We are currently updating an existing MDM configuration profile using the InstallProfile command in order to modify its capabilities. Is re-installing the MDM profile via the InstallProfile command the only supported approach for updating its capabilities? Also, are there any ways to update the MDM profile without requiring re-enrollment?

Thank you for the announcements at WWDC. I have one question. Are there any plans to support APIs in Apple Business that allow device actions such as Lock and Erase? Some operations are already possible with the current APIs, but having APIs for these actions would enable conditional operations and the provision of self-service portals. This would also allow for deeper integration with internal corporate systems.

Currently MDM must poll Apple Business for device assignments in order to detect any changes. Even with frequent syncs, admins still occasionally run into issues where devices were recently added to Apple Business and properly assigned, but do not properly enroll because they forgot to manually sync and the timing was in between regular scheduled syncs. The MDM can attempt to solve this by polling with high frequency, but there are still gaps and it feels a bit excessive. Current best practice is to just manually sync every time devices are added, but it's easy for admins to forget. In organizations with devices being added from multiple sources/individuals, this becomes more of challenge. Ideally, the MDM would be able to subscribe to notifications from Apple Business any time an assignment is updated and receive a list of changes - similar to how it works with Apps & Books licenses. This would simplify the admin experience and reduce end-user friction caused from devices not being enrolled properly on initial setup. Are there any plans to implement this type of functionality? If not, is there a "reasonable" interval you recommend polling for device assignment changes? FB16997801

When a device is locked into a single application using App Lock Mode, there is currently no convenient way to troubleshoot network connectivity issues if the device loses access to Wi-Fi or fails to connect to the configured network. In such scenarios, administrators or users may be unable to restore connectivity without performing a full device reset and re-enrollment, which can be time-consuming and disruptive. It would be beneficial to provide a mechanism that allows authorized users or administrators to temporarily exit App Lock Mode, or access limited device settings, for the purpose of configuring or troubleshooting Wi-Fi connectivity. This could be achieved through an administrator-defined password, recovery code, or another secure authentication method. Providing a secure Wi-Fi recovery option would significantly improve device manageability and reduce the need for device resets when network-related issues occur.

SUMMARY: Apple offers the Persistent Content Capture entitlement to developers who pinky-swear that it is only used for products in “VNC” (headless) deployments. This deployment scope also means that enterprises need to grant its use during applicable automated deployments. However, there is no means for an enterprise to pre-grant its use via MDM. At present, it is NOT POSSIBLE for enterprises to: [a] deploy products using Persistent Content Capture, and [b] achieve hands-off automated deployment. ASK: Enable macOS 27's new com.apple.configuration.app.settings to enable grants for com.apple.developer.persistent-content-capture. SEE ALSO, RELATED: FB21547531, FB21509640 REFERENCE: https://developer.apple.com/documentation/bundleresources/entitlements/com.apple.developer.persistent-content-capture

We noticed that the Asset Management API includes support for subscriptions for In App Purchases. Could you share the expected timeline for when this feature will be available for testing? https://developer.apple.com/documentation/devicemanagement/managing-subscriptions

I haven't yet found documentation that describes the behavior of the group or organization subscriptions at the time of renewal. Here are some examples. For Apple's scenario, a run club, say a coach orders a subscription for 'the team'. The app does seasonal (3 month) and annual (yearly) passes. One could collect group dues outside of the app store and help make the purchase. What happens at time of renewal? Does the person that made the original purchase have to manage that? How do they add or remove subscription users as club members may change? How about refunds? In another scenario, B2B, either education or enterprise. With Apple Business providing a free basic MDM (Business Essentials), I can see a lot more use for this case. The same questions apply. Maybe it is a productivity app for students or employees. The video described there being 'seats' that one could assign in Apple Business the say way that apps are assigned (and removed). What happens at the time of renewal? How about refunds? The video teased that management will be available in the future. To determine how 'seamless' the experience is, or to provide feedback, it would be good to even get some still screenshots of what this will look like. Choosing to go individual subscription vs group/org heavily depends on how much work it is removing from the individual consumer (and moving to a single or few administrators). When will some visuals of the 'group' management experience be available? For club scenarios, often the 'lead' or 'coach' is volunteer. Someone might leave for a season, the head coach might change, or groups want to have several admins that can manage the group for convenience to club members, and backup for those admins. Does the 'group' subscription support co-managers? To put it another way, can you have two or more coaches that can manage the group seats? Will there be a way to manage the managers of the group? What resources aside from the Device Management and new Subscriptions talks are relevant to this topic? Sorry the questions are 1-10 in the preview, but forums rendering is renumbering :)

We can either point the device at a URL to download and install the Legacy Profile (what we are doing now), or wrap it in a Declarative asset and reference that (newer offered path). Is there a recommended approach, and what drives it — reliability if the URL is unreachable at install time, how refreshes are handled, payload size? One of the pain points we have been working through with the Legacy Profile migration/default use (using the workflow point the device at a URL to download and install the Legacy Profile) is that durring the deployment of net new Declarations at ADE, and UIE on new enroll devices the profile install fails after ~15-30 profiles, and results in deadlock (FB22832791, FB22828244, and FB22827718) until devices reboot. Not ideal for a net new enroll with a end user. Would moving all net new deployments to the asset fix this? Is that going to be required? Thanks!

Thanks for the announcements and new features coming with device management. I noticed that there is a new declarative management that was mentioned in the list of videos under business & education. What would this compose of and how would this integrate into existing apple business accounts? Is there also newer features that would make deployment of devices faster or improved work flows? Thank you

Reading from the API documentation, we want to confirm that the subscription licenses must be bundled with clientuserid strings. Does that mean the app needs to also be assigned to the user, of can the app be assigned to the device and then the subscription assigned to the user after the fact?

Hi, Where can I have access to the newly introduced web login for Platform Single Sign-on? It would be very nice to see it and to learn how to implement the token exchange flow.

Hello! I have two questions around automatic device migration in Apple Business: Does the mdm_migration_deadline field ever get removed from a device response? If so, when? Documentation of the field for reference: https://developer.apple.com/documentation/devicemanagement/device Is there a way to determine if a device has actually completed a migration? Documentation of device migration for reference: https://developer.apple.com/documentation/devicemanagement/migrating-managed-devices#Handle-migration-in-the-destination-device-management-service

Apple made it very clear that this year is declarative. The last four years I’ve had several feedbacks open for legacy app config, and the new ManagedApp framework app config. This has been a major blind spot to deploying apps via Apple Business (Essentials). I didn’t see any announcements for support, but to double check, is that coming? FB19980558 (Business Essentials: Add Support for Managed App Configuration (via UserDefaults) and newer Managed App Framework) 2025 FB13398533 (Business Essentials: Add ability to send managed application configuration to an application installed via Apple Small Business Essentials app) 2023 FB21371989 (ManagedApp: Create a swift-configuration ConfigProvider implementation backed with ManagedAppConfigurationProvider)

Hey guys, I posted a similar thread in Privacy channel earlier, but their engineer points me to here: https://developer.apple.com/forums/thread/831492 I'm building a managed macOS app (credential-provider extension) that needs an MDM-provisioned, hardware-bound, attested identity via the ManagedApp framework on macOS 27 which just released days ago, and I've hit a documentation contradiction. By reading through the docs, my understanding of the ManagedApp identity path is com.apple.configuration.app.managed → Identities → com.apple.asset.credential.acme. But the OS27 ACME schema says, for both HardwareBound and Attest: "On macOS, this is a required key. Set the value to false" (https://github.com/apple/device-management/blob/seed_OS_27_0/declarative/declarations/assets/credentials/acme.yaml#L66) — implying a software key. However, the macOS 27 release notes say ManagedApp deploys "hardware-bound identities" on macOS. So I am wondering that on macOS 27 + Apple silicon, can a ManagedApp-provisioned ACME identity actually be HardwareBound: true / Attest: true? If yes, is the acme.yaml "set to false on macOS" text just stale? If no, how is the documented "hardware-bound identities" capability delivered? And would that identity gonna be able to be used by the app / app extension? Thanks!

One of the pain points we have be trying to work around is Safari, and XProtect updates via MDM moving to Declarative. Right now we have a blend of OS update and upgrades via Global Settings or Enforcement Specific Declaration. However, the non OS updates are stuck on MDM commands to install thus admins cannot control install time when using Global Settings with Auto Actions. With the full removal of MDM commands for updates how can we have a flavor of version control and install time with Safari vs. keep to latest and Auto Actions?

I've noticed that there is a tab for Ads in Apple Business and would like to know more about how this would integrate with claiming a business location. As well as uploading photos of the business, what types of features would be rolled out in the future, if it will be a central place to manage business locations? If this is more towards the Maps & Location Q&A or both, please direct this to the correct Q&A section. Thank you

With all of the announcements and improvements to Siri and Apple Intelligence on macOS/iOS/iPadOS 27, organizatiosn continue to decide whether to allow/deny Apple Intelligence in part or in whole. With so much capability for on-device AI, and with new Profiles available to developers to route AI requests to remain on-device versus shipping to Private Cloud Compute, is there any way, undocumented or otherwise where organizations can begin to allow Apple Intelligence on if it's kept on-device only and not have the permission to offload to the cloud of an external AI provider such as ChatGPT?

In domain capture, could you include the option to manually send invitations to users before running the domain capture process for the entire domain? Currently, I see that the option exists, but only for marketing-related accounts.

Hello, Thanks for all these new amazing updates, With the changes regarding the management state not restored anymore from the backup on iOS 27, can we expect the following flow to work: Backup an iPhone, adding it to Apple Business and ADE, and restore the same backup during activation to trigger ADE enrollement while restoring the backup on the device ? Currently when users are migrating a device from unmanaged to managed we have them restore the backup on the buffer device, backup this buffer device and restore that backup on the original iPhone. It would be really helpful when customers are starting to manage existing devices. Thanks

For binary execution control on Endpoint Security — how granular are the code-signing matching rules, and what happens to a denied binary that's already running versus launched fresh? For the consolidated privacy consent prompt — does app.settings replace the privacy preferences we manage today, or coexist with them? Knowing whether it's a clean migration or a parallel system would help our planning. Thanks!