Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the user can skip it. The portal that assigns configurations has five roles, a default configuration, and devices that must be deregistered when retired.
\nGoogle’s zero-touch enrollment guide explains that on first boot, devices check whether they have been assigned an enterprise configuration and, if so, start fully managed provisioning and download the device policy controller app. Prerequisites include a device running Android Pie (9.0) or later, or listed earlier exceptions, purchased from a reseller partner, a GMS-compatible device with Google Play services enabled, an EMM provider supporting company-owned devices, and a zero-touch account created by an authorized reseller.
\nThe reseller links the account to a Google Account associated with your corporate email; Google says not to use a personal Gmail account and recommends 2-Step Verification on accounts used for administration. Newly registered devices are automatically configured with the Enterprise default profile, and linking zero-touch with the EMM overrides that default configuration.
\nPortal users can be owners, admins, managers, assigners or viewers. Only owners can add, edit or delete users, accept terms or link zero-touch to an EMM; owners and admins can remove devices and view audit logs, and the portal does not notify team members that they have been given access. Devices can be deregistered from zero-touch enrollment in the portal.
\nUse this for company-owned Android devices. Personally owned phones use different enrollment methods, and specific EMM steps vary by provider.
\nDSE recommends buying corporate Android devices through a zero-touch reseller and setting a default configuration so every new device enrolls into management. Give the portal owner role to two named administrators with 2-Step Verification, assign narrower roles to everyone else, and add deregistration to the device disposal checklist so retired or resold phones are no longer bound to your configuration.
\nUnbox a new device during each purchase cycle and confirm it enrolls without manual steps. Review portal users and audit logs quarterly, and reconcile the zero-touch device list with the EMM inventory and disposal records.
\nAndroid Enterprise Help — Zero-touch enrollment for IT admins. Reviewed October 18, 2026.
", "content_text": "Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the user can skip it. The portal that assigns configurations has five roles, a default configuration, and devices that must be deregistered when retired.\nSource facts\nGoogle’s zero-touch enrollment guide explains that on first boot, devices check whether they have been assigned an enterprise configuration and, if so, start fully managed provisioning and download the device policy controller app. Prerequisites include a device running Android Pie (9.0) or later, or listed earlier exceptions, purchased from a reseller partner, a GMS-compatible device with Google Play services enabled, an EMM provider supporting company-owned devices, and a zero-touch account created by an authorized reseller.\nThe reseller links the account to a Google Account associated with your corporate email; Google says not to use a personal Gmail account and recommends 2-Step Verification on accounts used for administration. Newly registered devices are automatically configured with the Enterprise default profile, and linking zero-touch with the EMM overrides that default configuration.\nPortal users can be owners, admins, managers, assigners or viewers. Only owners can add, edit or delete users, accept terms or link zero-touch to an EMM; owners and admins can remove devices and view audit logs, and the portal does not notify team members that they have been given access. Devices can be deregistered from zero-touch enrollment in the portal.\nApplicability\nUse this for company-owned Android devices. Personally owned phones use different enrollment methods, and specific EMM steps vary by provider.\nDSE recommendation\nDSE recommends buying corporate Android devices through a zero-touch reseller and setting a default configuration so every new device enrolls into management. Give the portal owner role to two named administrators with 2-Step Verification, assign narrower roles to everyone else, and add deregistration to the device disposal checklist so retired or resold phones are no longer bound to your configuration.\nVerification\nUnbox a new device during each purchase cycle and confirm it enrolls without manual steps. Review portal users and audit logs quarterly, and reconcile the zero-touch device list with the EMM inventory and disposal records.\nOfficial reference\nAndroid Enterprise Help — Zero-touch enrollment for IT admins. Reviewed October 18, 2026.", "content_markdown": "Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the user can skip it. The portal that assigns configurations has five roles, a default configuration, and devices that must be deregistered when retired.\n\n## Source facts\n\nGoogle’s [zero-touch enrollment guide](https://support.google.com/work/android/answer/7514005?hl=en) explains that on first boot, devices check whether they have been assigned an enterprise configuration and, if so, start fully managed provisioning and download the device policy controller app. Prerequisites include a device running Android Pie (9.0) or later, or listed earlier exceptions, purchased from a reseller partner, a GMS-compatible device with Google Play services enabled, an EMM provider supporting company-owned devices, and a zero-touch account created by an authorized reseller.\n\nThe reseller links the account to a Google Account associated with your corporate email; Google says not to use a personal Gmail account and recommends 2-Step Verification on accounts used for administration. Newly registered devices are automatically configured with the Enterprise default profile, and linking zero-touch with the EMM overrides that default configuration.\n\nPortal users can be owners, admins, managers, assigners or viewers. Only owners can add, edit or delete users, accept terms or link zero-touch to an EMM; owners and admins can remove devices and view audit logs, and the portal does not notify team members that they have been given access. Devices can be deregistered from zero-touch enrollment in the portal.\n\n## Applicability\n\nUse this for company-owned Android devices. Personally owned phones use different enrollment methods, and specific EMM steps vary by provider.\n\n## DSE recommendation\n\nDSE recommends buying corporate Android devices through a zero-touch reseller and setting a default configuration so every new device enrolls into management. Give the portal owner role to two named administrators with 2-Step Verification, assign narrower roles to everyone else, and add deregistration to the device disposal checklist so retired or resold phones are no longer bound to your configuration.\n\n## Verification\n\nUnbox a new device during each purchase cycle and confirm it enrolls without manual steps. Review portal users and audit logs quarterly, and reconcile the zero-touch device list with the EMM inventory and disposal records.\n\n## Official reference\n\n[Android Enterprise Help — Zero-touch enrollment for IT admins](https://support.google.com/work/android/answer/7514005?hl=en). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/", "url": "https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use Android zero-touch enrollment so company phones arrive managed, and lock down the portal that controls it", "item": "https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/#article", "identifier": "https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/", "url": "https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/", "headline": "Use Android zero-touch enrollment so company phones arrive managed, and lock down the portal that controls it", "description": "Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the…", "abstract": "Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the user can skip it. The portal that assigns configurations has five roles, a default configuration, and devices that must be deregistered when retired.", "articleBody": "Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the user can skip it. The portal that assigns configurations has five roles, a default configuration, and devices that must be deregistered when retired.\nSource facts\nGoogle’s zero-touch enrollment guide explains that on first boot, devices check whether they have been assigned an enterprise configuration and, if so, start fully managed provisioning and download the device policy controller app. Prerequisites include a device running Android Pie (9.0) or later, or listed earlier exceptions, purchased from a reseller partner, a GMS-compatible device with Google Play services enabled, an EMM provider supporting company-owned devices, and a zero-touch account created by an authorized reseller.\nThe reseller links the account to a Google Account associated with your corporate email; Google says not to use a personal Gmail account and recommends 2-Step Verification on accounts used for administration. Newly registered devices are automatically configured with the Enterprise default profile, and linking zero-touch with the EMM overrides that default configuration.\nPortal users can be owners, admins, managers, assigners or viewers. Only owners can add, edit or delete users, accept terms or link zero-touch to an EMM; owners and admins can remove devices and view audit logs, and the portal does not notify team members that they have been given access. Devices can be deregistered from zero-touch enrollment in the portal.\nApplicability\nUse this for company-owned Android devices. Personally owned phones use different enrollment methods, and specific EMM steps vary by provider.\nDSE recommendation\nDSE recommends buying corporate Android devices through a zero-touch reseller and setting a default configuration so every new device enrolls into management. Give the portal owner role to two named administrators with 2-Step Verification, assign narrower roles to everyone else, and add deregistration to the device disposal checklist so retired or resold phones are no longer bound to your configuration.\nVerification\nUnbox a new device during each purchase cycle and confirm it enrolls without manual steps. Review portal users and audit logs quarterly, and reconcile the zero-touch device list with the EMM inventory and disposal records.\nOfficial reference\nAndroid Enterprise Help — Zero-touch enrollment for IT admins. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:52+00:00", "dateModified": "2026-10-18T22:22:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use Android zero-touch enrollment so company phones arrive managed, and lock down the portal that controls it" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 366, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Android Enterprise Help — Zero-touch enrollment for IT admins", "url": "https://support.google.com/work/android/answer/7514005?hl=en" } } ] } }