Zero touch provisioning means a new starter opens a sealed laptop and it configures itself. It works well, and it depends on three preconditions that most teams discover only after buying the software, because the hardest one is about where you bought the machine.
TL;DR
- Three preconditions: an enrolment-capable platform, an identity source, and devices bought through a channel that can register them to you.
- The third one catches everybody. A laptop bought on a consumer site cannot be enrolled automatically, whatever software you own.
- That makes procurement part of your provisioning design rather than a separate decision.
- Two platforms in this comparison publish per-device pricing and the rest quote.
- One well-known vendor in this space changed its name in late 2025, so older comparison articles name a brand that no longer exists.
- Budget for the fallback path too, because some proportion of devices will always need manual setup.
The three preconditions for zero touch provisioning
A platform that can enrol and configure. This is the part people shop for and the easiest to satisfy. Several mature products do it well.
An identity source the device can authenticate against. Your directory, with the new starter’s account existing before the laptop arrives. Sounds obvious, routinely is not, because accounts are often created on day one.
Devices registered to your organisation at the point of purchase. This is the one that breaks deployments. Automatic enrolment depends on the manufacturer or an enrolled reseller recording that a specific serial belongs to you. A laptop bought from a general retailer, or by an employee on expenses, carries no such record and cannot enrol itself.
So the real design question is not which platform to buy. It is whether your purchasing route can register hardware to you, and that is a procurement decision wearing a technical costume.
Why the procurement route decides this
What to do: list the last twenty devices you issued and mark where each came from. Manufacturer direct, enrolled reseller, a general retailer, or an employee buying their own and claiming it back.
| Purchase route | Can it auto-enrol? | What you get |
|---|---|---|
| Manufacturer direct | Yes | Serials registered to you at order time |
| Enrolled reseller or platform | Yes | Same, handled on your behalf |
| General retailer | No | Manual enrolment, device by device |
| Employee expenses | No | Manual, plus an ownership question |
| Inherited from an acquisition | Usually not | Manual, and often an unknown prior owner |
If more than a quarter of your last twenty came from the bottom three rows, buying an enrolment platform will deliver a partial result and the gap will be blamed on the software. Fix the purchasing route first or accept a permanent manual tail.
What the platforms publish
Read from each vendor’s own page on 16 October 2026, with script and style blocks stripped first.
| Platform | Published pricing | Note |
|---|---|---|
| Jamf | Jamf for Mac $12.50 per macOS device per month, Jamf for Mobile $5.75 per mobile device per month, Jamf Now from $4 per device per month | The $12.50 is a bundle, not the standalone product |
| Hexnode | $2.20, $3.20 and $4.70 per device per month across its tiers | Publishes the full ladder openly |
| Iru, formerly Kandji | No figure published; request a quote | Renamed in late 2025, see below |
| Mosyle | No readable figure published | Pricing renders in JavaScript |
| Microsoft Intune | Bundled into Microsoft licensing rather than priced standalone | Often already owned |
Two cautions on that table. The Jamf figure covers a bundle of several products rather than its standalone management tool, so attaching it to the wrong product name overstates what you get for the money. And the Mosyle page carries one large currency figure that is a funding announcement rather than a price, which a quick scan will pick up as a cost.
A brand change that makes older articles wrong
One widely recommended platform in this space changed its name in late 2025. Its old domain now redirects, and its own homepage titles itself with both names so that customers can find it.
The practical consequence is that a good deal of the comparison content you will find was written before that change and names a brand that no longer exists as such. If an article lists it under the former name with no mention of the rename, it predates the change, and anything else in it deserves the same suspicion.
We mention it because this category has unusually stale content. Checking the vendor’s own site before trusting any roundup, including this one, takes thirty seconds and is the only reliable method.
Budgeting for the devices that will not enrol
Every deployment keeps a manual tail and planning for it is the difference between a success and a disappointment.
Checklist for the fallback path:
- Who manually enrols a device that arrives unregistered, and how long it takes
- What a new starter is told when their laptop needs hands-on setup
- How inherited devices from acquisitions get brought in
- Whether a wiped and reissued machine re-enrols cleanly
- What happens when somebody buys their own laptop and claims it back
That last item is worth a policy rather than a case-by-case decision, because it recurs and because the answer affects both enrolment and ownership.
Where the device comes from, and who handles it
Since the binding constraint is procurement rather than software, it is worth knowing that some platforms handle purchasing and registration on your behalf rather than leaving you to arrange it.
RemoAsset is one of those. Disclosure that should shape how you read this: RemoAsset is owned by the same people who publish this site. It buys, registers, ships and later retrieves devices, which means serials are associated with your organisation as part of ordering rather than as a separate step somebody has to remember.
Where it struggles, stated plainly: pricing is quote-based and requires a demo, so it cannot be benchmarked against the published per-device figures above without a call; and it is a newer platform with a smaller footprint than the legacy global resellers, which matters in unusual markets. More importantly for this topic, it is not an enrolment platform and does not replace one. It solves the procurement precondition, not the configuration one, so you still need one of the platforms in the table.
Check the published figures against the source before committing: Jamf and Hexnode both publish openly.
Final thoughts
Zero touch provisioning is a solved problem technically and an unsolved one procedurally. The platforms work. What fails is devices arriving by routes that cannot register them, and accounts that do not exist until the morning somebody starts.
Do the twenty-device audit before you shortlist anything. If the purchasing route is sound, pick on per-device cost and platform fit. If it is not, the software will be the least of your problems.
What does zero touch provisioning actually require?
Three things: a platform that can enrol and configure devices, an identity source holding the new starter’s account before the laptop arrives, and devices registered to your organisation at the point of purchase. The third is the one that breaks deployments, because automatic enrolment depends on a manufacturer or enrolled reseller recording that a specific serial belongs to you.
Why will a laptop bought from a retailer not enrol?
Because nothing in the purchase recorded that the serial belongs to your organisation, and automatic enrolment works by looking that association up. No software can create it after the fact, so the device has to be enrolled by hand. The same applies to machines bought by employees on expenses and, usually, to devices inherited through an acquisition.
Which platforms publish per-device pricing?
Two of the five in the comparison above, with their figures and tier names attached in that table. The rest require a quote or are bundled into wider licensing. One caution on reading those published figures: the higher of the two covers a bundle of several products rather than the standalone management tool, so attaching it to the wrong product name overstates what the money buys.
Has any vendor in this space changed its name?
Yes, one widely recommended platform was renamed in late 2025, its old domain now redirects, and its own homepage carries both names so customers can still find it. Much of the comparison content online predates that change and lists the former brand as though it were current. If a roundup does that without mentioning the rename, treat everything else in it with the same suspicion.
How many devices will still need manual setup?
There is always a tail, and its size depends entirely on your purchasing routes rather than your software. List the last twenty devices you issued and mark where each came from; anything from a general retailer, an employee expense claim or an acquisition will need hands-on enrolment. If more than a quarter fall into those categories, plan the manual path properly rather than treating it as an exception.
Do we need a separate vendor for procurement?
Not necessarily, but somebody has to own the registration step, whether that is your own team buying direct from manufacturers or a platform doing it on your behalf. The point is that it is a distinct precondition from configuration, and an enrolment platform will not supply it. Teams that treat purchasing and provisioning as one design decision get a far higher automatic success rate.
