WWDC Quick Look 💓 By SwiftGGTeam
中文 EN 日本語
What's new in managing Apple devices

What's new in managing Apple devices

Device ManagementmacOSiOSBusiness
Watch original video

Highlight

macOS 14, iOS 17, and iPadOS 17 bring several device management enhancements: Automated Device Enrollment (ADE) can now require FileVault and minimum OS versions during Setup Assistant; Platform SSO expands to support creating local accounts at the login window, SmartCard authentication, and group privilege mapping; and iOS/iPadOS adds a Return to Service flow that automatically re-enrolls erased devices.

Core Content

Enterprise IT administrators face an ongoing challenge: how to ensure security and compliance configurations are in place before devices reach end users. Previously, while Automated Device Enrollment (ADE) on Mac simplified the setup flow, critical security steps like FileVault encryption and OS version checks could only happen after enrollment—leaving a “security window.”

macOS 14 changes this. MDM can now require FileVault during Setup Assistant. IT administrators can choose to show the recovery key to the user or escrow it to the MDM server. MDM can also set a minimum operating system version—devices that don’t meet it are automatically guided through a system update before enrollment continues.

Another long-standing pain point is networking. Previously, if a Mac wasn’t online during initial setup, ADE enrollment was skipped and only a notification reminded users to enroll later. Many users ignored this notification, leaving devices unmanaged for extended periods. macOS 14 switches to a full-screen Setup Assistant with two choices: continue enrollment immediately, or defer for up to 8 hours.

On the identity front, Platform SSO introduced in macOS Ventura lets enterprise users access all corporate services with a single identity provider (IdP) sign-in. This year the capability expands further: the login window can create local accounts directly with corporate credentials; SmartCards can be used for login and screen saver unlock; and user groups in the IdP can map directly to local privileges (standard user, administrator, or custom groups).

iOS and iPadOS also get important updates. Return to Service lets erased devices automatically re-enroll in MDM during reactivation without manual intervention—valuable for device recycling, resale, or recovery after loss.

Detailed Content

macOS ADE Enhancements

(03:22) macOS 14 lets MDM require FileVault during Setup Assistant:

  • IT administrators can configure whether to show the FileVault recovery key in Setup Assistant
  • Or escrow the recovery key to the MDM server without showing it to the user
  • This happens before the user’s first login, eliminating the security window

(04:13) Minimum operating system version requirements:

  • MDM can specify a minimum OS version when sending the enrollment profile
  • When a device requests the enrollment profile and the version is too low, MDM returns a JSON 403 response
  • The system automatically guides the user through a system update, then continues Setup Assistant after reboot
  • The entire process is automated—no manual IT intervention required

(04:45) Improved handling when offline:

  • Before: ADE was skipped when offline, followed by a notification reminder
  • Now: a full-screen Setup Assistant launches once online
  • Users choose “Continue” to enroll immediately, or “Later” to defer for up to 8 hours
  • Users can always manually complete enrollment in System Settings

Platform SSO Extensions

(06:40) Platform SSO adds several capabilities in macOS 14:

Creating local accounts at the login window:

  • On first boot, users authenticate at the login window with corporate credentials (e.g., Azure AD, Okta)
  • The system automatically creates the corresponding local account
  • Requires Shared Device Key and Bootstrap Token support

SmartCard authentication:

  • SmartCards can be used for login window authentication
  • Also for screen saver unlock
  • Suitable for high-security enterprise environments

Group privilege mapping:

  • User groups in the identity provider can map directly to local macOS privileges
  • Supports mapping to standard user, administrator, or custom local groups
  • Privilege changes made in the IdP automatically sync to the Mac

Network authorization:

  • Non-local users (e.g., those signed in via Platform SSO) can be used in authorization prompts
  • Suitable for temporary guests or shared device scenarios
  • Note: operations involving SecureToken still require a local user

iOS/iPadOS Return to Service

(14:30) Return to Service solves re-enrollment after a device is erased:

  • After erasure, the device automatically re-enrolls with the original MDM during activation
  • No manual intervention or re-scanning of configuration QR codes required
  • Applies to device recycling, pre-sale resets, recovery after loss, and similar scenarios
  • Must be enabled in ADE configuration

Apple Configurator Automation

(18:00) Apple Configurator adds automation capabilities:

  • Supports creating automation workflows through the Shortcuts app
  • Can batch device configuration, app installation, supervision status setup, and more
  • Reduces manual steps and improves large-scale deployment efficiency

Core Takeaways

  1. Build a self-service enterprise device enrollment portal

    • Use ADE enhancements and Platform SSO to create a web portal where employees complete device setup on their own
    • Why it’s worth doing: reduces IT ticket volume—employees can finish configuration without contacting IT after unboxing
    • How to start: configure ADE and Platform SSO in your MDM, and create internal documentation for the boot-up flow

  2. Build an MDM compliance status dashboard

    • Use real-time status reporting from Declarative Device Management to build a visual dashboard
    • Why it’s worth doing: IT administrators can see in real time which devices have FileVault disabled, outdated OS versions, or missing enrollment
    • How to start: connect to your MDM’s DDM status endpoints and build the dashboard UI with SwiftUI or web technologies

  3. Develop automated device recycling tools

    • Use Return to Service and Apple Configurator Shortcuts automation to build a device recycling pipeline
    • Why it’s worth doing: enterprises retire and recycle large numbers of devices each year—manual handling is slow and error-prone
    • How to start: use Apple Configurator’s Shortcuts integration to batch-erase devices, ensuring Return to Service is configured correctly

Comments

GitHub Issues · utterances