What’s Actually Changing

Starting with the OS 27 generation — iOS 27, iPadOS 27, macOS 27, tvOS 27, watchOS 27, and visionOS 27, all shipping this fall — Apple is removing the legacy MDM commands that many organizations have used for years to push, defer, and enforce software updates. Update queries, deferral controls, and recommended-cadence settings built on the old model simply stop functioning once a device is running OS 27. There’s no fallback, no compatibility window — it’s a hard cutover.

In their place, Apple wants everyone on Declarative Device Management (DDM) — specifically, Software Update Enforcement and Software Update Settings configurations. This has actually been in motion for a couple of years now, but OS 27 is the release where the training wheels come off.

Why “Declarative” Actually Matters (Not Just Jargon)

The old MDM model worked by your management server sending a command and waiting to hear back — check in, confirm, repeat. It’s chatty, and it breaks down at scale or when devices are offline. Declarative management flips that: the device itself is handed a set of rules and evaluates them locally, reporting status back on its own terms. For update enforcement specifically, that means more reliable compliance, better visibility into where a device actually stands, and less dependency on a device being online and checking in at exactly the right moment.

It’s a legitimately better architecture. But “better” doesn’t mean the migration takes care of itself.

It’s Not Just Software Updates

A few other changes worth knowing about, since they’re easy to miss if you’re only scanning for the headline item:

• Network configuration is moving to DDM too — VPN, encrypted DNS, and relay settings are shifting into the declarative model.
• App restriction lists are being deprecated, starting in visionOS 27, in favor of declarative app management.
• Stricter TLS requirements apply to select system processes handling management traffic on OS 27 devices.
• Legacy configuration profiles can still be delivered during the transition — Apple added a way to deploy them as declarative assets — but this is a bridge, not a permanent solution.

None of these are as urgent as the software update change, but they’re all pointing in the same direction: if your MDM strategy hasn’t fully moved to declarative management yet, this fall is the deadline that actually forces the issue.

What To Do Before OS 27 Ships

Audit your current setup now. Check whether your device groups have Software Update Enforcement and Software Update Settings configurations in place. If they don’t, or if you’re not sure, that’s the first gap to close.

Confirm your MDM vendor is ready. This part is genuinely good news if you’re on Jamf — they’ve committed to supporting declarative software updates even for on-premises installations, which otherwise would have been left without a path forward. Worth checking directly with your MDM vendor either way, since not every platform has handled this transition the same way.

Don’t wait for devices to update on their own. Once a device is running OS 27, the legacy enforcement is simply gone — there’s no soft landing. Test your declarative configurations on a small device group well before OS 27 becomes the default install for new devices coming through zero-touch enrollment.

The Bottom Line

This isn’t a flashy Apple announcement, which is exactly why it’s easy to miss. But for any organization managing more than a handful of Apple devices, it’s arguably the most operationally significant change coming this fall — quieter than a new iPhone, more consequential for your IT team’s day-to-day.

If you’re not sure whether your current MDM setup is ready for OS 27, that’s a conversation worth having before the fall releases land, not after. Get in touch and we’ll help you figure out exactly where the gaps are.

Source: Apple’s WWDC26 device management updates documentation.