What it is
On first boot a device contacts the Onboarding Service and is told which UMS or cloud environment it belongs to. The person in front of it signs in with their company credentials, and that registration is what assigns the device to its configuration, policies and group.
Everything else follows automatically: policies, network configuration, certificates, software packages.
What it is for
A device can go straight from the distributor to a home office and arrive managed.
It is equally the answer for a site with no IT staff, which is most branch offices.
What to watch
The device has to reach the service before it gets its configuration, so the failure modes are all network ones: captive portals in hotels, a home router with an unusual DNS, a firewall rule nobody remembers writing.
