Zero Touch Provisioning
A device obtaining its identity and configuration on first boot without a human configuring it, which is the only approach that scales past a few hundred units.
Manual provisioning — an installer entering credentials, or a technician running a tool — does not scale and is a security weakness: whatever the installer types can be typed by anyone, and shared credentials proliferate.
Zero touch inverts it. The device is manufactured with a hardware-backed identity and a bootstrap endpoint. On first power-on it contacts that endpoint, proves its identity using the manufacturing credential, and receives its operational credentials and configuration. Nobody types anything.
Three parts have to be right. The manufacturing trust anchor — the key or certificate installed at production — determines the security of everything after it, and a manufacturing process that allows extraction of that secret undermines the whole fleet. Claiming binds the device to a customer or site, which must be authenticated or a device can be claimed by the wrong party. And the bootstrap endpoint is a critical dependency whose outage means no device can be commissioned, so its availability requirement is higher than intuition suggests.
The case to design for from the start is re-provisioning: devices are resold, sites change hands, and a device that cannot be securely returned to an unclaimed state becomes electronic waste.