Short, practical write-ups on Apple management: the payloads, the gotchas, and the reasoning behind every builder on this site.
Google Workspace, Linear, and Jamf Pro each answer 'what changed' differently, and none of them tell you what the approved configuration was supposed to be.
Apple ships a file access policy through XProtect. On the macOS 27 beta, sandboxd looks for a different filename, ignores it, and runs its own built-in rules.
The macOS 26.4 Rosetta notice sits behind a game filter, rate limits and a server-delivered policy. Apple documents that Intel plug-ins may not trigger it.
Apple documents two fixes for encrypted Mac OS Extended volumes and excludes Time Machine backup disks from both. What is left is a new lineage.
Texas went live in June, California follows in January, Illinois in 2028. Apple implements all five through one API, and an ADE-enrolled Mac is outside it.
Apple states device managers cannot configure local network privacy using MDM. Local Network is not a PPPC service, and no reset returns it to undetermined.
Apple names three Platform SSO features that must reach the identity provider before FileVault unlock, and rules out VPN, Network Relay, and 802.1X.
Platform SSO can be passwordless and meet MFA requirements, but local-password, policy, and recovery behavior depend on the method.
Before a macOS security-agent rollout, test removal in dependency order: system extension, PPPC profile, launch daemons, and app bundle.
Local Mac password cracking has two stages: copying the verifier and guessing offline. FileVault and password strength address each stage.
CrashStealer passed Gatekeeper and stole login-keychain and browser credentials in the user session. Detect its on-device signals.
A Jamf Extension Attribute identifies Intel-only apps before Rosetta 2 support narrows, and fails closed when architecture cannot be read.
macOS 27 removes silent MDM Accessibility grants. Compare Apple's user-scoped replacement with current MDM delivery paths.
macOS 27 removes legacy software-update commands, leaving declarative enforcement as the supported MDM path.
macOS 27 adds declarative privacy settings for seven permissions, but Full Disk Access and Screen Recording still need PPPC profiles.
macOS 27 expands declarative configuration for credentials, network, VPN, and SSO; device-health reporting expands on iPhone and iPad.
A Jamf Extension Attribute inventories AI apps, CLI tools, editor extensions, and MCP configurations so Smart Groups can scope policy.
Apple's updated macOS Tahoe 26.5.2 bulletin lists 38 CVEs: 33 web-rendering fixes, including 24 in WebKit.