and for our pets), it put pressure on former Head of People Claire Maarek. 

With IT onboarding just a small portion of her role, Claire didn’t have the time or technical expertise to build a comprehensive program from scratch.

‍

Before: Poor leasing experience

Like Faume, Dalma also tried leasing as a (theoretically) efficient way to manage IT operations. But Claire explains that the downsides were obvious right away. “Our leasing experience was disappointing, offering minimal service and reliability with poor customer support.”

It was a maddening mix of high prices and low-quality service. For an HR leader like Claire—not an IT pro by trade—this wasn’t a tenable situation. 

‍

Today: IT onboarding in seconds

Since switching to Primo, the results are night and day. IT onboarding takes mere seconds, and Dalma can secure hardware at competitive prices, configured and delivered for when the person arrives. All of this with no deep IT procurement knowledge or dedicated technical experts. 

Most importantly for HR professionals, Primo integrates with Payfit (alongside other HR platforms). Dalma adds a new employee in Payfit, and most of the process is automated from there. Devices arrive on time, whether new hires are in France or Germany. 

When an employee leaves, Primo makes it easy to retrieve or reassign devices elsewhere, or simply resell them. Which makes both onboarding and offboarding as easy as can be. 

Read the full Dalma story here.

‍

‍

Make IT onboarding and offboarding a breeze

Both IT onboarding and offboarding are relatively simple processes, made difficult by manual steps and a need for technical expertise. Particularly for growing companies without IT teams or paid external consultants, key steps can fall through the cracks. 

That’s how you end up with security risks, sluggish processes, and frustrated team members — right when first impressions matter most.

The best way to streamline IT onboarding and offboarding is with one central solution. And as both Faume and Dalma showed, it’s even better when that solution integrates with your HR systems and company tools. This lets HR leaders and hiring managers—often “accidental IT managers”—keep control and ensure each step is completed efficiently. 

Primo provides exactly that: an all-in-one IT management system for faster onboarding and offboarding. You can easily automate virtually all of your IT operations, without paying huge fees to managed providers. 

‍See how Primo can improve your IT operations today.