# Use Android zero-touch enrollment so company phones arrive managed, and lock down the portal that controls it > Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the user can skip it. The portal that assigns configurations has five roles, a default configuration, and devices that must be deregistered when retired. - Canonical URL: https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:00:52+00:00 - Modified: 2026-10-18T22:22:07+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Guide - DSE priority: Information - Topics: Cybersecurity, IT - Reading time: 2 minutes ## What you need to know Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the user can skip it. The portal that assigns configurations has five roles, a default configuration, and devices that must be deregistered when retired. ## Potentially affected Organizations issuing company-owned Android phones or tablets to technicians, guards or office staff, and the IT teams and mobility providers who manage them. ## DSE recommendation DSE recommends buying corporate Android devices through a zero-touch reseller and setting a default configuration so every new device enrolls into management. ## Article Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the user can skip it. The portal that assigns configurations has five roles, a default configuration, and devices that must be deregistered when retired. ## Source facts Google’s [zero-touch enrollment guide](https://support.google.com/work/android/answer/7514005?hl=en) explains that on first boot, devices check whether they have been assigned an enterprise configuration and, if so, start fully managed provisioning and download the device policy controller app. Prerequisites include a device running Android Pie (9.0) or later, or listed earlier exceptions, purchased from a reseller partner, a GMS-compatible device with Google Play services enabled, an EMM provider supporting company-owned devices, and a zero-touch account created by an authorized reseller. The reseller links the account to a Google Account associated with your corporate email; Google says not to use a personal Gmail account and recommends 2-Step Verification on accounts used for administration. Newly registered devices are automatically configured with the Enterprise default profile, and linking zero-touch with the EMM overrides that default configuration. Portal users can be owners, admins, managers, assigners or viewers. Only owners can add, edit or delete users, accept terms or link zero-touch to an EMM; owners and admins can remove devices and view audit logs, and the portal does not notify team members that they have been given access. Devices can be deregistered from zero-touch enrollment in the portal. ## Applicability Use this for company-owned Android devices. Personally owned phones use different enrollment methods, and specific EMM steps vary by provider. ## DSE recommendation DSE recommends buying corporate Android devices through a zero-touch reseller and setting a default configuration so every new device enrolls into management. Give the portal owner role to two named administrators with 2-Step Verification, assign narrower roles to everyone else, and add deregistration to the device disposal checklist so retired or resold phones are no longer bound to your configuration. ## Verification Unbox a new device during each purchase cycle and confirm it enrolls without manual steps. Review portal users and audit logs quarterly, and reconcile the zero-touch device list with the EMM inventory and disposal records. ## Official reference [Android Enterprise Help — Zero-touch enrollment for IT admins](https://support.google.com/work/android/answer/7514005?hl=en). Reviewed October 18, 2026. ## Primary reference - Name: Android Enterprise Help — Zero-touch enrollment for IT admins - Authority: support.google.com - URL: https://support.google.com/work/android/answer/7514005?hl=en - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Use Android zero-touch enrollment so company phones arrive managed, and lock down the portal that controls it,” DSE Security, https://update.dsesecurity.com/updates/android-zero-touch-enrollment-reseller-portal-roles-default-configuration/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.