Apple Declarative Device Management (DDM) is now the standard for device management across Apple platforms. As part of this transition, Apple is retiring legacy software update controls in iOS 27, iPadOS 27, macOS Golden Gate, watchOS 27, visionOS 27, tvOS 27 and later releases. This is just one of several platform changes arriving this fall that could impact how your team manages and secures Apple devices.
The good news? Ivanti has supported Declarative Device Management for more than a year, giving customers a headstart on Apple's transition and the modern management capabilities that come with it. Here's what you need to know, what's changing and the steps you should take to prepare.
Apple Intelligence and Apple Foundation Models: WWDC 2026 AI announcements
WWDC 2026, Apple’s 37th Worldwide Developer’s Conference, introduced a rebuilt AI foundation developed in collaboration with Google’s Gemini technology. Apple now ships four models: Two run entirely on-device, including a new multi-modal model for text and images, and two run through Private Cloud Compute for more demanding tasks, with cryptographic guarantees that no data is stored or logged. That means AI that works offline, costs nothing per use and creates no data residency obligations. Apple has also opened a unified API to third-party models like Claude and Gemini, giving your development teams a single integration path rather than separate integrations for each provider.
Ivanti Neurons for MDM gives administrators the controls to allow or restrict them by device group, so the right capabilities reach the right people, without applying blanket policies across your entire organisation.
Declarative device management in Apple OS 27
Legacy device management sent commands and hoped they stuck. Declarative device management (DDM) works differently: you express the desired state, and the device takes ownership of reaching and maintaining it, self-correcting without being asked.
This extends DDM to cover VPN, DNS, network relay, content filtering, certificates, app management and more, making it the primary management path rather than an optional layer.
IT teams still on legacy configuration profiles will start to feel the gaps when OS 27 lands. Ivanti Neurons for MDM has been implementing DDM ahead of each Apple release.
We’re ready, and we can help you understand what migrates automatically and what needs attention before OS 27 releases this fall.
Apple OS 27 software update changes for enterprise IT
Apple OS 27 removes legacy software update management entirely, with no grace period. If your device groups don’t yet have a Software Update Enforcement configuration and a Software Update Settings configuration in Ivanti Neurons for MDM, create them now. Both are built on the declarative model and take minutes to set up. Once in place, your update enforcement carries forward into OS 27 and every release after it.
If you’re not sure where you stand, reach out to your Ivanti account team, and we’ll help you confirm your posture before fall.
Apple OS 27 security updates: hardware integrity and compliance
macOS 27 gives IT teams something genuinely new: the ability to verify hardware component integrity before a device goes back into circulation. When a Mac or iPhone comes back from an employee, Ivanti Neurons for MDM can now confirm whether any internal components (camera, Face ID, Touch ID, NFC) have been swapped outside an authorised service channel. For IT teams managing shared device programmes or strict compliance requirements, this adds a verifiable checkpoint to the device lifecycle that previously required a manual inspection or an Apple Store visit.
App management updates in iOS 27 and macOS 27
OS 27 changes how apps are deployed, controlled and licenced in ways your IT team will notice immediately.
The most visible change is how permission prompts work. Today, employees are hit with a series of blind permission requests when they first open a managed app — camera, microphone, location — with no explanation of why the business needs them. Many deny instinctively, the app breaks, and IT gets a call.
In iOS 27 and iPadOS 27, IT can pre-declare the permissions a managed app requires as part of the MDM deployment. The employee sees one clear, prompt that provides the business context. One tap. Done.
macOS 27 also introduces native binary and application control at the OS level. IT declares which applications and executables are allowed to run on a managed Mac. When a denied binary is encountered, the OS terminates it immediately, with no prompt or warning to the user. What previously required a dedicated endpoint security product is now built into macOS and managed through Ivanti Neurons for MDM.
Apple is also introducing volume purchasing for App Store subscriptions this fall, a change that IT teams managing licences through Apple Business Manager have been waiting for. Subscriptions have never been part of volume purchasing until now. Your team can purchase auto-renewable subscriptions in bulk and assign them to employees through MDM, the same way app licences work today. Subscriptions follow the user across devices and renew under your organisation’s account. Your employees won’t need personal payment methods or individual App Store credentials.
Faster support with enhanced diagnostic logging
Across iPhone, iPad, Mac and Apple TV, Ivanti Neurons for MDM can now trigger diagnostic log collection remotely from the console, routing logs directly to Apple’s support infrastructure without any involvement from the device user. For customers with an AppleCare Enterprise agreement, this creates a direct, fast-moving support channel between your fleet, Ivanti and Apple. Issues that previously took days to diagnose can now be resolved the same day.
macOS 27: the Most Management-Rich Release Yet
Content caching now reports health status directly to the MDM console, so you don’t discover a failed caching service when a fleet update slows to a crawl. Managed Migration Assistant preserves enrollment and device configuration when employees move to a new Mac. A unified declarative configuration replaces the overlapping stack of legacy profiles that’s accumulated over years of Apple releases — covering app management and privacy permissions in one place, with binary control included. Ivanti handles this consolidation for you.
What WWDC 2026 means for your Apple device management
OS 27 is the most management-significant Apple release in years. The shift to declarative management is complete; hardware integrity verification is real and on-device AI is now something IT either governs or doesn’t. The gap between teams that are prepared and teams that aren’t will show up quickly after the OS ships.
If you're evaluating your Apple device management strategy ahead of OS 27, reach out to your Ivanti representative. We’ll help you understand how Ivanti Neurons for MDM positions your organisation for this release and the ones that follow. We can walk through your current configuration, identify what carries forward automatically and flag anything that needs attention before the fall. The earlier that conversation happens, the less you’ll have to scramble when the update lands.
FAQs
What was announced at Apple WWDC 2026?
Apple WWDC 2026 announcements introduced on-device AI with IT policy controls, a complete declarative device management architecture across all configuration surfaces and the removal of legacy software update management in Apple OS 27 — with no grace period. Ivanti Neurons for MDM supports all these apple device management updates 2026 at launch.
What are the key enterprise features in iOS 27 and macOS 27?
Key iOS 27 enterprise features include IT-pre-declared app permissions, volume purchasing for App Store subscriptions through Apple Business Manager and remote diagnostic log collection. macOS 27 adds native binary and application control through MDM, hardware component integrity verification, and a unified declarative configuration that replaces overlapping legacy profiles.
What is declarative device management in Apple OS 27?
Declarative device management (DDM) lets IT declare a desired device state and the device self-corrects to maintain it — no repeated MDM commands required. In Apple OS 27, DDM becomes the primary management path, covering VPN, DNS, certificates, app management, and more, replacing legacy configuration profiles.
How does Apple Intelligence impact enterprise device management?
Apple Intelligence enterprise management in OS 27 puts AI model access under IT policy control through MDM, covering both on-device models and Private Cloud Compute options with cryptographic data protection guarantees. Ivanti Neurons for MDM lets administrators allow or restrict these models by device group from day one.
How should IT teams prepare for Apple OS 27 updates?
The most urgent step is creating Software Update Enforcement and Software Update Settings configurations in your MDM platform now — Apple OS 27 removes legacy update management with no grace period. Ivanti customers can contact their account team to confirm their configuration posture before fall 2026.
