Zero-Touch Provisioning

Bring a fleet online without touching every box

Onboarding hardware one device at a time is where most ISP and WISP rollouts slow down: copy a config, type a hostname, register it in a spreadsheet, and hope the next technician follows the same steps. At fleet scale that doesn't hold — duplicate records, devices in the wrong tenant, and inventory that drifts from reality within a week.

ISPAgents provisions hardware into the right tenant with strong identity from the start. Setup keys and bulk enrollment get routers and CPE onboarded without hand-configuring each one, and canonical device identity built from serial and MAC evidence keeps every observation — TR-069, SNMP, USP, syslog, controller — mapped to the one device it belongs to.

Canonical device identity

The hard part of provisioning isn't getting a device to talk — it's making sure the same device isn't counted three times because three protocols saw it. Identity is derived deterministically from strong serial and MAC evidence (a stable UUIDv5), so a router that appears over TR-069 and again over SNMP resolves to a single canonical record instead of fracturing into duplicates.

• One device, one identity — derived from strong serial and MAC evidence.
• Multi-protocol merge — TR-069, SNMP, USP, syslog, and controller observations map to the same device when the evidence supports it.
• Ownership hierarchy and device groups / zones so a device lands in the right tenant, site, and operational group as it onboards.

When the serial and MAC evidence is strong, these converge to one canonical device. When it isn't, the record stays distinct rather than merging on a guess.

Onboarding workflow

Onboarding is operator-initiated and audited end to end — not a black box that quietly claims hardware.

1. Mint a setup key with a one-time plaintext reveal (shown once, then only the hash is stored).
2. Issue an enrollment token with a 24-hour TTL for the device or batch.
3. The device enrolls and is matched to a canonical identity from its serial and MAC evidence.
4. A claim workflow binds the device to the right tenant, owner, and group, with an audit record of who claimed it and when.
5. The device appears in inventory with its identity, group, and ownership already resolved.

Bulk enrollment

For a rollout, onboarding one device at a time isn't the model. Setup keys and enrollment scripts drive bulk enrollment so a batch of routers comes online against the same campaign, lands in the correct tenant and groups, and is deduplicated by canonical identity as it arrives.

• Setup keys and scripts for batch onboarding.
• Enrollment tokens with a 24-hour TTL per batch.
• Device groups / zones and ownership applied during the campaign.
• Canonical identity dedup so a re-scanned device doesn't create a second record.

Coexist, then expand

Start by enrolling a small batch with setup keys and validating that identity, ownership, and groups resolve the way you expect — with your existing inventory system still in place. As the canonical identity proves clean, scale the enrollment campaign and let ISPAgents become the source of truth for what is onboarded where.

Provisioning feeds straight into unified device management for day-two operations; pair it with the TR-069 ACS for CPE that onboards over CWMP, and read canonical subscriber and device identity for how the one-device, one-subscriber mapping is built.