New features for managing Apple devices

Highlight

macOS Monterey brings the “Erase All Content and Settings” function to Mac. Apple silicon and T2 Macs can be restored to factory status with one click through MDM; iOS 15 merges VPN and device management settings pages, and adds enterprise data protection capabilities such as Required App and Managed Pasteboard.

Core Content

Over the past year, the way we work has changed like never before—from the office to the kitchen table to the living room couch. Apple’s hardware, software and services are always behind this flexibility. For IT administrators and MDM developers, this means finding a better balance between privacy, user autonomy, and administrative control.

This session is an annual overview of Apple’s device management field, covering the new MDM capabilities of iOS 15, iPadOS 15, and macOS Monterey. From a redesign of the Settings interface, to remote lock and password recovery for Apple silicon Macs, to a one-click recovery feature that erases everything and sets up, every change points to the same goal: making device management at scale easier and more secure.

Detailed Content

iOS/iPadOS 15: Settings interface revision and Required App

iOS 15 merges “VPN” and “Device Management” into a unified “VPN & Device Management” portal (02:38). Users can get a comprehensive view of the device’s management status on this page, including installed profiles, management accounts, and VPN configurations.

For unsupervised devices, app installation requires user confirmation—which the user may decline. iOS 15 introduces the Required App mechanism (03:25), which allows you to specify an app during MDM enrollment that must be installed on unsupervised devices:

// Required App configuration
1. Add the iTunes Store ID to the MDM profile
2. Make sure the app has a device or user license
3. Send the InstallApplication command
4. Add managed app attributes to prevent user removal

The user already agreed to install the app when signing up with MDM, so no additional confirmation is required. This solves the challenge of deploying enterprise-critical applications, such as MDM agents, on unsupervised devices.

Managed Pasteboard: Control clipboard data flow

Managed Open-In controls whether data can flow between managed and unmanaged applications. New in iOS 15requireManagedPasteboardLimitations (04:26), extending this control to the clipboard:

• System applications (Calendar, Notes, Mail, Files) automatically comply with this restriction
• Third-party applications can be adapted without additional modifications
• When pasting is blocked, the user will see the “Paste Not Allowed” prompt
• The organization name in the prompt can be passedOrganizationInfoSettings command customization

Temporary Session for Shared iPad

Shared iPads traditionally require a Managed Apple ID. Temporary Session introduced in iOS 14.5 allows anyone to use a shared iPad (05:28), and all data (Safari history, modified settings, new files) will be deleted when logging out.

SharedDeviceConfigurationThe Settings command adds three new configurations (05:52):

Key	Function
TemporarySessionOnly	Restrict logins to temporary sessions
TemporarySessionTimeout	Timeout for automatic logout of temporary sessions
UserSessionTimeout	Timeout for automatic user session logout

Pressing the Power or Home button resets the timer to avoid accidental logout during active use.

macOS Monterey: System Extensions management improvements

Starting from macOS 11.3, installing the System Extension payload will automatically activate the pending system extension; removing the payload will deactivate the extension (08:19). macOS Monterey NewRemovableSystemExtension, allowing apps to deactivate their system extensions on their own - this is particularly useful in deployment scenarios where there are no admin users (08:37).

For Kernel Extensions, macOS Big Sur requires a reboot to modify kexts. Monterey is inRestartDeviceTwo options have been added to the command (09:03):

• KextPaths: Specifies a kernel extension path not yet discovered by the operating system, allowing MDM to install the application and load the kext without the user having to launch the application first
• NotifyUser: Display a restart notification to the user and perform a graceful restart after clicking it.

AllowNonAdminUserApprovalskey allows standard users to complete the installation of kernel extensions (09:43).

Remote management enhancements for Apple silicon Macs

Apple silicon MacDeviceLockThe command now supports sending a six-digit PIN, message, and phone number (11:08), and the device will reboot and display this information, achieving feature parity with all Mac models.

More importantly,SetRecoveryLockandVerifyRecoveryLockCommand (11:43):

-Set a recovery password to prevent unauthorized entry into recovery mode

• Passwords can only be set and removed by MDM
• Recovery password automatically removed when user logs out from MDM
• MDM needs to know the existing password when setting a new password
• DeviceLock PIN and Recovery Password will be cleared when the device is erased

It is recommended to use Recovery Lock in conjunction with Activation Lock to provide the best security for your device fleet.

Erase all content and settings (Return to Service)

macOS Monterey introduces iOS-style “Erase All Content and Settings” to Mac (12:32). Send via MDMEraseDeviceYou can restore the factory state with one click using the command:

• Macs that support Apple silicon Macs and T2 security chip
• Multi-partition devices will reboot to the setup assistant in the current system volume, and other volumes will be erased
• Apple silicon devices also reset security settings modified in recovery mode
• PassableallowEraseContentAndSettingsRestrictions prevent users from performing this action themselves

// EraseDevice command behavior
Send EraseDevice -> erase all user data -> restart to Setup Assistant -> ready to assign to the next user

TV Remote payload update for Apple TV

tvOS 15 no longer broadcasts MAC addresses via Bonjour due to security concerns (06:32). TV Remote payload newTVDeviceNamekey, withTVDeviceIDUsed together, filter Apple TV in the Remote widget by device name to prevent unexpected pairing attempts.

Core Takeaways

1. Use Return to Service to simplify device transfer: Configuring Apple silicon and T2 MacEraseDevicecommand to restore the device to its factory state with one click, eliminating the need to manually reinstall the system.

2. Configuring Recovery Lock for Apple silicon Mac: CombinedSetRecoveryLockand Activation Lock to prevent the device from being entered into recovery mode to modify security settings after it is lost.

3. Use Required App on unsupervised devices: For BYOD scenarios, specify the MDM agent as Required App in the registration profile to ensure that key applications are always available.

4. Enable Managed Pasteboard to protect enterprise data: For enterprise applications involving sensitive data, setrequireManagedPasteboardRestrictions to prevent leakage to personal applications via clipboard.

5. Focus on Declarative Device Management: Many of the improvements mentioned in this session (such as software update management) are evolving towards declarative management. It is recommended to evaluate the feasibility of migrating existing MDM workflows to DDM.

Related Sessions

• WWDC2021 10136 - Explore account-driven User Enrollment — User enrollment improvements for BYOD scenarios
• WWDC2021 10129 - Managing software updates in your organization — Detailed approach to software update management
• WWDC2021 10140 - Manage devices with Apple Configurator — Apple Configurator for iPhone and new features
• WWDC2021 10135 - Getting Started with Declarative Device Management — The future direction of the MDM protocol