Chrome OS zero-touch enrollment is an alternative to manually enrolling devices, where a pre-provisioning partner (device manufacturer, distributor or reseller) sends instructions to Google to automatically enroll a Chrome device into a customer’s domain after a device is turned on and connected to the internet.
For a step-by-step guide, watch the following video:
Zero-touch enrollment requires:
- A compatible Chrome device
- A pre-provisioning token generated from the Google Admin console
- An approved pre-provisioning partner to assist with enrollment
- Available Chrome Enterprise, Education, or Non-Profit upgrades
A pre-provisioning token is a unique identifier generated in the Google Admin console, and is used for verification during device enrollment. It can be used for multiple devices and remains active until the admin revokes its use. A separate token can also be generated for each organizational unit.
To generate a pre-provisioning token:
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
From the Admin console Home page, go to Devices
Chrome devices.
-
To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
-
In the bottom-right corner, click Enroll devices
- A pre-provisioning token will be generated. You can choose to:
- Copy pre-provisioning token to clipboard
- Revoke token
- Revoke and regenerate token
- Copy pre-provisioning token to clipboard
Note: Be sure to provide both the pre-provisioning token and the device's enrolled domain to an authorized pre-provisioning partner to complete the zero-touch enrollment.
A new device status, "pre-provisioned" has been added to the Device status filter in the Admin console. It lists Chrome devices that are ready to be zero-touch enrolled during initial device setup. While a device is in a “pre-provisioned” state, it can be moved to a different organizational unit or deleted. However, once zero-touch enrollment is complete, the device will become “Provisioned”.
Not all Chrome devices are compatible with zero-touch enrollment. More devices will be added as they are announced. The table below lists devices that are supported currently:
| Device manufacturer and model | Manufactured date | Attested Device ID |
|---|---|---|
| Acer Chromebase CA24I2 | March 1, 2021 | Serial number |
| Acer Chromebase CA24V2 | March 1, 2021 | Serial number |
| Acer Chromebook 311 (C733/C733U/C733T) | Beginning January 1, 2021 | Serial number |
| Acer Chromebook 311 (C722/C722T) | All devices are capable | Serial number |
| Acer Chromebook 314 (C933) | Beginning March 1, 2021 | Serial number |
| Acer Chromebook 511 (C741L/C741LT) | All devices are capable | Serial number |
| Acer Chromebook 512 (C851/C851T) | Beginning January 1, 2021 | Serial number |
| Acer Chromebook 712 (C871/C871T) | Beginning December 11, 2020 | Serial number |
| Acer Chromebook Spin 511 (R752T/R752TN) | Beginning January 1, 2021 | Serial number |
| Acer Chromebook Spin 511 (R753T/R753TN) | All devices are capable | Serial number |
| Acer Chromebook Spin 512 (R851TN/R852T/R852TN) | Beginning January 1, 2021 | Serial number |
| Acer Chromebook Spin 512 (R853TA/R853TNA) | All devices are capable | Serial number |
| Acer Chromebook Spin 513 CP513-1H/CP513-1HL/R841T/R841LT) | All devices are capable | Serial number |
| Acer Chromebook Spin 514 (CP514-1H/CP514-1HH, CP514-1W/CP514-1WH) | All devices are capable | Serial number |
| Acer Chromebook Spin 713 (CP713-2W | Beginning November 2, 2020 | Serial number |
| Acer Chromebox CXI4 | All devices are capable | Serial number |
| ASUS Chromebox 4 | Beginning March 22, 2021 | Serial number |
| CTL Chromebook NL71/NL71CT/NL71LTE | Beginning January 1, 2021 | Serial number |
| CTL Chromebook NL71T/NL71TW/NL71TWB | Beginning January 1, 2021 | Serial number |
| CTL Chromebook NL81/NL81T | Beginning January 1, 2021 | Serial number |
| CTL Chromebox CBX2 | All devices are capable | Serial number |
| Dell Latitude 5300 2-in-1 Chromebook | Beginning December 1, 2020 | Service Tag |
| Dell Latitude 5400 Chromebook | Beginning December 1, 2020 | Service Tag |
| Dell Latitude 7410 Chromebook | Beginning December 1, 2020 | Service Tag |
| HP Chromebox G3 | Beginning December 21, 2020 | Serial number |
| HP Elite c1030 Chromebook | Beginning October 7, 2020 | Serial number |
| HP Pro c645 Chromebook | All devices are capable | Serial number |
| Lenovo ThinkPad C13 Yoga Chromebook1 | All devices are capable | 1S + MTM + Serial number |
| Samsung Galaxy Chromebook 2 | All devices are capable | Serial number |
1Note for pre-provisioning partners, Lenovo uses 1S + MTM + SN as the serial number for zero-touch enrollment.
The partners who currently offer zero-touch enrollment, are listed below. This list will be updated as more partners implement the service.
| Company name | Region |
| Acer | Global |
| Atea | Nordics |
| CDW | United States |
| CTL | United States, Europe |
| Econocom | France |
| Getech | United Kingdom |
| HP Inc. | Global |
| Insight | United States |
| Lenovo | Global |
| SHI | United States |
| Synnex | United States |
Issues during Chrome OS zero-touch enrollment can be caused by a number of things. Here are some potential issues you might encounter and how to resolve them.
Device isn’t listed as Pre-provisioned in the Admin console
Contact your pre-provisioning partner to ensure they used the correct pre-provisioning token, domain, and device information. If they have, contact support for further assistance.
Device isn't identified as eligible for zero-touch enrollment and doesn’t enroll
Verify devices have been pre-provisioned and are capable of zero-touch enrollment by pressing Alt + V during the initial device setup.
Contact support for further assistance.
Device enters the zero-touch enrollment flow but fails to enroll
If there are not enough Chrome Enterprise Upgrades available, you will see the error Not enough upgrades. Contact your reseller to purchase more Chrome Enterprise Upgrades.
Chromebook Enterprise devices include a Chrome Enterprise Upgrade associated with the device and do not use a separate Chrome Enterprise Upgrade for enrollment. If you have a Chromebook Enterprise device and are seeing this error, contact the device manufacturer for assistance.
Device is stuck on the manual enrollment screen
If the device is identified as eligible for zero-touch enrollment but fails to enroll, a manual enrollment screen is displayed. To one of the following:
- To avoid manual enrollment, powerwash the device and go through the initial device setup. For details, see Force wiped Chrome devices to re-enroll.
If it still does not zero-touch enroll, contact support. - Manually enroll the device.