Getting Ready for Apple Major OS Releases 2024

Apple's Worldwide Developers Conference (WWDC) 2024 has brought a number of exciting updates and features to all major platforms. During the opening keynote, Apple announced macOS 15, iOS 18, iPadOS 18, tvOS 18, and visionOS 2. In addition to showcasing many impressive consumer features, Apple announced important enhancements coming to their device management protocol as well as Apple Business Manager and Apple School Manager.

The information provided below documents the new enterprise-related updates and features announced in Apple’s WWDC information sessions. You can access these sessions at your convenience through Apple’s Developer Program website https://developer.apple.com/wwdc24/.

Beta releases are not supported with Omnissa Workspace ONE UEM. We are currently testing the beta releases to ensure backwards compatibility with existing Workspace ONE UEM features upon software upgrade launch in Q3 2024.

Note: This article does not indicate support for any of the below features with Workspace ONE UEM.

Apple Intelligence

Apple announced exciting new generative AI features, coming later this year to iOS 18, iPadOS 18, and macOS 15. Apple has announced they will be providing device management controls for various Apple Intelligence features as they become generally available.

New Restrictions capabilities by Apple to control the following Apple Intelligence features:

Genmoji
- Supported on iOS 18, iPadOS 18 & macOS 15
- Requires supervision
Image Playground
- Supported on iOS 18, iPadOS 18 & macOS 15
- Requires supervision
Image Wand
- Supported on iOS 18 and iPadOS 18
- Requires supervision
Writing tools
- Supported on iOS 18, iPadOS 18 & macOS 15
- Requires supervision
Personalized handwriting
- Supported on iOS 18 and iPadOS 18
- Requires supervision
Mail Summary
- Supported on iOS 18.1, iPadOS 18.1, & macOS 15.1
- Requires supervision
External intelligence integrations
- Supported on iOS 18.2, iPadOS 18.2, & macOS 15.2
- Apple states that on iOS, this restriction is temporarily allowed on unsupervised and user enrollments. In a future iOS release, this restriction will require supervision, and will be ignored on non-supervised devices.
External intelligence integrations sign-in
- Supported on iOS 18.2, iPadOS 18.2, & macOS 15.2
- Requires supervision
Notes Transcription Summary
- Supported on iOS 18.3, iPadOS 18.3, & macOS 15.3
- Requires supervision
Visual Intelligence Summary
- Supported on iOS 18.3 and iPadOS 18.3

We are actively working on implementing these new Restrictions in our Profile builder. In the meantime, these Restrictions can be applied via Custom Settings payload. See below for XML:

<dict>
        <key>allowGenmoji</key>
        <false/>
        <key>allowImagePlayground</key>
        <false/>
        <key>allowImageWand</key>
        <false/>
        <key>allowPersonalizedHandwritingResults</key>
        <false/>
        <key>allowWritingTools</key>
        <false/>
        <key>allowMailSummary</key> 
        <false/>
        <key>allowExternalIntelligenceIntegrations</key> 
        <false/>      
        <key>allowExternalIntelligenceIntegrationsSignIn</key> 
        <false/>
        <key>allowVisualIntelligenceSummary</key> 
        <false/>      
        <key>allowNotesTranscriptionSummary</key> 
        <false/>         
        <key>PayloadDisplayName</key>
        <string>Restrictions</string>
        <key>PayloadDescription</key>
        <string>iOS 18 Intelligence Restrictions</string>
        <key>PayloadOrganization</key>
        <string></string>
        <key>PayloadType</key>
        <string>com.apple.applicationaccess</string>
        <key>PayloadUUID</key>
        <string>a9f1b84e-7795-4f47-bcfa-e6334668bce1</string>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadIdentifier</key>
        <string>8141u59a-423c-4f76-a3c6-f785d46eb6db.Restrictions</string>
</dict>

Apple Business Manager and Apple School Manager Updates

Domain Capture and Account Transfer

Organizations can now enforce the creation of Managed Apple Accounts for their domains, capturing personal Apple Accounts that try to use the organization’s domain. Previously this was only possible by integrating with an identity provider (IdP). Users can transfer their existing personal Apple Account to a Managed Apple Account or change their existing email address.

Activation Lock Management

New features allow admin users with device management privileges to turn off Activation Lock for organization-owned devices, directly from Apple Business Manager and Apple School Manager.

Support for Apple Watch and Apple Vision Pro

Apple Watch and Apple Vision Pro devices can now be managed within Apple Business Manager and Apple School Manager, allowing the use of the new Activation Lock capabilities and existing Automated Device Enrollment enrollment options.

Device Management Updates

Safari Extensions Management

Apple’s declarative device management now supports a new configuration for Safari extensions management. This configuration is only available on supervised devices. Organizations can control which Safari extensions are allowed, always on, or always off, extending to both standard and Private Browsing modes.This configuration will be available for devices running iOS 18, iPadOS 18, and macOS 15.

Software Update Management

In addition to the existing Software Update Enforcement configuration, Apple’s declarative device management now supports a Software Update Settings configuration. This configuration allows for control over various update-related settings, including:

Automatic software update behavior
Rapid Security Response behavior
Deferral of software update (1-90 days)
Whether local administrator authorization is required to perform an update for macOS
Enrollment into beta programs (support for macOS later this year)
The default notification behavior when enforcing software updates
The visibility (recommended cadence) of software updates (iOS and iPadOS only)
Beta program registration and management

This configuration will be available for devices running iOS 18, iPadOS 18, and macOS 15.

New APIs and Hardware Requirements

Apps and Books for Organizations API: Developers can retrieve information about apps and books with visionOS compatibility.
Managed Device Attestation: Attestions will only be issued to devices that meet the following hardware requirements
- iPhones, iPads, and Apple TVs now require an A11 Bionic chip or later
- Mac computers now require Apple silicon (M1 and above)

macOS Management Enhancements

Passkey and Security Key Support

Automated Device Enrollment on macOS 15 will now support WebAuthN for web authentication, providing support for security keys and passkeys for enrollment authentication.

Platform Single Sign-On (SSO)

Platform SSO has been enhanced with macOS 15 to require IdP authentication when accessing FileVault, the Lock Screen, and the login window. Optional configurations for Touch ID or Apple Watch unlock are also available.

External Storage Management

A new disk management declarative configuration allows managed access to external and network storage and can enforce read-only volume mounting for enhanced data control.

iOS and iPadOS Management Features

Hiding and Locking Apps

iOS 18 and iPadOS 18 introduce options to require biometric authentication or a passcode to open apps and to hide apps from the Home Screen. MDM will be able to control these features on a per-app basis (managed apps only) or disable them entirely on supervised devices. Apple is bringing these restrictions to the MDM protocol later this year.

In-House App Installations

With iOS 18 and iPad 18, proprietary in-house apps now require a device restart to trust the provisioning profile. This does not apply to applications deployed via MDM.

New Restrictions

iOS 18, iPadOS 18, and macOS 15 now support new Restrictions keys for the following features:

eSIM Outgoing Transfer
- Supported on iOS 18 and iPadOS 18
- Requires supervision
Force eSIM Preservation on Erase
- Supported on iOS 17.2 and iPadOS 17.2
- Requires supervision
iPhone mirroring
- Supported on iOS 18, iPadOS 18 & macOS 15
- Requires supervision
Video Conferencing Remote Control
- Supported on iOS 18 and iPadOS 18
- Requires supervision
Hiding Apps
- Supported on iOS 18.1 and iPadOS 18.1
- Requires supervision
Locking Apps
- Supported on iOS 18.1 and iPadOS 18.1
- Requires supervision
Call Recording
- Supported on iOS 18.1 and iPadOS 18.1
- Requires supervision
RCS Messaging
- Supported on iOS 18.1 and iPadOS 18.1
- Requires supervision
Default browser modification
- Supported on iOS 18.2 and iPadOS 18.2
- Requires supervision