WWDC Quick Look 💓 By SwiftGGTeam
中文 EN 日本語
What’s new in Apple device management and identity

What’s new in Apple device management and identity

Business & Education
Watch original video

Highlight

Apple Business Manager and Apple School Manager open their first APIs. New features include device management migration, Vision Pro Return to Service, Platform SSO in Setup Assistant, and Tap to Login on Mac with iPhone or Apple Watch.

Core content

For the past ten years, IT administrators who wanted to move a fleet of Apple devices from one MDM server to another had two options: walk every user through the migration by hand, or wipe the devices and start over. School mergers, switches from on-prem MDM to the cloud, vendor changes — each one meant betting on a large-scale outage. Device lists in Apple Business Manager and Apple School Manager were only visible through the browser, so any IT team that wanted automated inventory had to scrape the web pages. That setup cannot keep up with growing fleets.

This WWDC25 session fixes both pain points in one go. The new device management migration feature lets IT reassign iPhone, iPad, and Mac devices to a new MDM server straight from ABM/ASM, with a deadline. Users get a notice before the deadline; after the deadline the system runs the migration on its own, and the new MDM takes over Activation Lock and rotates the FileVault key through the bootstrap token. At the same time, Apple ships its first REST API for ABM/ASM, covering device inventory queries, MDM service assignment, and bulk activity status. Add Vision Pro Return to Service, Platform SSO in Setup Assistant, and Tap to Login (where doctors and nurses tap an employee badge to sign in to a Mac), and the whole package aims at one goal: turn minutes of manual work into seconds of automation.

Details

The session has four parts: Apple services, device management, app management, and identity integration (01:00).

Apple services: Managed Apple Account and the ABM/ASM API

01:30 covers Managed Apple Account. Administrators can now download the list of every personal Apple Account in their domain and prompt those users to upgrade. Upgraded accounts get the new app notarization service. Access Management has grown wider too: it can now block personal Apple Accounts from signing in on organization-owned devices, covering both Setup Assistant and System Settings, with no MDM required (02:23).

The device list adds Activation Lock status, device storage, IMEI/EID, and the user and time stamp for who released a device. Bluetooth and Wi-Fi MAC addresses for iPhone and iPad, plus AppleCare coverage, will arrive later this year (03:13). The biggest news is the ABM/ASM API announced at 03:48. An Administrator or Site Manager creates an API account, then generates and downloads a Private API Key, and can then call an initial set of endpoints to list devices, assign MDM services, and check bulk activity status. A call looks like this:

GET /v1/orgDevices?filter[serialNumber]=F2LXXXXXXXXX HTTP/1.1
Host: api-business.apple.com
Authorization: Bearer <signed-jwt-from-private-api-key>
Accept: application/json

Key points:

  • GET /v1/orgDevices is the device-inventory endpoint of the ABM/ASM Services API. It filters by serial number, model, and activity status, replacing the device list that used to be visible only on the website.
  • Host: api-business.apple.com maps to Apple Business Manager. Apple School Manager uses the matching api-school.apple.com host.
  • The Authorization header carries a short-lived JWT signed with the Private API Key. The Private API Key has to be generated and downloaded by an Administrator or Site Manager on the ABM/ASM website, and it is shown only once.
  • Companion endpoints such as POST /v1/mdmServerTokens and POST /v1/orgDevices/assign push devices in bulk to a target MDM server, and GET /v1/orgDeviceActivities/{id} tracks the bulk activity.

Vision Pro now plugs into Apple Configurator for iPhone: while Vision Pro is in Setup Assistant, hold an iPhone close, type in the pairing code that appears, and the device joins the organization (05:00). visionOS also starts supporting skipping Setup Assistant panes. Account-driven enrollment adds a fallback for the service discovery URL — if the device cannot find a well-known endpoint on the domain, it asks ABM/ASM, and the MDM server can configure the default assignment (05:55).

06:38 introduces device management migration. In ABM/ASM you reassign devices to a new MDM and set a migration deadline. If the user does nothing before the deadline, the system migrates the device automatically; the new MDM takes over Activation Lock and rotates the FileVault key through the bootstrap token. Apple recommends keeping the old and new configurations as close as possible, and using await device configured so all apps reinstall before the device leaves the enrollment flow.

Device management: declarative growth, Safari, Apple Intelligence, Return to Service

08:17 opens the software updates section. Declarative software updates now reach visionOS and tvOS. The older MDM-based software update management is deprecated and will be removed.

Safari management gets new declarations: declare bookmarks, set the default home page, and pull every Safari setting that used to live in the restrictions payload into declarative device management (08:59). The Apple Intelligence restrictions for writing tools, notification summaries, and image playground come to visionOS too (09:25).

Return to Service is the headline of this part (09:47). iPhone and iPad can now keep managed apps on a reset: user data is wiped as before, but the apps stay, and the next user does not have to download them again. To turn it on, set a new key in the cloud configuration and pair it with await device configured. While the device is awaiting configuration, install the apps you want to keep; when the device is released, the system takes a snapshot. After the next reset, the InstallApplication command or a ManagedApp declaration takes over those apps.

A typical Return to Service cloud configuration for iPhone/iPad looks like this:

{
  "ReturnToService": {
    "Enabled": true,
    "MDMServerURL": "https://mdm.example.com/checkin",
    "WiFiProfileData": "<base64-encoded-mobileconfig>",
    "PreserveApps": true,
    "AwaitDeviceConfigured": true
  }
}

Key points:

  • ReturnToService.Enabled turns on the auto-re-enrollment flow that re-binds the device to the original MDM after a reset, with no admin intervention.
  • MDMServerURL and WiFiProfileData give the device a network and a target MDM server the moment it boots.
  • PreserveApps: true is the new app preservation switch. User data is wiped as usual, but installed managed apps stay on the device.
  • AwaitDeviceConfigured: true keeps the device in the awaiting configuration state until the MDM takes over the apps it wants to preserve through InstallApplication or ManagedApp declarations, then sends DeviceConfigured to release the device. At release time the system snapshots the currently installed apps as the recovery target for the next reset.

Vision Pro now officially has Return to Service (10:51). Control Center adds a “Reset for Next User” option, and after you tap it there is a 10-second buffer for the user to take the device off. From the lock screen, a single press of the Digital Crown also triggers the reset.

Other updates include iPad battery health information, setting the default Messages and Phone apps, restricting Messaging and FaceTime by SIM, temporarily allowing AirPods and Beats, network relay profile support for FQDNs, and a new Network Extension URL Filtering API (11:42).

App management: per-app update control, declarative distribution on macOS

12:18 moves to app management. Managed app configuration on iOS and iPadOS can now drive update behavior on a per-app basis: force or disable automatic updates, pin an app to a given version, restrict cellular downloads, and stream install progress and version information back through the status channel. iOS 18.4 and iPadOS 18.4 take managed apps out of beta. visionOS 2.4 adds required apps support.

Starting with macOS Tahoe, App Store apps, custom apps, and packages can all be deployed through declarative device management (13:28). Each one can be marked as required or optional, and status flows through the status channel. The ManagedAppDistribution framework will come to Mac later this year, so MDM vendors can build self-service app stores.

A minimal com.apple.configuration.managed-app declaration:

{
  "Type": "com.apple.configuration.managed-app",
  "Identifier": "com.example.config.workapp",
  "Payload": {
    "AppStoreID": "1234567890",
    "Assignment": { "Type": "Required" },
    "UpdateBehavior": "EnforceAutomatic",
    "VersionPin": "5.2.0",
    "CellularDownloadsAllowed": false,
    "Configuration": {
      "apiBaseURL": "https://api.example.com",
      "tenantID": "acme-prod"
    }
  }
}

Key points:

  • Type: com.apple.configuration.managed-app marks this as a managed app declaration in declarative device management. From macOS Tahoe on, Mac supports the same declaration family, covering App Store apps, custom apps, and packages.
  • Assignment.Type: Required installs the app automatically once the device is enrolled. Setting it to Optional puts the app in the MDM self-service store and lets users pick.
  • UpdateBehavior plus VersionPin cover the per-app update control: you can force automatic updates, or pin an app to a specific version so you can verify in a small ring before rolling it out.
  • CellularDownloadsAllowed: false blocks cellular downloads to keep large updates off employees’ data plans. Install progress and the final version flow back to the MDM server through the declarative status channel.
  • The Configuration dictionary is the same managed app configuration as before, read by the app through UserDefaults or the new ManagedApp framework.

iOS 18.4, iPadOS 18.4, and visionOS 2.4 introduce the new ManagedApp framework (13:52). It lets organizations push configuration to apps in a safe way — settings, passwords, certificates, identities. The session lists typical use cases: customizing the app experience, getting an API access token securely, adding custom trust certificates, and using hardware-bound keys to get a strong attestation of the device’s state. See Session 203 for the details.

Identity integration: Platform SSO in Setup Assistant, Authenticated Guest Mode, Tap to Login

14:50 turns to identity. Today, Platform SSO enrollment can only run after the local account on a Mac is set up. This year Platform SSO moves into Setup Assistant: during Automated Device Enrollment, a Platform SSO pane appears, and the user has to authenticate with the IdP to continue. Once login succeeds, SSO performs an authenticated MDM enrollment, and if the IdP is federated with Managed Apple Account, the user signs in to Managed Apple Account at the same time. The local account is created, the password syncs with the IdP or uses a Secure Enclave-backed key, and the account avatar can sync from the IdP.

16:08 brings Authenticated Guest Mode for shared devices. From the Mac login window, the user signs in directly with a cloud identity (password or SmartCard) — a network connection is required. Once signed in, the user can use SSO straight through to apps and websites. On sign-out, every piece of user data from the session is wiped. Together with Platform SSO and Auto Advance, a brand-new device can boot, finish Platform SSO and MDM enrollment silently, and stop at the login window.

17:15 is the most striking feature of the session: Tap to Login. If your organization already puts employee or campus badges in Apple Wallet, users can tap an iPhone or Apple Watch on an external NFC reader to sign in to a Mac configured with Authenticated Guest Mode. Credentials live as Access Keys written into a Wallet pass by an iPhone app and stored in the Secure Enclave, so they are hardware-encrypted, extraction-proof, and tamper-resistant. Express Mode lets the device sign in without waking or unlocking. Developers like SwiftConnect, who already work on employee and student badges, are wiring up Access Key issuance.

Takeaways

  • What to do: Lock the domain in ABM/ASM first, then roll out account capture and federation in stages.

    • Why it matters: Blocking personal Apple Accounts from signing in to company devices is the precondition for getting value out of Managed Apple Account; without it, app notarization and Apple Intelligence restrictions cannot reach everyone.
    • How to start: Set Lock Domain in ABM/ASM, download the list of personal Apple Accounts in the domain, and notify users to fix them. Turn on Access Management to block personal Apple Accounts on organization devices. Finally, plug in your IdP for federation.

  • What to do: Use device management migration instead of wipe-and-redeploy MDM switches.

    • Why it matters: Activation Lock and the FileVault key get handed over to the new MDM through the bootstrap token, with almost no impact on end users. It is the cleanest migration path Apple has ever shipped.
    • How to start: Bring the declarative configuration on the old and new MDM into close alignment. Set a migration deadline. On the new MDM, enable await device configured so all apps reinstall before the device leaves the enrollment flow.

  • What to do: Turn on Return to Service with app preservation on shared iPhone, iPad, and Vision Pro devices in retail, hospitals, and schools.

    • Why it matters: In bandwidth-limited venues, you no longer redownload several GB of work apps on every reset. Wait time for the next user drops from minutes to seconds.
    • How to start: Set the new key in the cloud configuration and enable await device configured. While in awaiting configuration, install the apps you want to keep through InstallApplication or ManagedApp declarations, then release the device so the system takes a snapshot.

  • What to do: Re-architect Mac deployment around Platform SSO plus Auto Advance.

    • Why it matters: Platform SSO and MDM enrollment finish in Setup Assistant, so a new hire can sign in the moment the Mac boots. IT no longer has to run the two-step “create a local account first, then register SSO” dance.
    • How to start: Turn on Platform SSO enrollment and Auto Advance in your MDM. Federate the IdP with Managed Apple Account so SSO signs the user in to Managed Apple Account at the same time. Configure Authenticated Guest Mode for shared devices.

  • What to do: Adopt the ManagedApp framework in your app to expose a safe configuration channel for IT.

    • Why it matters: The MDM can deliver API tokens, custom trust certificates, and hardware-bound keys safely — none of which managed app configuration handles well. Doing this often wins enterprise customers directly.
    • How to start: Adopt the ManagedApp framework in the iOS 18.4, iPadOS 18.4, and visionOS 2.4 SDKs. Define the settings, passwords, certificates, and identities IT needs to push. Read Session 203 for the API shape.

Comments

GitHub Issues · utterances