Declarative Device Management (DDM)

Declarative Device Management (DDM) is a new device management paradigm that allows devices to be autonomous and proactive in their management state. DDM is built on top of Apple’s existing MDM protocol. For more information on Declarative Device Management, see the Tech Zone article A Primer on Declarative Device Management for Apple Devices.

Requirements

• Devices must be running iOS 16 and later.
• Workspace ONE UEM modern architecture must be implemented.

Work with your account teams to ensure your Workspace ONE UEM environment has modern architecture implemented. For more information on Workspace ONE UEM modern architecture, see the article here.

Declarations

Declarations are payloads that are installed on managed devices. Declarations can be thought of as the successor to profiles. There are four declaration subtypes: Configurations, Assets, Activations, and Management properties. Workspace ONE UEM currently supports both Configuration and Asset declaration subtypes.

Configurations

Configurations represent policies that are applied to the device. For example, there are declarative configurations for passcode policy, email, and accounts. Many configurations require assets, so it’s important to create assets prior to configurations.

Assets

Assets represent user ancillary data needed by configurations. Assets provide information specific to an end user. For example, there are assets for defining user identity, authentication credentials, and certificates. Assets are linked to configurations any time user identity is needed. Assets have a one-to-many relationship with configurations, meaning one asset can be linked to many configurations.

The following are the available declarations that Workspace ONE UEM supports:

Configurations

• Passcode 
• CalDAV 
• CardDAV 
• LDAP 
• Calendar Subscriptions 
• Exchange 
• Email 
• Google Account

Assets

• User Identity (name and email address)

Configure a Configuration Declaration

Creating and managing Declarative Configurations is similar to creating and managing Profiles. For example, to create and deploy a Passcode Configuration:

1. On the UEM console, navigate to Resources > Profiles & Baselines > Profiles > ADD > Add a profile > iOS.
2. In the Apple iOS window, select Declarative.
3. Select the Declaration Type as Assets or Configurations.
4. Select Configuration.
5. Select Context as Device. Click Next. A page similar to profile creator is displayed.
6. Name the Declaration and choose Passcode from the dropdown.
7. Complete the displayed fields and proceed to assign the Passcode Configuration to a Smart Group.
8. Click Save and Publish.

Configure an Asset Declaration

Like Declarative Configurations, creating and managing Assets is similar to creating and managing Profiles. For example, to create and deploy the User Identity Asset:

1. On the UEM console, navigate to Resources > Profiles & Baselines > Profiles > ADD > Add a profile > iOS.
2. In the Apple iOS window, select Declarative.
3. Select the Declaration Type as Assets. Click Next.
4. Select Context as Device. Click Next. A page similar to profile creation is displayed.
5. Name the User Identity asset.
6. Complete the fields for Name and Email Address. Click Next.
7. Assign a smart group.
8. Click Save and Publish.

Create a Google Account Configuration

Some Configurations require Assets. For example, the Google Account Configuration requires the User Identity Asset.

To create and deploy the Google Account Configuration:

1. On the UEM console, navigate to Resources > Profiles & Baselines > Profiles > ADD > Add a profile > iOS.
2. In the Apple iOS window, select Declarative.
3. Select the Declaration Type as Configuration. Click Next.
4. Select Context as Device. Click Next.
5. Complete the Account Name field and User Identity Asset Reference by selecting the Asset you have created earlier.
6. Click Next.
7. Assign a smart group. You can view the referenced Asset and Smart groups in the preview.
8. Click Save and Publish.