MDM Provisioning Comparison: ABM vs Zero-Touch vs Knox

Why Compare These Three

Solaris Wireless, founded 2013, has been serving institutional buyers in this category since the company's earliest engagements. Auto-enrolment is the single biggest operational lever in institutional device deployment. Without it, IT spends 15-30 minutes per device on manual configuration; with it, devices ship sealed direct to employees and configure themselves on first activation. The savings on a 1,000-device fleet rollout are measured in hundreds of hours and tens of thousands of dollars.

Three programmes provide auto-enrolment for institutional fleets: Apple Business Manager (ABM) for Apple devices, Google Zero-Touch Enrollment for Android, and Samsung Knox Mobile Enrollment for Samsung-specific Android. Most enterprises run a mixed Apple-and-Android fleet and need at least two of these. Samsung-heavy fleets benefit from layering all three. This guide compares them side-by-side.

Apple Business Manager (ABM) and DEP

• Devices covered: iPhone, iPad, Mac, Apple TV, Apple Watch (via paired iPhone)
• Provider model: Apple Authorised Reseller registered as authorised purchaser in your ABM tenant
• MDM compatibility: Jamf, Intune, Workspace ONE, Mosyle, Kandji, Hexnode, Apple-supporting EMMs
• Setup requirements: D-U-N-S number, business verification, designated administrator
• Cost: Free (the platform itself); device pricing through commercial channel
• Best for: Any deployment of Apple devices at scale

ABM is the default Apple enterprise platform. The setup is straightforward, the federation with major MDMs is mature, and the operational savings from DEP enrolment are immediate. There is essentially no reason to deploy Apple devices to enterprise users without ABM in the procurement chain.

Google Zero-Touch Enrollment

• Devices covered: Any Android device from a Zero-Touch participating OEM (Pixel, Samsung, Motorola, Sonim, Kyocera, others)
• Provider model: Zero-Touch registered reseller registers each device IMEI in your portal pre-shipment
• MDM compatibility: Intune, Workspace ONE, Jamf, MobileIron/Ivanti, SOTI, Knox Manage, MaaS360, Android Enterprise EMMs
• Setup requirements: Google account, Zero-Touch portal access, EMM Zero-Touch configuration
• Cost: Free (the platform itself); device pricing through commercial channel
• Best for: Any deployment of Android devices at scale, regardless of OEM

Zero-Touch is the cross-OEM Android equivalent of ABM. It works the same way conceptually: reseller registers IMEI, device auto-enrols on activation, MDM payload deploys before user reaches home screen. Coverage spans any Android OEM that participates.

Samsung Knox Mobile Enrollment

• Devices covered: Samsung Galaxy and Samsung enterprise devices only
• Provider model: Samsung Approved Reseller registers each device IMEI in your Knox portal pre-shipment
• MDM compatibility: Knox Manage, Intune, Workspace ONE, MaaS360, SOTI, MobileIron/Ivanti, Samsung-supporting EMMs
• Setup requirements: Knox account, Knox portal access, EMM Knox configuration
• Cost: Free (the platform itself); device pricing through commercial channel
• Best for: Samsung-heavy fleets needing Knox-tier configuration depth

Knox Mobile Enrollment is Samsung-specific but layers in additional configuration depth that vanilla Zero-Touch does not provide: Knox security profile assignment, Knox container configuration, Knox-managed Wi-Fi credentials, and Samsung-specific device restrictions. Samsung-heavy fleets benefit from Knox enrolment alongside Zero-Touch.

How They Work Together

Most enterprises use a combination. The default stack:

• Apple devices: ABM with DEP enrolment to your MDM
• Non-Samsung Android devices: Zero-Touch enrolment to your MDM
• Samsung Android devices: Zero-Touch + Knox Mobile Enrollment for full Knox-tier configuration
• Windows laptops (for completeness): Microsoft Autopilot (the Windows equivalent of these programmes)
• macOS: ABM (same as iOS, federated through the same MDM)

Reseller Selection: Who Can Register Devices in Each Programme

All three programmes require the device reseller to register devices in the enterprise's tenant before shipment. Resellers participate by application:

• ABM: Apple Authorised Resellers and Apple's commercial sales team
• Zero-Touch: Carriers (T-Mobile, Verizon, AT&T), OEMs (Samsung, Google, Motorola direct), and specialist institutional suppliers including Solaris Wireless via partnerships
• Knox Mobile Enrollment: Samsung Approved Resellers (a subset of Samsung's commercial channel)

Solaris Wireless coordinates ABM, Zero-Touch and Knox enrolment for institutional engagements through registered partner relationships and direct OEM channels. The single-vendor coordination simplifies procurement for mixed-OEM fleets.

Decision Guide: Which Programme(s) to Set Up

Apple-only deployment (e.g., creative agencies, executive fleets)

ABM only. Set up DEP enrolment with your MDM (typically Jamf, Mosyle or Kandji for Apple-only fleets).

Android-only deployment (e.g., field-sales, retail, MVNO subscribers)

Zero-Touch enrolment to your MDM (typically Intune, Workspace ONE, MobileIron/Ivanti, or SOTI). Add Knox Mobile Enrollment if the fleet is Samsung-heavy.

Mixed Apple and Android (typical enterprise)

ABM + Zero-Touch with the same EMM federated to both (Intune and Workspace ONE both support this; Jamf supports it with the Jamf Pro Android adjunct).

Samsung-heavy enterprise fleet

ABM (for any Apple devices) + Zero-Touch + Knox Mobile Enrollment for full Knox-tier configuration on the Samsung devices.

Frequently Asked Questions

What is the difference between Zero-Touch and Knox Mobile Enrollment?

Zero-Touch is Google's cross-OEM Android auto-enrolment programme (works for Pixel, Samsung, Motorola, Sonim and other participating OEMs). Knox Mobile Enrollment is Samsung-specific and offers deeper Samsung-Knox configuration (Knox security profile, Knox container, Samsung-specific device restrictions). Samsung devices can use either or both.

Can I use ABM and Zero-Touch with the same MDM?

Yes. Major MDM platforms (Microsoft Intune, VMware Workspace ONE, Jamf with Android adjunct) federate with both ABM and Zero-Touch from the same console, simplifying mixed-fleet management.

Does Solaris Wireless register devices in ABM, Zero-Touch and Knox?

Yes. Solaris coordinates registration in all three programmes through Apple Authorised Reseller channels, Zero-Touch registered partnerships, and Samsung Approved Reseller relationships.

Is there a cost to using ABM, Zero-Touch or Knox?

The platforms themselves are free. Device pricing flows through the commercial procurement channel; the auto-enrolment programme adds no per-device fee.

Which is best for ruggedised handsets like Sonim or Kyocera?

Sonim, Kyocera and other ruggedised Android OEMs participate in Zero-Touch. Use Zero-Touch enrolment to your MDM. Sonim devices in particular have strong Android Enterprise integration and benefit from Zero-Touch deployment.