How we zero-touch provision 400 retail kiosks across 18 locations — without on-site IT

We run customer-facing ordering and loyalty kiosks across 18 retail locations. Over the past two years we've provisioned over 400 devices using Esper's Zero Touch enrollment, and we've gotten the time from "tablet out of the box" to "fully configured kiosk ready for customers" down to under 10 minutes — with no IT staff on-site.

Here's how we set it up.

The challenge

When we started, provisioning a new location meant flying or driving an IT tech to site, spending a day configuring devices by hand, and then flying home. For 18 locations across multiple states that was expensive, slow, and created inconsistencies between sites — whoever was on site would make slightly different decisions and we'd end up with devices that weren't quite identical.

We needed a way for store managers to unbox tablets, plug them in, and have them configure themselves.

How we structured our Blueprints

We use a three-layer Blueprint hierarchy:

• Base Blueprint (all devices) — OS settings, security policy, core apps, Wi-Fi configuration, Kiosk Mode settings
• Region Blueprint (per region) — inherits from Base, overrides regional app configuration (pricing logic, regional content)
• Location Blueprint (per store) — inherits from Region, injects the store ID as a managed configuration value into the kiosk app

This means a security policy change or a core app update goes into the Base Blueprint and propagates to all 400 devices automatically. Store-specific configuration stays isolated and never accidentally bleeds across.

The provisioning workflow

1. Devices are purchased through a reseller enrolled in our Zero Touch account. They arrive pre-registered — the ZT configuration is already associated with the device serial before we touch it.
2. Before a new location opens, we create the Location Blueprint for that store (store ID, the correct Region Blueprint as parent, any site-specific Wi-Fi). This takes about five minutes.
3. Devices ship directly to the store. The store manager takes them out of the box, connects to Wi-Fi, and powers them on.
4. Within eight to ten minutes, each device has downloaded the Esper agent, enrolled, pulled its Blueprint, configured Kiosk Mode, and launched the kiosk app.
5. The manager gets a Slack notification (we built a simple webhook integration) when all devices in the location are online and in Blueprint compliance.

What we'd still like to see

The one remaining pain point is updates. Pushing a Blueprint change to all 400 devices has to be done manually, and doing it during business hours disrupts customers. We've put in a Feature Request for scheduled Blueprint apply — if that's a problem for your team too, the more votes it gets the faster it moves up the roadmap.

Happy to answer questions about the Blueprint structure, the ZT setup, or the webhook integration.