Declarative Device Management (DDM) is a new device management paradigm that allows devices to be autonomous and proactive in their management state. DDM is built on top of Apple’s existing MDM protocol. For more information on Declarative Device Management, see the Tech Zone article A Primer on Declarative Device Management for Apple Devices.
Requirements
- Devices must be running iOS 17 and later.
- Omnissa Workspace ONE UEM modern architecture must be implemented.
Work with your account teams to ensure your Workspace ONE UEM environment has modern architecture implemented. For more information on Workspace ONE UEM modern architecture, see the article here.
Status Channel
The Status Channel provides the means for collecting information from managed devices via Declarative Device Management. The Status Channel is comprised of Status Items, which represent various device attributes. Once subscribed to a Status Item, any time its value changes, a managed device will automatically report the new value to Workspace ONE UEM in near real-time.
Workspace ONE UEM automatically subscribes to all supported Status Items for any managed devices that meet the minimum iOS version requirement. The following is a list of currently supported Status Items and their minimum iOS version requirements.
-
OS Version (iOS 16+)
-
Build Version (iOS 16+)
-
OS Supplemental Build Version (iOS 16.1+)
-
OS Supplemental Build Version Extra (iOS 16.1+)
-
OS Family (iOS 16+)
-
Pending Version (iOS 17+)
- Available in UEM Modern integration with Intelligence (ETLv2)
-
Install State (iOS 17+)
- Available in UEM Modern integration with Intelligence (ETLv2)
-
Install Reason (iOS 17+)
- Available in UEM Modern integration with Intelligence (ETLv2)
-
Failure reason (iOS 17+)
- Available in UEM Modern integration with Intelligence (ETLv2)
-
Battery Health (iOS 17+)
- Available in UEM Modern integration with Intelligence (ETLv2)
-
Passcode Presence (iOS 17+)
- Available in UEM Modern integration with Intelligence (ETLv2)
-
Passcode Compliance (iOS 17+)
- Available in UEM Modern integration with Intelligence (ETLv2)
-
Model Marketing Name (iOS 17+)
- Available in UEM Modern integration with Intelligence (ETLv2)
Declarative Device Management (DDM) App Status Subscriptions
Workspace ONE UEM collects managed application inventory and status information through DDM Status Subscriptions starting with UEM version 2604. Previously, app installation status was collected through the native MDM’s Managed Application List (MAL) sample. This enhancement provides real-time visibility into app installations, removals, and status changes on DDM-enabled iOS devices. The UEM console UI, UEM APIs and all the downstream services such as Intelligence and Freestyle also reflect the app information received through DDM Status.
Declarations
Declarations are payloads that are installed on managed devices. Declarations can be thought of as the successor to profiles. There are four declaration subtypes: Configurations, Assets, Activations, and Management properties. Omnissa Workspace ONE UEM currently supports both Configuration and Asset declaration subtypes.
Configurations
Configurations represent policies that are applied to the device. For example, there are declarative configurations for passcode policy, email, and accounts. Many configurations require assets, so it’s important to create assets prior to configurations.
Declarative Configurations integrate with Apple’s GitHub device management developer documentation. This integration enables Workspace ONE UEM to implement and update configurations significantly faster, and in many cases, without requiring a Workspace ONE UEM console upgrade. This integration will be enabled by phased rollout for Workspace ONE UEM 2410 environments deployed on UEM modern architecture.
Omnissa Workspace ONE UEM supports the following declarations. Scroll horizontally to view all columns in the table.
| Configuration | Description | Apple Docs |
|---|---|---|
| Accessibility Settings | Configures vision accessibility settings on the device. | Accessibility Settings |
| Account:CalDAV | Configures a CalDAV calendar and reminders account for the user. | AccountCalDAV |
| Account:CardDAV | Configures a CardDAV contacts account for the user. | AccountCarddav |
| Account:Exchange | Configures an Exchange ActiveSync account for the user. | AccountExchange |
| Account:Google | Configures a Google account for the user. | AccountGoogle |
| Account:LDAP | Configures an LDAP directory account for the user. | AccountLdap |
| Account:Mail | Configures an email (IMAP/POP) account for the user. | AccountMail |
| Account:Subscribed Calendar | Configures a read-only subscribed calendar for the user. | AccountSubscribedCalendar |
| App:Settings | Configures the dictionary of allowed/managed app settings. | AppSettings |
| Audio Accessory:Settings | Configures audio accessory temporary-pairing behavior. | AudioAccessorySettings |
| Extensible SSO | Configures Extensible Single Sign-On for apps and websites. | ExtensibleSSO |
| External Intelligence Settings | Configures External Intelligence Integrations settings. | ExternalIntelligenceSettings |
| Intelligence Settings | Configures Apple Intelligence features (Genmoji, Image Playground, Writing Tools, etc.). | IntelligenceSettings |
| Keyboard Settings | Configures keyboard behavior such as auto-correction and dictation. | KeyboardSettings |
| Math Settings | Configures the built-in Calculator app and system math behavior. | MathSettings |
| Network:DNS Proxy | Configures a DNS proxy network extension. | NetworkDNSProxy |
| Network:DNS Settings | Configures encrypted DNS server settings. | NetworkDNSSettings |
| Network:Relay | Configures one or more network relay servers. | NetworkRelay |
| Network:VPN:AlwaysOn | Configures a VPN connection using the Always-On sub-type. | NetworkVPNAlwaysOn |
| Network:VPN:IKEV2 | Configures a VPN connection using the IKEv2 sub-type. | NetworkVPNIKEV2 |
| Network:VPN:IPSec | Configures a VPN connection using the IPSec sub-type. | NetworkVPNIPsec |
| Network:VPN:VPN Plugin | Configures a VPN connection using a third-party VPN plug-in. | NetworkVPNVPNPlugin |
| Passcode:Settings | Configures passcode policy requirements (length, complexity, retry limits). | PasscodeSettings |
| Safari:Bookmarks | Pushes a set of managed bookmarks to Safari. | SafariBookmarks |
| Safari:Extension Settings | Configures which Safari extensions are allowed or managed. | SafariExtensionSettings |
| Safari:Settings | Configures general Safari behavior (JavaScript, fraud warnings, history). | SafariSettings |
| Security:Certificate | Installs a certificate on the device via an asset reference. | SecurityCertificate |
| Security:Identity | Installs an identity (certificate + private key) on the device. | SecurityIdentity |
| Siri Settings | Configures Siri availability and feature restrictions. | SiriSettings |
| Software Update:Enforcement:Specific | Forces the device to update to a specific OS version by a deadline. | SoftwareUpdateEnforcementSpecific |
| Software Update:Settings | Configures software update deferral and enforcement behavior. | SoftwareupdateSettings |
| WebContentFilter:Plugin | Configures a plugin-based web content filter. | WebContentFilterPlugin |
Assets
Assets represent user ancillary data needed by configurations. Assets provide information specific to an end user. For example, there are assets for defining user identity, authentication credentials, and certificates. Assets are linked to configurations any time user identity is needed. Assets have a one-to-many relationship with configurations, meaning one asset can be linked to many configurations.
The following are the available assets that Omnissa Workspace ONE UEM supports:
- User Identity (name and email address)
- Data
Configure a Configuration Declaration
Creating and managing Declarative Configurations is similar to creating and managing Profiles. For example, to create and deploy a Passcode Configuration:
- On the UEM console, navigate to Resources > Profiles & Baselines > Profiles > ADD > Add a profile > iOS.
- In the Apple iOS window, select Declarative.
- Select the Declaration Type as Assets or Configurations.
- Select Configuration.
- Select Context as Device. Click Next. A page similar to profile creator is displayed.
- Name the Declaration and choose the Configuration from the dropdown.
- Complete the displayed fields and proceed to assign the Configuration to a Smart Group.
- Click Save and Publish.
Configure an Asset Declaration
Like Declarative Configurations, creating and managing Assets is similar to creating and managing Profiles. For example, to create and deploy the User Identity Asset:
- On the UEM console, navigate to Resources > Profiles & Baselines > Profiles > ADD > Add a profile > iOS.
- In the Apple iOS window, select Declarative.
- Select the Declaration Type as Assets. Click Next.
- Select Context as Device. Click Next. A page similar to profile creation is displayed.
- Name the User Identity asset.
- Complete the fields for Name and Email Address. Click Next.
- Assign a smart group.
- Click Save and Publish.
Configure a Credentials – Username and Password Asset Declaration
The Credentials – Username and Password asset allows IT administrators to securely and remotely provision username and password credentials to managed devices as DDM assets. These credentials can be used by DDM configurations to silently perform authentication without requiring manual user input.
- Navigate to Profiles > List View > Profile> Declaration > Assets.
- Select Add and choose Credentials – Username & Password as the asset type.
- Enter the Username and password.
- The dependent DDM configurations that use this asset automatically have the asset dependency injected at publish time — no manual linking step is required.
- Review the OS version tags (iOS/iPadOS 15+) to confirm device compatibility.
- Save the asset.
After saving, you can perform the following actions on a Credentials – Username and Password asset:
- Edit or delete the asset
- Assign or unassign the asset to devices or users
- Track deployment status
- Deactivate or copy the asset
Was this page helpful?