Each year, Apple's operating system releases introduce changes that affect how organizations manage their Apple device fleets. With WWDC 2026, Apple has announced many new capabilities coming to iOS 27, iPadOS 27, macOS 27, tvOS 27, and visionOS 27 this fall. This article provides an early look at what's new and what IT administrators and Omnissa Workspace ONE customers should be thinking about as they prepare for the upcoming release cycle.
The theme for 2026 is continued investment in Declarative Device Management (DDM). Apple is consolidating more of its legacy MDM protocol capabilities into the declarative model, a shift that has been underway since DDM was introduced. This year's additions are notable both for the breadth of configurations being migrated and for several genuinely new management capabilities, particularly around security, observability, and authentication.
The information provided below documents the new enterprise-related updates and features announced in Apple’s WWDC information sessions. You can access these sessions at your convenience through Apple’s Developer Program website https://developer.apple.com/wwdc26/.
Bookmark this page! In the coming weeks, we’ll update this article, adding more details as they become available. Although beta releases are not supported with Omnissa Workspace ONE UEM, we are currently testing to ensure backward compatibility with existing Workspace ONE UEM features upon software upgrade launch in Q3 2026.
Increased network security requirements
iOS 27, iPadOS 27, macOS 27, tvOS 27, and visionOS 27 introduce stricter network security requirements for certain system processes. These requirements will be fully supported by Workspace ONE cloud infrastructure, but any administrators leveraging on-premise infrastructure should ensure that their servers and configurations support:
- TLS 1.2+
- Key exchange algorithms that meet Apple's minimum specifications
- Certificates that meet App Transport Security requirements for key size, signature algorithm, and validity.
For more information, see the Apple Support article Prepare your network environments for stricter security requirements.
Network configurations via DDM
One of the most significant changes in 2026 is the addition of credential-reliant network configurations into declarative management. Previously, configurations like VPN, DNS settings, and content filters could only be managed using Imperative profiles that bundled credential data directly into the payload. The new model separates the credential (delivered as a declarative asset) from the configuration itself, leveraging DDM's ability to handle dependencies and updates more cleanly. These new configurations also provide the ability for multiple distinct configurations to reference the same asset, allowing for streamlined management of any underlying certificate or identity assets.
The following configuration types can be managed through DDM in the version 27 releases:
- DNS Proxy
- DNS Settings
- Network Relay
- VPN: Always-On
- VPN: IKEv2
- VPN: IPSec
- VPN: Plugin
- Web Content Filter
For Workspace ONE customers, this means that over time, the recommended path for deploying these configurations will shift to the declarative model. Existing Imperative profiles will continue to function, but organizations should begin exploring these declarative configurations where applicable.
Status reporting enhancements
Apple continues to expand the set of device attributes available through the declarative status channel, reducing the need for MDM servers to issue explicit query commands. This year, several new items are being brought into the DDM status framework:
- MDM Enrollment Type
- Device Configured for Return to Service
- Device is a Shared iPad
- MDM Protocol Push Magic
- MDM Protocol Push Token
- Device Awaiting Configuration
- Lockdown Mode status
- System health (iPhone and iPad)
The system health status item provides insight into the status and genuineness of certain hardware components for iPhones and iPads:
- Baseband
- Camera
- Display
- Face ID
- NFC
- Touch ID
- Ultra-Wideband
Return to Service enhancements
Apple introduced several enhancements to Return to Service (RTS) in iOS/iPadOS 27 and visionOS 27 that improve the experience for shared device deployments. Users can now initiate RTS directly from Control Center, and administrators can configure it to launch automatically after a period of inactivity using the TemporarySessionTimeout key in the SharedDeviceConfiguration command, eliminating the need for manual admin intervention between user sessions. IT administrators can also preset device language and region as part of the enrollment profile using language and region keys, reducing the manual configuration steps required after each reset. A new ShouldRetryEnrollment key enables the device to automatically retry enrollment with increasing delays of up to five minutes if the initial enrollment attempt fails post-reset. Finally, when issuing an RTS erase command, administrators can now enforce a software update, with the device completing the OS update automatically before returning to service.
AppleCare log collection
Diagnosing issues on managed devices has historically required either hands-on access to the device or coordination with the end user to manually capture and share logs. Apple is changing this with a new remote log collection capability that integrates directly with Apple's support infrastructure.
When AppleCare support engages with an organization's IT team, they can provide an enhanced logging token. The IT administrator uses a new TriggerEnhancedLogCollection MDM command to send that token to the affected device, which then initiates the logging process. The device collects diagnostic logs, prompts the user for consent as needed, and uploads the results directly to Apple's support servers. Service devices and unattended equipment can use a variant of the flow that does not require on-device user interaction.
Note: AppleCare Enterprise agreement is required to test this feature.
Content caching configuration via DDM
Apple's content caching service, which allows organizations to reduce bandwidth usage by caching Apple software updates, app downloads, and iCloud content locally on the network, is moving to declarative management. The new com.apple.configuration.content-cache.settings declaration replaces the legacy configuration profile and introduces a corresponding set of status items to report on:
- Service Information
- Parent Caches
- Peer Caches
- Service Status
A notable new capability in this update is the ability for content cache servers to push their own status reports to an arbitrary HTTPS endpoint. This opens the door for organizations to build custom monitoring dashboards or integrate caching service health data into existing observability platforms.
ManagedApp framework comes to macOS
Last year, Apple released the ManagedApp framework for iOS, iPadOS, and visionOS. This framework defines a secure method to deploy app-specific configurations and secrets, such as user identities and certificates, in order to customize the app behavior and streamline the user experience. Each of these components can be defined as a DDM Asset, and deployed to the app through the DDM configuration. Keep in mind that the ManagedApp framework must be supported by an app before settings can be deployed and managed. For apps that do not yet support the ManagedApp framework, the legacy AppConfig framework can continue to be used.
With macOS 27, this framework is now available for macOS apps, leveraging the existing DDM configurations.
Native management for blocking apps and binaries
Apple is bringing application allowlist and denylist controls to declarative management on macOS, using the Endpoint Security framework to enforce binary execution policies. The new capability, surfaced through the com.apple.configuration.app.settings declaration, provides granular control over which binaries are permitted to run on a managed Mac. While Workspace ONE has long supported similar functionality through the Intelligent Hub, this provides an MDM-native approach to restrict which applications can run on a managed device.
Additionally, app launch restrictions that were previously only available in the Imperative profile framework have also been consolidated into this declaration for iOS, iPadOS, tvOS, and visionOS.
Privacy management for apps
Handling app permission prompts at scale, particularly for newly enrolled devices or freshly installed apps, has long been a friction point for both IT administrators and end users. Apple is addressing this with a new privacy management capability that allows IT administrators to pre-configure permission defaults for specific apps as part of a declarative configuration.
Using the Privacy key within the com.apple.configuration.app.settings declaration, administrators can specify defaults for the following privacy components:
- Accessibility
- Bluetooth
- Camera
- Dictation
- Local Network
- Location
- Location Accuracy
- Microphone
When the app is first launched, it checks the configuration for any privacy defaults that have not yet been granted and presents a single consolidated consent prompt showing the organization's name, the app's name, an admin-provided justification string, and the specific permissions being requested. The prompt offers an Allow button and a Not Now option. If the user taps Allow, the configured defaults are applied immediately. If they choose Not Now, standard system-level consent prompts appear on first use.
Privacy management for websites in Safari
The same privacy management model described above for apps extends to websites in Safari. Using the new Privacy key in the com.apple.configuration.safari.settings configuration, IT administrators can pre-configure default permissions for specific websites covering the following components:
- Camera
- Microphone
When Safari first opens a configured website, it checks the privacy defaults and, if any permissions have not yet been granted, displays a single consent prompt identifying the organization, the website, and the components involved along with an admin-provided justification string. The user can Allow or defer with "Not Now." If deferred, the user will receive subsequent prompts if the website later requires the same access.
Volume purchase app subscriptions
In the future, it will be possible for IT administrators to purchase and manage app subscriptions directly in Apple School Manager and Apple Business. These subscriptions can be assigned directly to users via device management, using a similar process to assign purchased applications and books.These app subscriptions can only be assigned to a user, and cannot use device-based assignment.
This capability will require support from each individual app. For more information, see the WWDC26 session Offer subscriptions to groups and organizations.
Platform SSO enhancements
Platform SSO continues to evolve in 2026. The full Extensible Single Sign-On payload, including the new capabilities below, will be available in DDM with the com.apple.configuration.extensible-sso configuration.
Web Authentication
Platform SSO now supports a web-based authentication flow using OpenID Connect, enabling identity providers to deliver modern, non-phishable authentication methods including passkeys and advanced MFA flows through the macOS login experience. QR code based authentication is supported as part of this, using the built-in camera to securely capture QR code data provided by the identity provider without exposing sensitive camera images. If web-based authentication is unavailable, administrators can define a grace period to support authentication with the local account password.
MFA with Touch ID
Platform SSO can now require Touch ID (or Apple Watch) as a mandatory second factor for login, unlock, and FileVault policies individually. Administrators can define whether to allow web authentication as a fallback when biometric authentication is unavailable.
FileVault for Authenticated Guest Mode
Authenticated Guest Mode, which allows users to log in to a temporary macOS session using organizational credentials without a pre-existing local account, can now be used alongside FileVault. Note that the Mac must have an active internet connection to access the configured IDP for authentication.
DDM is now the expectation for managing software updates
Today, Apple software updates are fully manageable with DDM through the use of the Software Update Enforcement Specific declarative configuration. In the upcoming version 27 releases, Apple is fully deprecating support for the legacy ScheduleOSUpdate MDM commands, as well as other related commands and profile settings, in favor of the DDM approach.
While today Workspace ONE UEM supports both the Software Update Enforcement Specific configuration and the Software Update Settings configuration as Device Profiles, further updates to the built-in Device Updates dashboard will make the transition to DDM-based software update management simpler for any administrators that currently leverage those legacy commands to manage updates on their devices.
Summary
Upon release later this fall, iOS 27, iPadOS 27, macOS 27, tvOS 27, and visionOS 27 will contain many new features that collectively enhance the scalability, security, and efficiency of managing Apple devices in business environments. While this article describes many notable features that were announced by Apple in these upcoming releases, we also recommend reviewing Apple's content directly for additional depth on these capabilities, as well as information on additional changes that weren't included here.
For more information on Apple’s new enterprise features, check out the following WWDC 26 session: What’s new in managing Apple devices. Review Apple's Intro to What's New for IT at WWDC26 for more details on these announcements and other recently released capabilities.
If you would like to dig in on all the products and features Omnissa offers to help you manage Apple devices at scale, please visit https://www.omnissa.com/apple.
Workspace ONE App and Feature Support
The Omnissa team will be working to validate support for Apple's 27 releases in each Workspace ONE native app. As the minimum supported version of each app is validated, this article will be updated.
- Intelligent Hub
- Boxer
- Content
- Web
- Tunnel
- Assist
- PIV-D Manager
- Intelligence SDK
- SDK (Swift)
- Send
- Mobile Threat Defense
- Employee Experience (DEEM)
For questions about Omnissa Workspace ONE and Apple device management, visit the Omnissa Tech Zone or contact your Omnissa account team.
Was this page helpful?