Use Android zero-touch enrollment so company phones arrive managed, and lock down the portal that controls it

Android zero-touch enrollment makes a corporate phone check for its enterprise configuration on first boot and install the management app before the user can skip it. The portal that assigns configurations has five roles, a default configuration, and devices that must be deregistered when retired.

Source facts

Google’s zero-touch enrollment guide explains that on first boot, devices check whether they have been assigned an enterprise configuration and, if so, start fully managed provisioning and download the device policy controller app. Prerequisites include a device running Android Pie (9.0) or later, or listed earlier exceptions, purchased from a reseller partner, a GMS-compatible device with Google Play services enabled, an EMM provider supporting company-owned devices, and a zero-touch account created by an authorized reseller.

The reseller links the account to a Google Account associated with your corporate email; Google says not to use a personal Gmail account and recommends 2-Step Verification on accounts used for administration. Newly registered devices are automatically configured with the Enterprise default profile, and linking zero-touch with the EMM overrides that default configuration.

Portal users can be owners, admins, managers, assigners or viewers. Only owners can add, edit or delete users, accept terms or link zero-touch to an EMM; owners and admins can remove devices and view audit logs, and the portal does not notify team members that they have been given access. Devices can be deregistered from zero-touch enrollment in the portal.

Applicability

Use this for company-owned Android devices. Personally owned phones use different enrollment methods, and specific EMM steps vary by provider.

DSE recommendation

DSE recommends buying corporate Android devices through a zero-touch reseller and setting a default configuration so every new device enrolls into management. Give the portal owner role to two named administrators with 2-Step Verification, assign narrower roles to everyone else, and add deregistration to the device disposal checklist so retired or resold phones are no longer bound to your configuration.

Verification

Unbox a new device during each purchase cycle and confirm it enrolls without manual steps. Review portal users and audit logs quarterly, and reconcile the zero-touch device list with the EMM inventory and disposal records.

Official reference

Android Enterprise Help — Zero-touch enrollment for IT admins. Reviewed October 18, 2026.