Device Provisioning & Onboarding
New laptops shipped straight to the person who will use them, set up automatically at their first sign-in and under management before they open an email. When someone leaves, their access is shut off, their data is kept, and their device is wiped and made ready for the next hire.
Overview
A new hire's first morning should not start with a technician and an unboxed laptop.
In most businesses a new laptop means someone spends half a day setting it up by hand: installing the same applications, applying the same settings, connecting the same printers, and forgetting something different each time. Leavers are worse. Accounts stay open for weeks, a laptop sits in a drawer with company data on it, and nobody is sure which shared passwords the person knew.
We turn onboarding and offboarding into a repeatable process. Windows devices are registered with Windows Autopilot, and Macs, iPhones and iPads with Apple Business (formerly Apple Business Manager), so a device can ship from the supplier to an employee's home and configure itself at first sign-in: work account, security policies, the management agent and the applications for that person's role. Offboarding runs from a checklist tied to the leaving date: sign-ins blocked, mailbox and files handed to a manager, the device locked or wiped remotely and brought back into stock.
Capabilities
What's included
- Zero-touch Windows deploymentDevices registered with Windows Autopilot and enrolled through Microsoft Intune and Entra ID, so a sealed laptop sets itself up at the user's first sign-in.
- Apple Business enrollmentMacs, iPhones and iPads assigned to your organization at purchase and enrolled automatically, with setup screens skipped and policies applied.
- Role-based software and settingsEach role gets its own applications, printers, drive mappings and settings, pushed automatically, so the tenth new hire is set up exactly like the first.
- Accounts and licenses ready on day oneMicrosoft 365 or Google Workspace account, license, groups, shared mailboxes and MFA enrollment prepared before the start date.
- Offboarding checklistSign-in blocked, sessions revoked, MFA methods removed, mailbox and files handed to a manager, and shared credentials the person knew rotated.
- Remote lock, wipe and recoveryA departing employee's device locked or wiped remotely, return shipping arranged where needed, and reset ready for the next person.
- Asset records kept currentEvery device's assigned user, location and warranty updated on the way in and on the way out, so you always know who has what.
How It Works
Delivered through managed IT
Windows Autopilot and Apple Business handle the out-of-box enrollment and install our management agent as part of it. From first sign-in the device sits in our endpoint management platform with policies, patching, monitoring and software already assigned by role. Offboarding steps are logged against the user and the device, so there is a record of what was removed and when.
Why Atlas
Secure. Reliable. Responsive.
Flat monthly fee
Predictable per-device pricing. No surprise invoices and no hourly meter running while your team waits for help.
Proactive, not reactive
Monitoring, patching, and automation run around the clock — so most issues are resolved before your staff ever notice them.
Responsive & accountable
One team that knows your environment and answers fast. You reach a real technician, not a ticket queue in another time zone.
Month-to-month
We earn your business every month. No multi-year lock-in — you stay because the service works, not because a contract traps you.
Common Questions
Questions we get asked
What does zero-touch provisioning actually mean?
It means the device is set up by its first sign-in rather than by a technician. The supplier registers the serial number to your organization; when the employee unboxes it and signs in with their work account, it joins your tenant, applies security policies, installs the management agent and pulls down the applications for their role. A technician watches the process remotely and steps in only if something fails.
Do we have to buy new devices for this to work?
No. Devices you already own can be registered after the fact, usually when they are next reset, and from then on they rebuild themselves the same way. New purchases are easiest: when hardware is bought through a supplier that supports Autopilot or Apple Business registration, the serial numbers are assigned at purchase and the device never needs to visit an office.
We do not have Microsoft Intune. Can you still automate setup?
Yes. Intune is included in some Microsoft 365 business plans, such as Business Premium, and we will tell you whether yours already has it. Where it does not, we build a standard image and a management policy per role that installs software and applies settings as soon as the agent checks in, which gets most of the benefit without a licensing change. We lay out both options for your plan and fleet.
How quickly is access removed when someone leaves?
As quickly as you tell us. Offboarding runs from a checklist the moment HR or a manager notifies us, and for a sensitive departure it can be timed to the exit meeting itself: sign-ins blocked, active sessions revoked and the device locked before the person reaches the parking lot. The mailbox and files are preserved and handed to a manager rather than deleted, so nothing the business needs is lost.
What happens to the laptop after someone leaves?
It is locked or wiped remotely, depending on whether it has come back yet, and its asset record is updated so the device is not lost track of. Once it is returned it is reset, and because it is registered for zero-touch setup it configures itself for the next person at their first sign-in. If it is near the end of its life we flag it for retirement instead, with the drive sanitized before disposal.
Secure. Reliable. Responsive.
Book a consultation and we’ll map out a managed IT plan for your business, or email contact@atlasbm.net.