Declarative Device Management (DDM)

Declarative Device Management (DDM) is a new device management paradigm that allows devices to be autonomous and proactive in their management state. DDM is built on top of Apple’s existing MDM protocol. For more information on Declarative Device Management, see the Tech Zone article A Primer on Declarative Device Management for Apple Devices and Apple's documentation here.

Requirements

• Devices must be running macOS 14 and later.
• Omnissa Workspace ONE UEM modern architecture.

Work with your account teams to ensure your Workspace ONE UEM environment has modern architecture implemented. For more information on Workspace ONE UEM modern architecture, see the article here.

Status Channel

Workspace ONE UEM now supports the following status items via Declarative Device Management (DDM). For eligible devices, Workspace ONE UEM will automatically receive these attributes as they change on managed macOS devices.

• OS Version (macOS 13+)
• Build Version (macOS 13+)
• OS Supplemental Build Version (macOS 13+)
• OS Supplemental Build Version Extra (macOS 13+)
• OS Family (macOS 13+)
• Pending Version (macOS 14+) (Available only in Omnissa Intelligence)
• Install State (macOS 14+) (Available only in Omnissa Intelligence)
• Install Reason (macOS 14+) (Available only in Omnissa Intelligence)
• Failure reason (macOS 14+) (Available only in Omnissa Intelligence)
• Battery Health (macOS 14.4+)
• Model Marketing Name (macOS 14.4+)

Declarations

Declarations are payloads that are installed on managed devices. Declarations can be thought of as the successor to profiles. There are four declaration subtypes: Configurations, Assets, Activations, and Management properties. Omnissa Workspace ONE UEM currently supports Configuration declaration subtype.

Configurations

Configurations represent policies that are applied to the device. We now have User Context and Device Context declarative configurations.

User Context Configurations

Workspace ONE UEM supports the following User Context Configurations:

• Account: CalDAV
• Account: CardDAV
• Account: LDAP
• Account: Mail
• Account: Subscribed Calendar
• Math Settings
• Passcode: Settings
• Screen Sharing: Connection
• Safari: Bookmarks

Device Context Configurations

Workspace ONE UEM supports the following Device Context Configurations:

• Disk Management: Settings
• Passcode
• Screen Sharing: Connection
• Screen Sharing: Host Settings
• Software Update Enforcement
• Software Update: Settings

Configure a Configuration Declaration

Configurations are similar to the current profile payloads used to configure email accounts, passcodes, restrictions, etc. They refer to the policies to be applied to a device. For more information, refer to Configuration Example in Apple documentation.

To create any configuration:

1. On the UEM console, navigate to Resources > Profiles & Baselines > Profiles > ADD > Add a profile > macOS.
2. In the Apple macOS window, select Declarative.
3. Select the Declaration Type as Configurations.
4. Select Configuration.
5. Select Context as Device. Click Next. You may also select Context depending on the type of configuration you want. A page similar to profile creation is displayed.
6. Name the Declaration and choose the configuration from the dropdown.
7. Enter the details specific to the configuration and assign them to a smart group.
8. Click Save and Publish.

Assets

Assets are reusable data referenced by configurations to provide user-specific information. They represent ancillary data such as user identity, authentication credentials, and certificates. Each asset can be linked to multiple configurations that allows efficient reuse of user data across different configuration contexts.

The following are the available assets that Omnissa Workspace ONE UEM supports:

• User Identity
• Data
• Credentials - Username and Password

Configure an Asset Declaration

Creating and managing Declarative Configurations is similar to creating and managing Profiles.

1. On the UEM console, navigate to Resources > Profiles & Baselines > Profiles > ADD > Add a profile > macOS.

2. In the Apple macOS window, select the following:

   • Management Type: Declarative
   • Declaration Type: Assets
   • Context: Device or User

3. Click Next.

Note: The steps above are common to all asset types. The subsequent configuration options vary depending on the asset type you select.

After saving, you can perform the following actions on an asset:

• Edit or delete the asset
• Assign or unassign the asset to devices or users
• Track deployment status
• Deactivate or copy the asset

Configure an User Identity Declaration

The User Identity asset allows IT administrators to provision user-specific identity information, such as full name and email address, to managed devices as DDM assets. This information can be referenced by DDM configurations to personalize device settings and ensure accurate user attribution across managed environments.

1. Complete the steps as described in Configure an Asset Declaration.
2. Name the Declaration and choose User Identity Asset from the dropdown.
3. In the Full Name field, select a lookup value.
4. In the Email address field, select a lookup value.
5. Click Next and proceed to assign the Asset to a Smart Group.
6. Click Save and Publish.

Configure a Data Asset Declaration

Workspace ONE UEM allows you to upload and deploy Data Assets for macOS devices using Declarative Device Management. A Data Asset is a data file, such as a ZIP, PLIST, or XML file, that can be referenced by applicable declarative configurations. By uploading Data Assets, you can distribute necessary configuration files and background tasks to your managed iOS devices.

1. Complete the steps as described in Configure an Asset Declaration.
2. Name the Declaration and choose Data Asset from the dropdown.
3. In the Data Asset section, select Upload and choose the file from your local system. Upload reference data (JSON, scripts, etc.) to create a reusable data asset for your declarative configurations.
4. Click Next and proceed to assign the Asset to a Smart Group.
5. Select Save and Publish to store the Data Asset.

Configure a Credentials – Username and Password Asset Declaration

The Credentials – Username and Password asset allows IT administrators to securely and remotely provision username and password credentials to managed devices as DDM assets. These credentials can be used by DDM configurations to silently perform authentication without requiring manual user input.

1. Complete the steps as described in Configure an Asset Declaration.
2. Name the Declaration and choose Credentials – Username & Password as the asset type.
3. Enter the Username and password.
4. Click Next and proceed to assign the Asset to a Smart Group.
5. Select Save and Publish.