What’s new in device management

Highlight

Apple Vision Pro now supports Automated Device Enrollment zero-touch deployment; Apple Business Manager adds remote Activation Lock disable; software update management introduces unified configuration declarations replacing scattered MDM commands.

Core Content

Apple’s device management ecosystem received a series of important updates this year, centered on two pain points: making new devices easier to deploy, and making locked devices easier to recover.

The first pain point comes from enterprise Apple Vision Pro deployment. After purchasing headsets, administrators still had to manually power on, complete Setup Assistant, and manually enroll in MDM—a process disconnected from iPhone/Mac zero-touch deployment. visionOS 2.0 solves this—Automated Device Enrollment now supports Vision Pro, so devices can automatically complete MDM enrollment in Setup Assistant right out of the box without physical interaction.

The second pain point is device recovery challenges from Activation Lock. After a device is erased or locked, Activation Lock prevents unauthorized use, but sometimes the lock is unintentionally retained, preventing reconfiguration. Previously IT teams could only contact Apple Support or ask users to unlock manually. Apple Business Manager now supports remotely turning off Activation Lock—whether the lock was set by the organization or the user’s personal account (including locks enabled with a personal Apple Account before MDM enrollment).

For identity management, the Managed Apple Account domain capture flow was simplified. Organizations can now capture Apple Accounts using their domain without connecting an Identity Provider; users can choose to convert existing accounts directly to Managed Apple Accounts instead of being forced to rename.

For platform management, software update management introduced unified configuration declarations, replacing previously scattered legacy MDM commands and profiles. New declarations support managing Beta updates, notification behavior control, and provide stronger visibility. Safari extensions can now be managed through MDM, letting IT define which extensions are available, whether they’re enabled by default, and which domains they can access.

Detailed Content

Apple Vision Pro Device Management

visionOS 2.0 brings Apple Vision Pro into the Automated Device Enrollment ecosystem (01:47). After an organization purchases Vision Pro and associates its Apple Customer Number, devices appear in Apple Business Manager. The Device Assignment API now includes Vision Pro value types.

The visionOS management model closely matches iPhone/iPad, supporting three enrollment methods:

Device Enrollment: Users manually enroll in Settings > VPN & Device Management with a Managed Apple Account
User Enrollment: Also uses Managed Apple Account, but for bring-your-own-device scenarios
Automated Device Enrollment (new in visionOS 2.0): Zero-touch deployment, automatic enrollment in Setup Assistant with supervision enabled

visionOS 2.0 significantly expands management capabilities, now supporting most MDM payloads and configurations, including:

Passcode policy, Domains, Web Content Filter payloads
DeviceConfigured, DeviceLock, Settings subcommands
Managed Open-In restrictions, account modification restrictions, allowCamera restrictions

Because Vision Pro is a camera-centric device, the allowCamera restriction was redesigned—when users take screenshots, only the active window is captured and the background is removed (15:04).

Remote Activation Lock Management

Apple Business Manager and Apple School Manager now support remotely turning off Activation Lock (03:58):

Supported devices: iPhone, iPad, Mac, Apple Watch, and Vision Pro
Prerequisite: Device must belong to the organization
Supported scenarios: Both organization-set and user personal locks can be disabled

For Mac devices, this means even if a user enabled Activation Lock with a personal Apple Account before MDM enrollment, the organization can remotely disable it (04:25).

Unified Software Update Management Declarations

iOS/iPadOS 18 and macOS 15 introduce new Software Update Settings configuration declarations (07:28), replacing all legacy MDM software update management commands, profiles, and restrictions. New declarations support:

Changing notification behavior to show notifications only one hour before enforcement time
Managing Beta updates, supporting Public Beta and AppleSeed for IT

The Beta update management flow (08:49):

An Apple Business Manager or Apple School Manager administrator registers for AppleSeed for IT at beta.apple.com/it
The system generates unique tokens for the organization and seed period
MDM discovers available programs via the OS beta enrollment tokens endpoint (OAuth authentication required)
MDM retrieves program tokens and uses them for device enrollment

Beta update configuration example (09:37):

{
  "BetaUpdates": {
    "betaPrograms": ["public-seed", "it-seed"],
    "publicBeta": "enabled",
    "notificationTime": "3600"
  }
}

Key points:

The betaPrograms array specifies available Beta program types
publicBeta controls whether public Beta is enabled
notificationTime sets notification time before enforcement in seconds

During Automated Device Enrollment, MDM can return an HTTP 403 response to enforce a specific Beta version, with a RequireBetaProgram dictionary in the response body (10:05).

Safari Extension Management

Safari extensions can now be managed through MDM on iOS, iPadOS, and macOS (11:07). New configuration supports:

Defining an allowed extension list that users can toggle
Controlling whether extensions are always on or always off
Configuring extension website access by domain and subdomain
All features apply to Safari Private Browsing

Mac Management Enhancements

Service profile installation now supports executables (15:40), letting administrators install IT management tools and scripts in tamper-resistant locations, still delivered as zip archives. Launchd profiles can also be installed through background task services configuration.

External storage management introduces new disk management configuration (16:19), letting IT administrators:

Allow or prohibit external/network storage
Restrict mounts to read-only volumes

This configuration replaces the deprecated media management payload, which will be removed in a future version.

Platform SSO expands the scope of identity provider authentication (16:48):

IdP authentication can now unlock FileVault
Login policies can require IdP authentication across FileVault, login window, and lock screen
Stronger security options like HPKE added

Platform SSO configuration example (17:27):

{
  "PlatformSSO": {
    "Extension": {
      "BundleIdentifier": "com.example.sso_extension",
      "TeamIdentifier": "EXAMPLE123"
    },
    "ExtensionType": "loginwindow-sso",
    "LoginWindow": {
      "Enable": true,
      "Mode": "allow"
    },
    "FileVault": {
      "Enable": true,
      "Policy": "attempt-authentication"
    },
    "UnlockPolicy": "require-authentication",
    "AllowOfflineGracePeriod": true,
    "OfflineGracePeriod": 72,
    "AllowTouchIDOrWatchForUnlock": true
  }
}

Key points:

When FileVault.Policy is set to “attempt-authentication”, IdP authentication is attempted first, falling back to local credentials when the server is unavailable
UnlockPolicy set to “require-authentication” makes lock screen unlock stricter
AllowOfflineGracePeriod and OfflineGracePeriod control offline grace period duration
AllowTouchIDOrWatchForUnlock allows biometrics and Apple Watch instead of IdP authentication

iPhone and iPad Management Enhancements

Two new cellular network restrictions (18:42):

forcePreserveESIMOnErase: Prevents eSIM removal when erasing the device
allowESIMOutgoingTransfers: Controls whether eSIM can be transferred to a new device

Users can configure eSIM themselves by long-pressing a QR code or tapping a link (19:04).

iOS/iPadOS 18 supports up to 5 Private Cellular Network payloads, configuring up to 5 private 5G or LTE networks (19:29). When network slicing and per-app VPN are both configured, managed app traffic routes to the designated 5G network slice while retaining VPN benefits.

App lock and hide features can be managed by organizations (20:05):

Restrict all app locking and hiding on supervised devices
Per-app control for managed apps
Hiding an app also locks it, so restricting lock also restricts hide

Education Tool Enhancements

Easy Student Sign-In and Classroom’s Unmanaged Nearby Classes features can now be configured in Apple School Manager’s Access Management (22:18).

Schoolwork 3.0 introduces new assessment and grading workflows (22:42):

Teachers can send assessments by scanning or importing documents, supporting Pages, Numbers, Keynote, Google Suite documents, and PDF
Teachers can grade documents and analyze student performance by question

Assessment Mode adds multi-app mode support (23:20), including Notes, spreadsheets, assistive apps, coding apps, and iPad’s new Calculator app. The Calculator app supports Assessment Mode and MDM configuration, allowing scientific calculator mode or Math Notes to be disabled (23:53).

Core Takeaways

Include Apple Vision Pro in zero-touch deployment: Why it’s worth it—Vision Pro units are expensive; manual deployment is inefficient and error-prone. How to start—associate Vision Pro with your organization in Apple Business Manager, configure visionOS 2.0 Automated Device Enrollment, and enable Remote Management in Setup Assistant.
Clean up idle Activation Lock devices: Why it’s worth it—locked devices can’t be reconfigured, tying up enterprise assets. How to start—sign in to Apple Business Manager, select locked devices in the device list, and use the “Turn Off Activation Lock” menu to remotely disable the lock without contacting Apple Support or user action.
Use unified software update declarations for Beta testing: Why it’s worth it—new declarations support phased testing and rollout starting from the first Beta version. How to start—register your organization in AppleSeed for IT, obtain tokens, configure the Beta dictionary in the new Software Update Settings declaration, and combine with deferral options for phased deployment.

Introducing enterprise APIs for visionOS — visionOS enterprise APIs including camera access, barcode scanning, object tracking, and Neural Engine access
What’s new in privacy — Latest Apple platform privacy updates related to device management security policies
What’s new in SwiftUI — Latest SwiftUI framework features for building device management admin interfaces