What do we actually need for zero-touch setup to work?

Three things: devices registered for Autopilot (either bought that way through a reseller or registered by hardware hash), Intune licences with the enrolment and app policies configured once, and Entra ID accounts created before the laptop is handed over. After that, the person signs in on a fresh device and the configuration arrives on its own.

Does this work for Macs and iPhones too?

Yes. Apple Business Manager plus Intune gives Apple devices the same pattern: automated enrolment at first boot, app deployment, configuration profiles and remote wipe. The mechanics differ - Apple uses automated device enrolment rather than Autopilot - but the operational result for the person receiving the laptop is the same.

How long does the first setup take to build?

The one-off configuration is typically a day or two of work: enrolment profiles, an app set, compliance and update policies, and a test device run end to end. Every hire after that costs minutes of admin rather than half a day, which is where the time actually comes back.

What about the offboarding side?

It is the same pipeline in reverse and it matters more. Disable the account first, which cuts access to every connected app at once, then revoke sessions, reassign the licence, transfer OneDrive content to the manager, and wipe or retire the device. Doing it in that order is what stops a leaver keeping access to a tool nobody remembered.

Can we run this without Business Premium?

Intune is the requirement rather than the specific bundle - it comes in Business Premium or as a standalone licence. What you cannot do is run zero-touch onboarding with Business Standard alone, because the device management layer simply is not there.

How to Set Up a New Employee's Laptop in Under 60 Minutes

What manual onboarding actually costs you in time

Most small businesses don't track this number, but it adds up fast. A typical manual device setup for a new hire looks like this:

Setting up one new laptop: by hand vs zero-touch

Install and activate Windows

By hand: 1-2 hours, from USB or the network
With Autopilot and Intune: Runs itself at first sign-in

Install Microsoft 365 apps

By hand: 45-90 minutes
With Autopilot and Intune: Pushed by Intune during setup

Set up security tools

By hand: 30-60 minutes
With Autopilot and Intune: Defender and BitLocker apply as policy

Install role-specific apps

By hand: 1-2 hours, one source at a time
With Autopilot and Intune: Packaged once, delivered per role

1Password and other accounts

By hand: 30-45 minutes of manual sharing
With Autopilot and Intune: Vault access follows the account

Total IT time per hire

By hand: 4-7 hours
With Autopilot and Intune: Under 60 minutes, unattended

Table comparing five onboarding steps done by hand against Autopilot and Intune, cutting 4-7 hours of IT time per hire to under an hour.
Step	By hand	With Autopilot and Intune
Install and activate Windows	1-2 hours, from USB or the network	Runs itself at first sign-in
Install Microsoft 365 apps	45-90 minutes	Pushed by Intune during setup
Set up security tools	30-60 minutes	Defender and BitLocker apply as policy
Install role-specific apps	1-2 hours, one source at a time	Packaged once, delivered per role
1Password and other accounts	30-45 minutes of manual sharing	Vault access follows the account
Total IT time per hire	4-7 hours	Under 60 minutes, unattended

Our own delivered timings for small-business onboarding. The automated column assumes the device was registered with the supplier.

At €75/hour for IT time, that's €300-€525 per new hire. For a 10-person team that hires 5 people a year, that's €1,500-€2,600 in IT setup time alone - before counting the productivity the new employee loses waiting.

How zero-touch onboarding works

Two vendor mechanisms do the work: Windows Autopilot registers a device to your tenant so it configures itself at the user's first sign-in^[1], and Intune delivers the app set and policies to it without an engineer touching the machine^[2].

With Microsoft Intune + Windows Autopilot, the process changes entirely:

You order a laptop from any Microsoft-registered supplier (in Israel and across Europe - they all support Autopilot).
The supplier ships it directly to the employee.
The employee opens the box, connects to Wi-Fi, and signs in with their company credentials.
Everything else happens automatically: Windows configures itself, Office installs, security policies apply, approved apps download.
The employee is working in 30-45 minutes - with no one else involved.

Your IT setup doesn't need to be in the same room, the same city, or the same country.

What gets deployed automatically

Microsoft 365 apps (Outlook, Teams, Word, Excel)
1Password browser extension and company vault access
Endpoint protection (Microsoft Defender, configured via Intune)
BitLocker disk encryption (transparent to the user)
Conditional Access policies (enforced at first login)
Any role-specific software you've packaged in Intune

What happens if the laptop gets lost or stolen

Remote wipe via Intune takes about 30 seconds. The device is locked and all company data is wiped the next time it connects to the internet. The employee gets a new device, signs in, and is back to their full setup within an hour.

The same setup works for Macs

It runs through Apple Business Manager - the Apple equivalent of Windows Autopilot. Setup is similar: you enrol your Apple Business Manager account with Intune, and new Mac purchases from any Apple Authorised Reseller in your country go through the same zero-touch process.

The Mac setup process is slightly more involved than Windows Autopilot (Apple's MDM profile system works differently), but the end result is the same: a device ready to work within an hour, no hands-on setup needed.

Questions we get asked

Sources

Every figure in this article traces back to a named source. Where we quote our own numbers, they come from work we have done with small businesses in Israel and across Europe, and we say so.

Figures last checked 28 July 2026