Devices that arrive configured and stay managed.

Zero-touch enrolment means a device configures itself from a management service on first power-on rather than being built by hand. The routes are platform-specific. Windows Autopilot registers a device by hardware identifier; Apple Automated Device Enrolment binds devices bought through approved channels to an organisation's account; Android Enterprise separates a work profile on a personal handset from a fully managed corporate device, with a dedicated mode for single-purpose use. None of this saves effort unless a build standard already defines what each device role receives: applications, security baseline, network access and peripherals.

Retirement carries its own duties. Deleting files or reformatting does not reliably remove recoverable data; NIST SP 800-88 defines clear, purge and destroy as three levels of media sanitisation, and a disposal record should name the serial number and the method used. UK WEEE regulations govern the collection and treatment of the hardware itself. Refresh timing is knowable in advance: warranty expiry and published operating-system support dates set the outer limit, and requirements such as TPM 2.0 can make a working device ineligible for the next version.