MDM Zero-Touch Enrollment Queue

Enrollment Load

Arrival rate λ 2.0 dev/s

CA throughput μ 2.5 certs/s

Request failure rate 15%

Backoff base delay 1.0s

Fleet Status

Queue depth

In backoff

Avg wait (Little's Law)

0.0s

Success rate

—

Utilization ρ = λ/μ

0.80

Enrolled total

How it works

Zero-touch MDM enrollment is a single-server queue: devices power on, contact the MDM server, and request a certificate over SCEP (Simple Certificate Enrollment Protocol). The certificate authority (CA) can only sign so many requests per second, so devices queue up in front of it — exactly the classic M/M/1 queueing model:

λ = arrival rate (devices/s)
μ = service rate (certs/s)
ρ = λ / μ                    utilization
L = ρ / (1 − ρ)               avg devices in system  (ρ < 1)
W = L / λ                     avg time in system (Little's Law)

When ρ ≥ 1 the CA can't keep up with new arrivals and the queue grows without bound — visible here as the line of waiting devices never shrinking. A fraction of signing attempts fail (expired challenge, bad clock skew, network drop); a failed device doesn't leave the fleet, it retries with exponential backoff:

retry_delay(n) = base_delay × 2ⁿ   (n = retry count, capped at 30s)

Arrival rate λ — how fast new devices are provisioned into the enrollment flow (e.g. a bulk unboxing).
CA throughput μ — signing capacity of the certificate server; raising it drains the queue faster.
Failure rate — probability a signing attempt fails and the device must back off and retry.
Backoff base delay — the starting wait before a retry; it doubles on every subsequent failure so a flaky device doesn't hammer the CA.

Real deployments (Microsoft Intune, VMware Workspace ONE, Apple Business Manager zero-touch) size CA/NDES throughput against expected bulk-enrollment bursts precisely to keep ρ comfortably under 1 — this simulator makes that capacity-planning tradeoff visible and interactive.

Waiting in queue In backoff (retry) Enrolled (success)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.