Devices provision themselves, out of the box, as work-managed devices. Advantages include:
● Your IT admins don't need to provision individual devices because a config can be automatically set for purchased devices in bulk.
● You stay in control of their devices at all times—even after factory resets.
● End users, after receiving a boxed device, just need to sign in.
Zero-touch enrollment stores each user’s provisioning config for a device. After starting up, a device checks for a provisioning config. If your company has assigned the device a config, the device provisions itself. The device downloads and installs the chosen device policy controller (DPC) app. The DPC app, using the customer's config data, provisions the device.

The work-managed device solution set is designed for corporate-owned devices that are used exclusively for work and no personal use. This allows admins to manage the entire device and enforce an extended range of policy controls unavailable to work profiles, but restricts the device to only corporate use.

No, corporate-owned devices can be provisioned in several different ways, including zero-touch enrollment, EMM token, NFC-bump and the scanning of a QR code.

To use zero-touch enrollment, you’ll need the following:
● Android Oreo (8.0)
● A compatible device purchased from a reseller partner
● An enterprise mobility management (EMM) provider supporting work-managed device mode.

Zero-touch enrollment is a streamlined process for Android devices to be provisioned for enterprise management. On first boot, devices check to see if they have been assigned to an enterprise. If so, the device initiates the work-managed device provisioning method and downloads the correct device policy controller app, which then completes setup of the managed device. To configure a device with zero-touch enrollment, the enterprise is allocated a set of devices. The process begins with the manufacturer, who creates a set of device identifiers and passes that to the reseller, who uploads a mapping of the device identifiers to a customer, who finally configures the correct provisioning parameters for the allocated devices. Enterprise customers purchase devices from a carrier
1. Carrier creates new customer zero-touch enrollment accounts
2. Carrier assigns devices to customers
3. Enterprise customers create EMM configs for their enterprise
4. Enterprise customers map purchased devices to EMM configs
5. Carriers ship the devices to end user locations
6. End users turn on their new device.

Your organization can utilize zero-touch enrollment if it buys its Android devices from a participating zero-touch carrier or reseller. Click here for participating carriers. If you’re already provisioning devices with zero-touch enrollment, give the zero-touch carrier or reseller your account ID.

Not at the present time. We plan to add this ability in the future. Eligible devices must be be purchased directly from a Google partner or enterprise reseller and not through a consumer store. Click here for participating carriers.

The zero-touch enrollment program is available in territories covered by the carrier partners listed here.

No minimum number of devices required.

Devices purchased from a zero-touch carrier will be assigned to your account in the zero-touch portal. From here, IT admins can create Enterprise Mobility Management (EMM) configurations and apply them to the devices.

Most EMM providers (for Android) support zero-touch enrollment. Click here and scroll down the webpage to view the list of eligible vendors. You can also use the zero-touch enrollment portal to check which EMMs are supported. Create a new configuration or edit an existing one. Click EMM DPC to see the EMMs you can use with zero-touch enrollment.

Yes. IT admins can create configurations for each EMM tool and assign these to devices. You can link one or more EMM servers to the zero-touch enrollment program and assign devices to each server.

Start by purchasing zero-touch enrollment devices. Your reseller sets up your portal account when your organization first purchases devices registered for zero-touch enrollment. Your reseller might ask you to provide your corporate email address. You'll need a Google account, associated with your corporate email, to use the portal. See Associate a Google account below. Don't use your personal Gmail account with the portal.

If you don't have a Google account associated with your corporate email, follow the steps below:
1. Go to Create your Google account
2. Enter your name
3. Set Your email address to your corporate email. Don't click I would like a new Gmail address
4. Complete the remaining account information
5. Click Next step
6. Follow the on-screen instructions to finish creating your account.
See the Google Account help center to help you and learn more about your new account.

Your carrier or reseller sets up your portal account when your organization first purchases devices registered for zero-touch enrollment. They will send your Account ID and the link to the zero-touch portal. Open the portal. You will need to sign in with your Google account.

You set provisioning options for your devices using a configuration. Each configuration combines the following:
- The EMM device policy controller (DPC) you want to install on the devices
- EMM policies you want to enforce on the devices
- Metadata that's displayed on the device to help your users.
Your organization can add more configurations as you need them. However, zero-touch enrollment helps you most when you set a default configuration that's applied to any new devices your organization buys.

Before you add a configuration, check that you have access to your EMM console. To add a configuration for your organization's devices, follow the steps below:
1. Open the zero-touch portal. You might need to sign in
2. Click Configurations in the sidebar
3. Click + in the Configurations table.
Use the notes below to help you complete the new configuration panel:
- Name. Give your configuration a name that describes its purpose. Choose a short, descriptive name that's easy to find in a menu.
- EMM DPC. Select your EMM's DPC app. If you don't see your EMM's DPC listed, contact your EMM provider to confirm that they support zero-touch enrollment.
- DPC extras. Set your organization's EMM policy data that's passed to the DPC. Copy the JSON-formatted text from your EMM console.
- Company name. Set this to the name of your organization. Zero-touch enrollment shows the company name to your device users in a support panel during device provisioning. Shorter names that are easily recognized by your organization's employees work best. You can use uppercase or lowercase letters (without accents) and spaces.
- Contact email. Set this to an email address your device users can contact to get help. Zero-touch enrollment shows the email to your device users in a support panel before device provisioning. Because device users can see the email but can't click it to send a message, choose a short email address users can type on another device.
- Contact phone. Set this to a telephone number your device users can call, using another device, to get help. Zero-touch enrollment shows the number to your device users in a support panel before device provisioning. Use the plus sign, hyphens, and parentheses to format the telephone number into a pattern your users recognize.
- Custom message. Optionally add one or two sentences to help your users contact you. Zero-touch enrollment shows your message to device users in a support panel.
Now that you've made one, you can apply a configuration to some or all of your devices.

Yes. An IT admin can create multiple configurations with different policies to enforce. These configurations can then be applied to selected devices.

Choose a default configuration that's applied to any new devices your organization buys. Follow the steps below:
1. Open the portal. You might need to sign in
2. Click Configurations in the sidebar
3. Select the configuration you want applied to new devices in the Default configuration panel
4. Click Apply.

Use the portal to apply configurations to devices or unregister devices from zero-touch enrollment. After you apply a configuration to a device, the device automatically provisions itself on first boot, or next factory reset.

You can apply a configuration one device at a time by selecting devices in the portal. Follow the steps below:
1. Open the portal. You might need to sign in
2. Click Devices
3. Find the device you want to apply the configuration to
4. Set Configuration to the configuration you want to apply or select No config to temporarily remove the device from zero-touch enrollment.

You apply a configuration to devices by uploading a CSV file. A CSV text file represents a data table, and each line represents a row in that table. Commas separate the values in that row. A new line means a new row of data.
Each row in the CSV file lists the ID of the configuration you want to apply and a device identifier of the device you want to apply it to.
Prepare a CSV file containing your device and configuration information. You can download a sample file (by following steps 1–4 below) to help you get started. Alternatively, if you want to start with a blank file, learn about the fields needed by reading Device configuration CSV file format.
Check that the CSV file you upload to the portal is smaller than 50 MB because that's the largest file the portal accepts. If you have more than 50 MB of data, consider splitting the file into smaller files. When you've prepared your CSV file, follow the steps below:
1. Open the portal. You might need to sign in
2. Click Devices
3. Click ⋮ in the Devices table header
4. Click Upload batch config updates
5. Select your CSV file from the file picker
6. Click Upload.
After the file uploads, the portal processes the data rows. When processing finishes, the portal shows a notification with a link to an upload status page. You also receive an email summarizing the processing of your CSV data. Click the See details button in the email to open a status page. The status page lists each device that wasn't assigned a configuration with a reason for the error.
If you close your browser window after the CSV file uploads, the portal continues to process your data. To know when the portal finishes processing your data, check your email inbox for the status email.
When you receive the processing summary email, check for any errors, and if everything went well, let your customer know that they can see the purchased devices in their portal.

To apply a configuration to devices, you upload a file. The snippet below shows the field format with example values:
The following table shows the field values you use in your file:

Field	Example	Description
modemtype	IMEI	Always set this value to IMEI using uppercase characters.
modemid	123456789012347	Set this value to the device’s IMEI number—the GSM network identity for the device. This field is used to match a device.
manufacturer	Google	Set this value to the device manufacturer’s name. You need to make sure this is one of the names listed in Manufacturer names. This field is used to match a device.
profiletype	ZERO_TOUCH	Always set this value to ZERO_TOUCH using uppercase characters.
profileid	54321	Set this value to the numeric ID of the configuration you want to apply to the device. To see the ID for a configuration, check the table's ID column in the Configurations page. Set this value to 0 (zero) to temporarily remove the device from zero-touch enrollment.

You can unregister devices from zero-touch enrollment. You might need to unregister a device when you transfer ownership. You can unregister one device at a time by selecting devices in the portal.
To unregister a device, follow the steps below:
1. Open the portal. You might need to sign in
2. Click Devices
3. Find the device you want to unregister in the Devices table
4. Click Unregister in the device row
5. Click Confirm in the confirmation panel.

To activate a new carrier or reseller, follow the steps below:
1. Open the portal. You might need to sign in
2. Click Resellers in the sidebar
3. Find the reseller you want to work with in Other Resellers
4. Click Enroll in the reseller row
5. Click Confirm.
Because your organization already has a zero-touch enrollment account, you can continue to use the same account by giving your customer ID to your new reseller before you purchase devices.

To stop a reseller assigning devices to your organization, you can deactivate the reseller. Deactivating a reseller doesn't affect the configured devices you purchased from the reseller.
Deactivate a reseller by following the steps below:
1. Open the portal. You might need to sign in
2. Click Resellers in the sidebar
3. Find the reseller you want to deactivate in Active Resellers
4. Click Delete in the reseller's row
5. Click Confirm.
If you mistakenly deactivate a reseller, follow the steps in Activate a reseller to revert the deactivation.

Before you buy devices from a new reseller, give your customer ID to the reseller. To see your customer ID, follow the steps below:
1. Open the portal. You might need to sign in
2. Click Resellers in the sidebar
3. Select My customer ID in the first table row to see your Customer ID.

Your organization manages the users that have access to the portal.
Your organization's portal users can be owners or admins. Owners share the same access as admins but can also add, delete, and edit your organization's portal users. The following table compares the capabilities of the owner and admin roles.

Portal task	Owner	Admin
Add, edit, and delete configurations	✓	✓
Apply configurations	✓	✓
Unregister devices	✓	✓
Activate and deactivate resellers	✓	✓
Manage your organization's users	✓

Follow the steps below to check your account's role:
1. Open the portal. You might need to sign in
2. Click Users in the sidebar
3. Look in the Role column to see your account's role.

Before you start, check your account role to ensure that it is Owner. You need to be an account owner to add team members. Give portal access to new team members by following the steps below:
1. Ask your team member to associate a Google account with their corporate email. Your team member can follow the instructions in Associate a Google Account
2. Open the portal. You might need to sign in
3. Click Users in the sidebar
4. Click +
5. Set Email address to the team member's corporate email
6. Select a Role
7. Click Apply.
The portal doesn't notify your team member that they have access. You need to contact your team member and tell them about their new portal access.

Before you start, check your account role to ensure that it is Owner. You need to be an account owner to delete team members. To remove a team member's access to the portal, follow the steps below:
1. Open the portal. You might need to sign in
2. Click Users in the sidebar
3. Click Edit in the account row you want to delete
4. Check that the account is correct because the portal deletes the account without warning and you can't undo the action
5. Click Delete.
If you accidentally delete an account, re-add it by following the instructions in Add team members above.

First, check if the device supports zero-touch enrollment. Confirm the device model is listed in Which Android devices are supported?
Next, check if the device is registered for zero-touch enrollment using the portal. Find the device using the hardware identifier, such as the IMEI number. If you don’t find the device, contact the device reseller and ask them to register the device.
Finally, confirm that you applied a configuration to the device. Find the device using the portal and check the Configuration column of the table. Devices without a configuration behave do not provision themselves.
If your reseller registers the device or you apply a configuration, remember that you’ll need to factory reset the device for zero-touch enrollment to provision the device.

First, confirm that the device isn’t registered with your organization’s zero-touch enrollment. Find the device in the portal using the hardware identifier, such as the IMEI number. If you find the device, click Unregister.
Next, contact the device provider—the organization that manages the zero-touch configuration for the device. To discover how to contact the provider, follow the steps below:
1. Factory reset the device
2. Click the link to contact your device’s provider in the Your device at work screen
3. Make a note of the telephone number, email address, and the identifiers in Device information.
Contact the provider, and ask them to unregister the device from zero-touch enrollment. Include the identifiers you noted previously. You might want to include a link to this page.

Not at the present time. We plan to add this ability in the future.

Yes, provided that backup and restore is supported by the DPC selected by the IT admin.

Users just open the box, connect to WiFi and start using the device with management, apps and configurations all set up.

Zero-touch is designed to enroll a device into a specific configuration known as work-managed device. KME offers support for certain Samsung devices prior to Android Oreo with a portfolio of Samsung devices that go back to Android Lollipop. KME is also able to set up a device in work managed device mode but can support other configurations based on support by EMMs.
Knox Configure is a cloud-based service that allows IT admins to remotely configure a large number of Samsung devices and tailor device software and hardware features to meet specific business needs. Knox Configure effectively allows off-the-shelf Samsung devices to be turned into purpose-built appliances via advanced device configuration capabilities.

Customers who are already using KME may also use zero-touch without interoperability issues. However, customers should select only one enrollment service per device as only one service can be used.

Customers should reach out to their carrier or reseller first. If you need additional information or support, visit the Android zero-touch webpage.