メインコンテンツへスキップ

055: Review provisioning strategy

Implementation Effort: High

User Impact: High

Overview​

Provisioning strategy determines how quickly devices can be deployed, how much control IT has at first boot, and how consistently security settings are applied. In a Zero Trust device workshop, provisioning should be designed around ownership, platform, shared vs. assigned use, and whether the organization needs day-one compliance and application deployment.

The best strategy is usually not a single method. Most organizations need a small set of approved patterns and a clear rule for when each pattern is used.

Implementation Guidance​

  1. Define standard provisioning paths for each device class: corporate-owned assigned, corporate-owned shared, personally owned, and contractor or temporary devices.
  2. For Apple corporate-owned devices, prefer Automated Device Enrollment through Apple Business Manager or Apple School Manager. For Apple BYOD, evaluate account-driven user enrollment or an app-protection-only approach.
  3. For Android, prefer Android Enterprise enrollment models that align with ownership and use case. Avoid relying on legacy Android device administrator patterns except where a supported exception clearly exists.
  4. Confirm what must happen during provisioning: naming, compliance evaluation, required apps, certificates, Wi-Fi, VPN, and setup experience controls where supported.
  5. Decide whether users may self-provision or whether devices must be staged by IT or a partner.
  6. Build a pilot matrix that covers first-run sign-in, recovery or re-provisioning, break/fix replacement, and offboarding or wipe.
  7. Publish the strategy as approved standards, not as a loose list of options.

Reference​