UEMTools.com
Guides / Out-of-box enrolment

Out-of-box enrolment options by OS and country

Out-of-box (zero-touch) enrolment registers company-owned devices with the OS vendor so they enrol into your UEM automatically at first power-on, and management survives a factory reset. These services are provided by the OS vendors and work alongside your UEM platform; they are not UEM platforms themselves.

Check availability in your countries

Select one or more countries. With no country selected, the global overview is shown.

Available offered in the country   Partner available globally via authorised resellers; confirm a local partner   Not available not offered in the country

The enrolment methods

Apple Automated Device Enrolment (Apple Business / Apple School Manager)

What it is. Devices bought through an eligible channel appear in your Apple Business (formerly Apple Business Manager) or Apple School Manager account, are assigned to your MDM server, and enrol and become supervised during Setup Assistant.

Availability. Only in the countries Apple lists, and only through the channels listed for each country (Apple Stores, DEP Resellers and/or Carriers). In all other countries, for example Pakistan, it is not available.

Requirements.

  • Devices bought from Apple or a participating Apple reseller or carrier, linked to your organisation through your Organization ID.
  • An Apple Business or Apple School Manager account linked to your MDM.
  • Supported devices: iPhone with iOS 13 or later; iPad with iPadOS 13.1 or later; Mac with macOS 10.14.4 or later; Apple TV with tvOS 13 or later; Apple Vision Pro with visionOS 2.0 or later; Apple Watch with watchOS 10 or later (through a paired, supervised iPhone).

Manual fallback. Apple Configurator can add devices to Apple Business manually, or devices can be enrolled through the MDM's own enrolment profile. Apple Configurator is a fallback and does not count as Automated Device Enrolment coverage.

Official documentation: Use Automated Device Enrolment · Apple programme availability

Android zero-touch enrolment

What it is. A Google service for company-owned Android devices. The reseller registers devices to your zero-touch account and you assign them a UEM configuration, so they provision as fully managed at first boot.

Availability. Offered globally through authorised zero-touch resellers. Coverage depends on a reseller in your country; confirm a local partner in Google's directory.

Requirements.

  • Supported Android devices bought from an authorised zero-touch reseller, which creates or links your zero-touch account.
  • A UEM that supports Android Enterprise fully managed devices.

Manual fallback. QR code, NFC, UEM token (afw#) or Google account enrolment.

Official documentation: Zero-touch enrolment for IT admins · Android Enterprise partner directory

Samsung Knox Mobile Enrolment (KME)

What it is. Samsung's service for enrolling Samsung Galaxy devices into your UEM automatically at first boot.

Availability. Offered globally through Samsung Knox Deployment Program resellers; confirm a local partner. Check Samsung's supported locations list for your country.

Requirements.

  • Supported Samsung Galaxy devices bought through a Knox Deployment Program reseller (or added with the Knox Deployment App).
  • A Samsung Knox account and a UEM profile configured in KME.

Manual fallback. Knox Deployment App, QR code, NFC or afw# enrolment, or Android zero-touch.

Official documentation: Knox Mobile Enrollment FAQ · KME supported locations

Windows Autopilot

What it is. Microsoft's service that sets up and pre-configures new Windows devices for your organisation, joining them to Microsoft Entra ID and enrolling them into your MDM during the out-of-box experience.

Availability. Available worldwide for tenants on global Azure. Not available in sovereign clouds such as Azure operated by 21Vianet (China), where Windows Autopilot device preparation is the Microsoft option, or Azure Government.

Requirements.

  • Windows 10 or 11 devices with their hardware hash registered by the OEM, a Cloud Solution Provider partner or your IT team.
  • Microsoft Entra ID with Microsoft Intune or another supported MDM.

Manual fallback. Provisioning packages or manual Microsoft Entra join during setup.

Official documentation: Windows Autopilot FAQ · Intune operated by 21Vianet

ChromeOS zero-touch enrolment

What it is. Google's service that enrols ChromeOS devices into your Google Admin console automatically when they first connect to the internet.

Availability. Offered globally through approved pre-provisioning partners; confirm a local partner.

Requirements.

  • Chrome Enterprise or Education upgrade licences.
  • Devices bought from an approved pre-provisioning partner, using a pre-provisioning token and your customer ID.

Manual fallback. Manual enterprise enrolment during device setup.

Official documentation: ChromeOS zero-touch enrolment

Availability depends on the country, purchase channel and device model. Confirm with your supplier before purchase. Information reviewed November 2026.