Device Enrollment Readiness: What Has to Be True Before Day One

It works or it doesn’t. Which of those you get was decided weeks before the laptop shipped, long before anybody thought to unpack it. The purchasing route, the organisation account and the domain verification are the whole of it. None of them can be fixed on the morning somebody starts.

What readiness actually means

Readiness is narrow. A device is ready to enroll automatically when it arrives already associated with your organisation, so that switching it on puts it under management without anybody typing anything.

Three things have to be true for that. You need an organisation account with the platform vendor, a verified domain proving you control the email addresses you claim, and a purchasing route that reports the serial numbers into that account. Miss any one and the machine arrives as a blank consumer device.

None of the three is difficult. All three take days rather than hours, because domain verification needs a DNS change and an account application needs somebody to approve it, and that’s the reason this has to be done before you need it rather than when you do.

The purchasing route is the one that bites

Here’s the trap. Devices generally have to be bought through the manufacturer directly or through an enrolled reseller to appear in automated enrollment, and a machine bought anywhere else simply won’t show up no matter how correct the rest of your setup is.

The exception is always reasonable. That’s why it catches people. Somebody starts in four days, the usual supplier quotes three weeks, so a machine gets bought from a retailer to bridge the gap and set up by hand with every intention of fixing it later. That machine is now outside the automated path permanently, because association happens at purchase and can’t be applied retrospectively by you.

What to do:

• Confirm in writing that your supplier reports serials into your organisation account.
• Ask what happens to an urgent order, before you have an urgent order.
• Hold a small local spare pool so the retailer shortcut is never the fastest option.
• If a machine has to be bought outside the route, record it on a named list the same day.

Decide the identity question before it decides itself

Whether your directory handles sign-in on the device, or the platform does, is a decision with a long tail. Both work. Changing your mind afterwards means touching every enrolled machine, which is why this is worth twenty minutes of thought now rather than a project later.

Ask one question. What do you want to happen when somebody leaves? If disabling the directory account should lock the device, you need the device tied to that directory, and that has to be configured before machines are enrolled rather than after. Teams that skip the question get whatever the default was and discover it during an offboarding that didn’t go as expected.

What changed with Apple Business

Worth knowing if your reference material is older than this year. Apple retired Apple Business Manager, Apple Business Essentials and Apple Business Connect on 14 April 2026, replacing all three with a single free platform called Apple Business, available in more than 200 countries.

The substance barely moved. You still need the organisation setup, the domain verification, the identity decision and devices bought through Apple or an enrolled reseller to appear in automated enrollment, so advice written for the old product is still correct in every operational respect. Only the name is wrong.

One thing did change and it matters. Apple Business carries built-in management at no cost, so the point at which a small Apple fleet has to pay for a management platform has moved later than it used to be, and a team of 23 people may not need to buy one at all.

A team that tested it on one machine

A 68-person company was about to order 31 laptops for a new office. Their setup looked complete on paper and the supplier had confirmed everything by email.

They ordered one first. It arrived and didn’t appear in the organisation account, because the reseller had been reporting serials into an account created by a contractor two years earlier that nobody still had access to. Sorting that out took nine days, and finding it on one machine rather than 31 is the entire value of the test.

The lesson is narrow and cheap. Supplier confirmation isn’t evidence; a device landing in your account is evidence, and the difference between those two costs one machine to establish.

Where a lifecycle platform helps, and where it does not

Readiness is a configuration problem. Getting the right machine to the right person in the right country, with the serial recorded against them, is a logistics problem, and they’re frequently confused for each other.

RemoAsset is our own product. Its relevance here is procurement and the record: it buys and ships across 80+ countries and tracks each device through issue and return, which is what keeps the register correct when machines are landing in several markets at once. Pricing is published, from $1,499 a year on the Subscription tier for companies with 50 to 5,000+ employees, including a 60 per cent reduction on retrieval charges.

Be clear about the limits. It has no network discovery, so it can’t tell you which machines never enrolled, which is the specific failure this article is about. It has no software licence management. And only the Subscription tier publishes a figure, with pay-as-you-go quoted instead. It isn’t a management platform and enrolls nothing itself.

Workwize, Firstbase, GroWrk, allwhere and Deel IT operate on broadly similar lines, and not one of the five publishes a rate card. The live Workwize domain is goworkwize.com.

Checklist before you order volume

Checklist:

• Organisation account exists and somebody currently employed has access to it.
• Domain verified, with the DNS record documented so it survives a provider change.
• Supplier confirmed as reporting serials into that account, proved on one device.
• Identity decision made and configured before enrollment, not after.
• A named list of every device enrolled by hand, maintained from the first exception.
• An agreed answer for urgent orders that is not a trip to a retailer.

Final Thoughts

Three preconditions, one test. Get the account, the domain and the purchasing route in place, then order a single machine and watch it appear before committing to the rest.

The failures here aren’t technical. They’re administrative decisions made weeks earlier by somebody who had no idea they were making them, and the only defence is checking rather than assuming.

Frequently asked questions