WIRE 10.09.2026Commission opens formal AI Act proceedings against two model providersECB digital euro pilot names first Belgian banksAgeas, AXA, Allianz sign joint letter on cloud exit clausesBelgium's NIS2 transposition enters force 18 October
All wire
Hosaka Seven

Tech, policy and power. For the people who have to sign off on it.

Review

Zero-touch enrolment is a purchase-order decision. On two of the three platforms you cannot reverse it on your own.

Apple, Google and Microsoft all expect the party that sold you the hardware to write a record about it before your console can see the thing. Microsoft's documentation says an administrator cannot remove an OEM's authorisation at all, and gives an email address instead.

By Bram Coppens, , 7 min read
Written from 17 primary documents. See the list.

A goods-in counter in a loading bay, shot square on. Three identical sealed cartons stand on the counter with printed delivery notes taped to their lids; two of the notes carry a small second sticker and the third has an empty printed rectangle where that sticker belongs. A locked key cabinet is mounted on the wall behind the counter, and its key hangs on a hook on the delivery side, out of reach of anyone standing at the desk.

Draft, not yet edited. Written by Bram Coppens, and not yet through the desk: nothing here has been checked against the sources listed at the foot of the page. Do not act on it.

Four hundred laptops, and the winning quote came in eleven euros a unit under the incumbent. The part that cost a fortnight is that the pallets arrived, somebody opened a box to start the pilot, and the serial number was not in the console. It was never going to be. Nothing was wrong with the device. The problem was on the purchase order.

Zero-touch enrolment — Apple's Automated Device Enrollment, Android's zero-touch, Windows Autopilot — is not a property of the hardware. It is a record somebody else writes about your hardware, in a database you do not administer, and all three vendors expect the party that sold you the box to write it. That makes it a procurement term. It belongs in the specification next to the warranty and the support horizon, and in the tenders I have read it is in none of them.

Apple and Microsoft each document a real buyer-side route in; Google documents none. And on two of the three the undoing is worse than the doing, which is the part that costs somebody a quarter.

The seller writes the record and you countersign it

Apple's mechanism is the tidiest. You give a participating Apple Authorized Reseller or an authorised carrier your Organization ID and add their Reseller Number to your account; Apple's own wording is that doing so authorises that reseller to submit devices you purchased through them to Apple. Devices bought through any other channel do not appear. Apple publishes per-country lists for Europe, the Middle East and Africa — Belgium among them, page dated 15 July 2026 when I read it — headed Preferred Device Enrollment Resellers. It does not say the list is complete, so ask your supplier rather than inferring from an absence on it.

Apple's general article on Automated Device Enrollment, refreshed on 17 September 2026, says nothing about resellers at all. The channel rule lives on a separate supplier page, and the buyer reads the wrong one.

Google puts the seller further in. The reseller creates your zero-touch account when your organisation first buys devices registered for it, then claims each device to your customer record through Google's provisioning API. The developer documentation describes claiming entirely from the reseller side.

Microsoft splits registration into two acts: capture a hardware hash, associate it to a tenant. Microsoft says the hashes are not normally provided directly to customers or partners and that the OEM should register on the customer's behalf, which is another way of saying the identifier that makes the scheme work is not yours. Manual registration is documented — harvest the hash from a running Windows installation and upload it — and it means unboxing, starting and wiping every unit, which is the labour zero-touch was sold to remove. Fine for forty devices. For four hundred it is a fortnight.

The consent that cannot be withdrawn from your side

Before an OEM can register devices for you, your Microsoft Entra Global Administrator must approve it — the account your security team spent last year locking down, spent to let a hardware vendor write rows in a database that is not yours. Microsoft flags on the same pages that Global Administrator is a highly privileged role that should only be used when another role cannot be.

Then this, in Microsoft's own note on the consent article: once the process is completed it is not currently possible for an administrator to remove an OEM, and to remove one or revoke its permissions you send a request to an msoemops@microsoft.com address. There is no revocation in the tenant. There is an inbox. Whatever else that is, it is a supplier-exit clause, and it is not in your contract with the supplier.

The reseller route behaves better. A Cloud Solution Provider requests a relationship, your Global Administrator approves it, and Microsoft states plainly that Autopilot does not require delegated administrator permissions — the approver can untick that box, though Microsoft notes some partners ask anyway. In four years I have not seen anyone untick it on the day.

Apple's escape hatch, and the thirty days inside it

Apple documents a way out, and it is the most useful sentence on any page in this piece: you can manually add iPhone, iPad, Mac, Ethernet Apple TV and Vision Pro to Apple Business with Apple Configurator even where the device was not bought from Apple, an Apple Authorized Reseller or an authorised carrier.

It carries a condition. When you hand such a device to a user, they have a 30-day provisional period in which they can release it from Apple Business, from supervision and from the management service, running from successful assignment and enrolment. Apple does not say whether the same period attaches to devices a supplier submitted. I could not establish it either way, and I am not going to guess in front of an auditor. Test both routes on two devices before you conclude the channel does not matter.

Google's runs the other way. On the user side it is stronger — a user cannot factory reset a device out of management and must ask an administrator to unregister it. On the administrator side it is weaker. You can deregister devices yourself, singly or by CSV, and then: after you deregister a device you need to contact your reseller if you want to register it again. Your fleet's enrolment lives inside a relationship with whoever sold you the phones three years ago. Rebid, and the new supplier claims the new devices. Nobody publishes what happens to the old ones.

Google's public partner directory returned no results at all when I loaded it on 25 September — a loading fault rather than an empty programme, but I could not confirm one Belgian name from it.

Microsoft has quietly built the exit it needed

Autopilot device preparation is being discussed as a deployment improvement when it is really a channel change. Its requirements page — article dated 11 June 2025, refreshed 22 June 2026 — lists software, networking, licensing, configuration and RBAC. No hardware hash. No OEM registration. No reseller relationship. No third-party consent from a Global Administrator. There are, it says, no additional hardware requirements beyond those needed to run Windows. The device binds at first sign-in.

Price the trade: Entra join only, so hybrid estates are out, and Windows 11, version 22H2 or later with KB5035942. And where a device is already registered as an Autopilot device but not associated with your tenant, the old profile wins and you deregister first — the same dependency by a different door.

What none of them publishes

No service level for the registration. No turnaround commitment between the moment a supplier ships and the moment the record exists. No price: Apple's device management has been free since Apple Business launched on 14 April 2026, Microsoft's rides on a subscription you already hold, and Google's reaches you inside a reseller's invoice as logistics, or as nothing. And from none of the three, a word about what becomes of your device records when a reseller leaves the programme or is acquired.

Approved as a purchasing rule rather than a technical one, with three lines for the specification. The supplier must be a registered enrolment partner for the named platform. The supplier must register devices to our tenant before shipment and evidence it within five working days of delivery. And on termination the supplier must release or transfer every device record within a stated period, in writing. Any competent supplier signs the first two.

The third is where the negotiation is, because none of the three vendors has documented what transferring a record would mean. Most readers will find that out at their next rebid, which for a four-year refresh cycle is the year after next.

Written from

Primary The document itself. Claims in this piece rest only on these.

  1. Manage device suppliers in Apple BusinessApple2026-04-14Read on 25 September 2026; the page carried a publication date of 14 April 2026. Source for: the definition of the Organization ID as the organisation's unique identifier in Apple Business; the statement that giving a participating Apple Authorized Reseller or authorised cellular carrier that ID authorises the reseller to submit devices purchased through them to Apple; the definition of Reseller Numbers as identifiers for resellers and carriers whose purchases appear automatically; and Apple Customer Numbers for direct purchases. The page does not address devices bought from any other channel, and it states no service level, no timescale for a reseller to submit a device, and nothing about what happens to existing device records if a supplier relationship ends. The body says so rather than inferring an answer.
  2. Enrollment methods for built-in device management (Apple Business)Apple2026-04-14Read on 25 September 2026. Source for the three enrolment methods and their OS floors, and for the sentence directing administrators to Apple Configurator when a device does not appear in Apple Business. Notably, this page does not state the purchase-channel requirement for Automated Device Enrollment at all; that requirement is on the supplier page cited above. The body treats the split between the two pages as an observation, not as a contradiction.
  3. Add devices using Apple Configurator to Apple BusinessApple2026-04-14Read twice on 25 September 2026, the second time specifically to check the scope of the provisional period. Source for: the statement that devices may be added manually using Apple Configurator even where they were not purchased directly from Apple, an Apple Authorized Reseller or an authorised cellular carrier; the device types eligible; and the 30-day provisional period during which the user may release the device from Apple Business, supervision and the device management service, running from successful assignment and enrolment. The page does not state whether that provisional period also applies to devices submitted by a supplier. This desk could not establish it either way and the body says so.
  4. Preferred Device Enrollment Resellers for Europe, the Middle East, and AfricaApple2026-07-15Read on 25 September 2026; page dated 15 July 2026. Source for the existence of per-country lists of resellers supporting device enrolment for Apple Business and Apple School Manager, and for Belgium being among the countries covered. The introductory wording offers a list of resellers 'available in your country or region that support Device Enrollment'; it does not say the list is exhaustive, and the body does not claim it is. No individual reseller is named in the body because this desk did not verify any single entry against that reseller's own current material.
  5. Automated Device Enrollment and device managementApple2026-09-17Read on 25 September 2026; page dated 17 September 2026. Read specifically to check whether Apple's general Automated Device Enrollment article states the purchase-channel requirement. It does not: it covers enrolment options, configuration and management once a device is already in Apple School Manager or Apple Business, and says nothing about resellers, Reseller Numbers or Organization IDs. That absence is cited in the body as an absence and nothing else rests on this page.
  6. Introducing Apple Business, a new all-in-one platform for businesses of all sizesApple2026-03-24Apple's own announcement, read on 25 September 2026. Source for: the consolidation of Apple Business Manager, Apple Business Essentials and Apple Business Connect into Apple Business; availability from 14 April 2026 in more than 200 countries and regions; the inclusion of built-in mobile device management at no separate charge; and Apple's own sentence that zero-touch deployment is available when devices are purchased through Apple or Apple Authorized Resellers. It is the company's announcement of its own product, and its framing is its own. Nothing about pricing beyond the free device management is claimed here, because Apple does not print a figure for it on this page.
  7. Zero-touch enrollment for IT adminsGoogle, Android Enterprise HelpRead on 25 September 2026; the page carries no publication date this desk could see. Source for: the three stated requirements, including a zero-touch account created by an authorised zero-touch reseller partner and devices purchased from a reseller partner; the statement that the reseller sets up the account when the organisation first purchases devices registered for zero-touch; the procedure for deregistering devices singly and in bulk; and the sentence that after deregistering a device you need to contact your reseller to register it again. It states no price, no service level and nothing about changing reseller.
  8. Zero-touch enrollment for usersGoogle, Android Enterprise HelpRead on 25 September 2026. Source for the statement that a user cannot factory reset a device to remove it from the organisation's management and must ask an administrator to unregister it from zero-touch enrolment, and for the requirement to factory reset after an administrator unregisters a device. Cited in the body for the contrast with Apple's provisional period, and for nothing else.
  9. Zero-touch enrollment: how it worksGoogle for Developers, device provisioning services2025-08-28Read on 25 September 2026; the page reported a last update of 28 August 2025. Source for the reseller-side mechanics: the reseller claims devices to a named customer through the provisioning API, and the reseller creates the customer account. The page describes no customer-side route to claim a device, and it does not address what happens when a customer changes reseller. The body states that absence rather than filling it.
  10. Android Enterprise partner directory, device resellersGoogleLoaded on 25 September 2026. It describes itself as listing partners meeting Google's Silver or Gold programme requirements and offering Android Enterprise zero-touch enrolment services. On the fetch this desk made, the directory returned no results at all and displayed a no-matches message, which is most likely a front-end or client-side loading fault rather than an empty programme. This desk therefore could not confirm a single named Belgian zero-touch reseller from it, and the body reports the failed load as a failed load. The linked programme-requirements document was not opened.
  11. Windows Autopilot registration overviewMicrosoft Learn2025-03-25Read in full on 25 September 2026. Article date 25 March 2025; page metadata showed a refresh on 22 June 2026. Source for: registration requiring both a captured hardware hash and association to a tenant ID; the statement that ideally the OEM, reseller or distributor performs both; the four registration routes; the contents of the hardware hash and the note that a motherboard replacement will not match; and the deregistration sequence, including that a device must be deleted from Intune first and that deregistration by a partner in Partner Center does not unenrol the device from MDM or disjoin it from Entra ID.
  12. Windows Autopilot OEM registration processMicrosoft Learn2025-06-13Read on 25 September 2026. Article date 13 June 2025; metadata refresh 19 May 2026. Source for: the statement that hardware hashes are not normally provided directly to customers or Cloud Solution Partners and that the OEM should register on the customer's behalf; the statement that no permissions to the customer's tenant are granted or required for an OEM to register devices; and the requirement that the organisation's Microsoft Entra Global Administrator approve the OEM first.
  13. Reseller, distributor, or partner registration of Windows Autopilot devicesMicrosoft Learn2025-06-13Read on 25 September 2026. Metadata refresh 19 May 2026. Source for: the requirement that a reseller or distributor be part of the Cloud Solution Provider programme to register devices; the two-step consent, partner requests a relationship and the customer's Global Administrator approves; and the sentence that Windows Autopilot does not require delegated administrator permissions, with the Global Administrator free to uncheck the delegated administration box during approval.
  14. Windows Autopilot customer consentMicrosoft Learn2025-06-13Read in full on 25 September 2026. Metadata refresh 19 May 2026. Source for the finding the body leads on: Microsoft's note that once OEM authorisation is completed it is not currently possible for an administrator to remove an OEM, and that to remove an OEM or revoke its permissions a request must be sent to msoemops@microsoft.com. Also source for the CSP consent flow, the direct and indirect CSP distinctions, the note that partners may request Delegated Admin Permissions and that DAP status can be removed from the Microsoft 365 admin center, the repeated caution that Global Administrator is a highly privileged role, and the statement that no delegated admin permissions are granted to an OEM. The linked OEM API whitepaper is restricted to Microsoft device partners and was not opened.
  15. Overview of Windows Autopilot device preparationMicrosoft Learn2026-08-07Read on 25 September 2026. Article date 7 August 2026; metadata refresh 27 August 2026. Source for: Microsoft Entra join only being supported; enrolment-time grouping; and the precedence rule, that where a device is already registered as an Autopilot device and is not associated with the tenant, the Autopilot profile takes precedence and the device must be deregistered first. Also source for corporate identifiers being required only where enrolment restrictions block personal devices.
  16. Windows Autopilot device preparation requirementsMicrosoft Learn2025-06-11Read in full on 25 September 2026 across all five requirement tabs. Article date 11 June 2025; metadata refresh 22 June 2026. Source for the central comparison in the body: the requirements are software, networking, licensing, configuration and RBAC, and none of them is a hardware hash, an OEM registration or a reseller relationship. Source also for the Windows 11 floors including KB5035942 on 22H2 and 23H2, the listed subscription options, and the statement that there are no additional hardware requirements beyond those needed to run Windows.
  17. Prices charged by resellers for enrolment registration, and vendor service levels for the registration servicesNot found. This desk looked for a published price, a published turnaround commitment and a published service level for Apple's supplier submission, Google's zero-touch claiming and Microsoft's OEM and CSP registration, on each vendor's own current pages listed above. None of the three publishes any of the three. Nor does any of them publish what becomes of an existing device record when a reseller leaves the programme, is acquired, or loses the relationship. The body reports these as absences and prints no number.

Bram Coppens

Procurement and devices

I report on banking, fintech and the compliance tech reshaping how European financial institutions actually operate. I'm happiest when a quarterly earnings call turns into a regulatory subplot.