Declarative Device Management is mandatory in 2026: the enterprise iOS fleet migration guide

Summary. On Apple's 27.0 operating systems, shipping in the second half of 2026, legacy mobile device management (MDM) software update controls no longer function. Apple deprecated them in the iOS 26 and macOS Tahoe cycle in 2025 and removed them one year later, exactly as it warned. Four things stop working on iOS 27, iPadOS 27, and macOS 27: software update commands, software update queries, recommended cadence settings, and software update restrictions such as deferrals and Background Security Improvements. The only mechanism that still enforces updates is declarative device management (DDM). At WWDC26 on June 8, 2026, Apple also moved seven network configuration types (VPN, encrypted DNS, and relay) into DDM, deprecated the Apple Intelligence, Siri, and keyboard restriction keys as of 26.4, and shifted web content filtering and Mac content caching to declarative configurations. For an IT team running a 3,000-device Apple fleet, where third-party MDM platforms run on the order of $2 to $8 per device per month, this is not an optional refresh. If your MDM still leans on legacy software update commands, you lose update enforcement the moment a device upgrades to 27.0. This guide covers what breaks, what moves, and a step-by-step migration plan.

Declarative device management is not new. Apple introduced it at its 2021 developer conference and has expanded it every year since. What changed in 2026 is that the legacy path started to disappear rather than simply sit alongside DDM. Rich Trouton, a longtime Apple systems administrator who writes the widely read Der Flounder blog, put the 2026 change plainly: "Apple has carried through on this and announced publicly that legacy software update management no longer functions in all Apple 27.0 operating systems." For fleets that deferred the move, the deadline is now the operating system upgrade itself.

What DDM is, and why Apple is forcing the move

Traditional MDM is a command model. The management server sends a command, the device responds, and the server polls for status. It is chatty, it depends on the device being reachable at the right moment, and enforcement drifts when a device is offline.

Declarative device management inverts that. The server sends declarations that describe a desired state, and the device enforces that state itself and reports back through status channels when something changes. The four building blocks are declarations (the policy intent), assets (resources such as profiles the policy needs), predicates (conditions that decide when a policy applies), and status channels (the device reporting its own state). The device becomes autonomous: it applies the policy, watches for drift, and pushes updates to the server rather than waiting to be asked. That reduces server load, closes the enforcement gap for offline devices, and gives Apple a cleaner surface to build on. It is also why Apple is retiring the command-based path rather than maintaining both forever.

The timeline: from optional to mandatory

Apple's own iOS 26 enterprise notes, published May 11, 2026, state it directly: "Software update management using mobile device management commands, restrictions, the com.apple.SoftwareUpdate payload, and queries is deprecated and will be removed next year. Going forward, software updates can be managed and enforced using only declarative software update management." One year later, the WWDC26 device management notes confirmed the removal landed.

Exactly what stops working on 27.0

On Apple's 27.0 operating systems, under the heading "Software update command removal," Apple lists what no longer functions:

• Software update commands

• Software update queries

• Recommended cadence settings

• Software update restrictions, such as deferrals and Background Security Improvements

If your MDM still uses any of these to schedule, defer, or enforce updates, that enforcement silently stops the moment a device moves to 27.0. There is no grace period after the upgrade. The replacement is declarative software update management, configured through the SoftwareUpdateSettings declarative configuration documented in Apple's Device Management reference. Practically, that means moving update enforcement into a declarative configuration that sets a target OS version and an enforced installation deadline, which the device then honours on its own.

What else moves to DDM in the 27 cycle

Software updates are the forcing function, but they are not the only domain moving. At WWDC26 Apple shifted several more management areas to declarative configurations. Plan for these in the same migration rather than in a second round.

Network settings are the biggest addition. Seven declarative network configuration types are now available on the 27.0 platforms, which lets one policy model cover VPN, DNS, and relay across every major Apple platform:

Three more domains changed. Apple moved Apple Intelligence, external intelligence, Siri, and keyboard management from legacy MDM restriction payloads to declarative configurations, and deprecated the matching restriction keys as of iOS 26.4, iPadOS 26.4, macOS 26.4, visionOS 26.4, and watchOS 26.4. Web content filtering moves to the com.apple.configuration.webcontent-filter.plugin configuration on iOS 27, iPadOS 27, macOS 27, and visionOS 27. On macOS 27, content caching gains a declarative content-cache.settings configuration, and the legacy com.apple.AssetCache.managed profile is deprecated. If you manage Siri or on-device intelligence policy, our iOS 27 App Intents and Siri developer guide covers the app-facing side of that shift.

Legacy MDM software update versus declarative software update management

A step-by-step migration plan

Treat this as a project with a hard deadline tied to your 27.0 rollout, not a background task. The sequence below works for most fleets.

First, inventory what your current setup depends on. Pull every profile and command your MDM uses for software updates, VPN, DNS, content filtering, and intelligence restrictions. Anything touching the four removed software update mechanisms is a priority-one item.

Second, confirm your MDM vendor's DDM support. Jamf, Microsoft Intune, Omnissa, and the other major platforms all ship declarative software update support, but coverage of the newer network and content-filter configurations varies by release. Check that your version supports the specific declarative configurations you need on 27.0 before you plan the cutover.

Third, move software update enforcement to declarative software update management. Replace deferral and cadence rules with a declarative configuration that sets a target OS version and an enforced installation deadline. Apple improved the user-facing countdown in the 26 cycle, so the due date is described accurately once the countdown reaches 13 or fewer days, and notifications do not nag before the final 24-hour required window.

Fourth, migrate network policy to the declarative network configurations. Rebuild VPN, encrypted DNS, and relay settings using the seven configuration types above rather than legacy profiles, so one policy model covers every platform.

Fifth, use the new declarative asset path for anything that still needs a legacy profile. On 27.0, legacy profiles can be delivered as declarative assets through the ProfileAssetReference key in the com.apple.configuration.legacy and com.apple.configuration.legacy.interactive configurations. This gives you flexibility over where profiles are hosted and adds built-in integrity verification so a downloaded asset cannot be modified in transit.

Sixth, meet Apple's stricter transport requirements. On the 27.0 releases, select system processes enforce tighter TLS rules, and your device management service needs to support TLS 1.2 at a minimum with cipher suites and certificates that meet the new App Transport Security requirements. A management server that fails these checks will not talk to devices at all, so validate this early.

Seventh, test on the beta seeds before the public release. Enrol representative devices on the 27 developer and public betas, and watch AppleSeed for IT seed notes, because Apple has documented enforcement limitations in the initial 27.0 seeds. Apple also cautions that these features are pre-release and may change before final release, so re-test after each seed.

Two changes that will surprise you

Backup restore behaviour changed. On iOS 27, iPadOS 27, and visionOS 27, devices no longer restore device management information from a backup, including the enrollment profile, management configuration, and supervision status. A device restored from an old backup comes back unmanaged, so your re-enrolment workflow has to account for it.

Return to Service gained update enforcement. On iOS 27, iPadOS 27, and visionOS 27, you can enforce a software update on a supervised device when it receives a Return to Service erase command, with the management service returning a 403 response during enrollment to trigger it. Separately, on iOS 27 and iPadOS 27, the setting formerly called Wi-Fi Assist is renamed Connectivity Assist, though the underlying WiFiAssistPolicy management key does not change. For the wider upgrade picture, our iOS 27 enterprise fleet readiness guide and the September readiness checklist put these device-management changes in context.

India-specific considerations

For Indian enterprises and the global capability centres that run large Apple fleets from India, three points matter. Data protection comes first. Managed devices hold employee personal data, and the Digital Personal Data Protection Act 2023 (DPDP) raises the bar for how that data is stored, accessed, and retained. Declarative device management helps here because status reporting and enforcement happen on the device with less server-side polling of device state, which reduces the surface where personal data moves. Design your MDM data flows to keep personal data on controlled infrastructure and describe that handling in your records. Second, the stricter TLS 1.2 and App Transport Security requirement means any self-hosted or regionally hosted management service in India needs its certificates and cipher suites checked now, not during the rollout. Third, vendor readiness varies, so confirm your MDM provider supports the specific 27.0 declarative configurations for the platforms your fleet runs. Teams timing hardware refreshes alongside the OS move should read our note on Apple 2026 enterprise fleet budget impact, and those still validating device readiness can use the public beta fleet checklist.

FAQ

How eCorpIT can help

eCorpIT helps enterprises plan and run Apple fleet transitions, from auditing legacy MDM dependencies to rebuilding software update, VPN, and content-filter policy as declarative configurations and validating transport security before an OS rollout. Our senior engineering teams also build the internal iOS and iPadOS apps that run on those managed devices. If you manage an Apple fleet and want a migration plan before the 27.0 releases land, see our enterprise iOS app development work or talk to us. eCorpIT is CMMI Level 5, MSME, and ISO 27001:2022 certified.

References

1. WWDC26 device management updates — Apple Platform Deployment, June 8, 2026.

1. What's new for enterprise in iOS 26 — Apple Support, published May 11, 2026.

1. MDM-based software update management options no longer work on all Apple 27.0 operating systems — Rich Trouton, Der Flounder, June 8, 2026.

1. SoftwareUpdateSettings declarative configuration — Apple Developer documentation.

1. Device Management — Apple Developer documentation.

1. Intro to declarative device management — Apple Platform Deployment.

1. Support tip: move to declarative device management for Apple software updates — Microsoft Intune Customer Success.

1. Getting to know declarative device management — Jamf.

1. WWDC 2026: what IT admins need to know — Fleet.

1. WWDC 2026 updates: everything IT teams should know — ManageEngine.

1. A primer on declarative device management for Apple devices — Omnissa.

_Last updated: July 28, 2026._