# Overview **Zero-touch enrollment** lets organizations preconfigure the enterprise devices they purchase. Preconfigured devices provision themselves out-of-the-box, enabling organizations to streamline their device deployments. Additional advantages of zero-touch enrollment include: - **Customer IT admins** don't need to provision individual devices because a config can be automatically set for purchased devices in bulk. - **Customers** stay in control of their devices at all times---even after factory resets. - **End users**, after receiving a boxed device, just need to sign in. *** ** * ** *** ## Key stakeholders ### Device resellers As part of their sales fulfillment process, approved device resellers assign devices (using a serial number, hardware ID, and other device identifiers) to their customers' zero-touch enrollment accounts. Approved zero-touch resellers can claim devices with additional device protection service. See [Device protection](https://www.android.com/enterprise/enrollment/) for details. ### Enterprise customers Enterprise customers (also called *customers* or *companies*) with Android devices use their zero-touch enrollment accounts to access the zero-touch enrollment portal. Within the portal, customers can: - View the devices assigned to them by their reseller(s). - Create, edit, and delete device configurations. - Apply configurations to devices. - Select a default configuration for any devices added to zero-touch enrollment going forward. - Manage portal access. - Add or remove resellers. After a device is assigned a configuration, the device can provision itself out-of-the-box: 1. The device downloads and installs the customer's chosen device policy controller (DPC) app. 2. The DPC app, using the customer's config data, provisions the device. If you're part of an enterprise interested in purchasing and configuring devices through zero-touch enrollment, see the help center for [enterprise customers](https://support.google.com/work/android/answer/7514005). Enterprise customers with ChromeOS devices do not use the zero-touch enrollment portal. Instead they can configure the management of their devices in the [Google Admin Console](https://admin.google.com). ### Enterprise mobility management (EMM) providers EMMs can add some of the features available in the zero-touch enrollment portal to their consoles to provide their customers with a single point for managing devices. These features include: - Create, edit, and delete device configurations. - Apply configurations to devices. - Select a default configuration for any devices added to zero-touch enrollment going forward. For details on how to support these zero-touch enrollment features as an EMM, see [how the Customer API works](https://developers.google.com/zero-touch/guides/customer/how-it-works). *** ** * ** *** ## Example zero-touch enrollment workflow ![ZTP flow for customer purchasing devices from reseller](https://developers.google.com/static/zero-touch/images/guides/overview/flow.svg) 1. **Customers** purchase devices from **resellers**. 2. **Resellers** create new customer zero-touch enrollment accounts.\* 3. **Resellers** assign devices to **customers**. 4. **Customers** create EMM configs for their enterprise.\* 5. **Customers** map purchased devices to EMM configs.\* 6. **Resellers** ship the devices to **end user** locations. 7. **End users** turn on their new device. \* - not required for ChromeOS devices. *** ** * ** *** ## Option 1: Integrate with zero-touch enrollment and the Knox Deployment Program The [Common Android Reseller Library](https://developers.google.com/zero-touch/guides/reseller-library/how-it-works) supports enrolling Android devices from [these manufacturers](https://developers.google.com/zero-touch/resources/manufacturer-names) as well as Samsung. We recommend using the library if: - Your organization hasn't integrated with Samsung's [KDP](https://www.samsungknox.com/en/knox-deployment-program) or zero-touch enrollment, AND - Your organization sells or plans to sell Samsung devices. ### Non-Samsung devices: Library and zero-touch enrollment portal As a reseller, your organization can use the Common Android Reseller Library or the portal to support zero-touch enrollment for devices from [these manufacturers](https://developers.google.com/zero-touch/resources/manufacturer-names). You might use one or both depending on your organization's needs. The web portal allows you to manage your customers and their zero-touch enrollment devices. With the library, you can integrate zero-touch enrollment into your organization's existing sales or service tools. The following table compares tasks you might perform using the portal and API. | Reseller task | Portal | Library | |---|---|---| | Add, edit, and claim devices | Yes | Yes | | Add customers | Yes | Yes | | Add vendors | No | No | | Integrate with existing tools | No | Yes | | Import and export CSV files | Yes | No | | Manage your organization's users | Yes | No | | Add, edit, and delete device metadata | No | No | Your customers also use the same portal to map their purchased devices to EMM configs. To learn more about how to complete the tasks listed in the table, read [How it works](https://developers.google.com/zero-touch/guides/reseller-library/how-it-works) or the [Reseller portal guide](https://developers.google.com/zero-touch/guides/portal). [Launch portal](https://enterprise.google.com/android/zero-touch/resellers) ### Samsung devices: Library and Knox portals The Common Android Reseller Library provides a single integration for zero-touch enrollment and, for Samsung devices, [KDP](https://www.samsungknox.com/en/knox-deployment-program). Resellers belonging to [KDP](https://www.samsungknox.com/en/knox-deployment-program) can use the library to add Samsung devices and assign them to enterprise customers, using their customers' Knox Customer IDs. Your customers use the [KME](https://www.samsungknox.com/en/solutions/it-solutions/knox-mobile-enrollment) portal to create device configurations and apply them to the Samsung devices assigned to them. To learn more, read [How it works](https://developers.google.com/zero-touch/guides/reseller-library/how-it-works). ## Option 2: Integrate with zero-touch enrollment ### Reseller API and zero-touch enrollment portal This Reseller API and the zero-touch enrollment portal supports enrolling Android devices from [these manufacturers](https://developers.google.com/zero-touch/resources/manufacturer-names) as well as [compatible ChromeOS devices](https://support.google.com/chrome/a/answer/10130175#identify_compatible) and is recommended if: - Your organization has already integrated with the [Samsung Knox Deployment Program](https://www.samsungknox.com/en/knox-deployment-program) (KDP) to support [Knox Mobile Enrollment](https://www.samsungknox.com/en/solutions/it-solutions/knox-mobile-enrollment) (KME), OR - Your organization doesn't sell or plan to sell Samsung devices, OR - Your organization sells or plans to sell both Android and ChromeOS devices. As a reseller, your organization can use the Reseller API or the portal to support zero-touch enrollment for devices from [these manufacturers](https://developers.google.com/zero-touch/resources/manufacturer-names). You might use one or both depending on your organization's needs. The web portal allows you to manage your customers and their zero-touch enrollment devices. With the API, you can integrate zero-touch enrollment into your organization's existing sales or service tools. The following table compares tasks you might perform using the portal and API. | Reseller task | Portal | API | |---|---|---| | Add, edit, and claim devices | Yes | Yes | | Add customers | Yes | Yes | | Add vendors | No | No | | Integrate with existing tools | No | Yes | | Import and export CSV files | Yes | No | | Manage your organization's users | Yes | No | | Add, edit, and delete device metadata | No | Yes | Your customers use the customer portal to map their purchased devices to EMM configs. To learn more about how to complete the tasks listed in the table, read the [Reseller portal guide](https://developers.google.com/zero-touch/guides/portal) or the [How it works](https://developers.google.com/zero-touch/guides/how-it-works) Reseller API guide. [Launch portal](https://enterprise.google.com/android/zero-touch/resellers) *** ** * ** *** ## Reseller onboarding The three stages below list what you can expect to complete as your organization onboards into zero-touch enrollment. ### Stage 1: prepare - Sign the zero-touch enrollment reseller agreement. - Get leadership approval and train your customer support team. - Decide with Google on a launch date. - Plan co-marketing opportunities. ### Stage 2: integrate - Include zero-touch enrollment in your sales and customer support processes. - Integrate point of sale (POS) systems with zero-touch enrollment reseller APIs to automatically claim devices for customers. ### Stage 3: launch - Run a pilot launch with 2 customers. - Offer zero-touch enrollment to all your customers. Visit the [Android Enterprise Partner Portal](https://www.androidenterprise.dev) to get started with zero-touch enrollment. *** ** * ** *** ## Learn more To learn more about fully managed Android devices, see [Fully managed device](https://developers.google.com/android/work/requirements/fully-managed-device). Learn more about [enterprise management for ChromeOS](https://chromeenterprise.google/os/). If you're not a reseller, see the [Android Enterprise Help](https://support.google.com/work/android/answer/7514005) for more information.