← Field Notes DDM · Deep dive

The management model changed under us: what macOS 27 moved to declarative

R Rob Flanagan · Jul 2026 · 3 min read

Declarative device management is old news by now. What most of the coverage missed is how much of the macOS 27 release quietly moved onto it — and how much less your MDM server has to ask the device as a result.

I spent years hitting refresh on a management console, waiting to find out whether a profile I pushed actually took. If you managed Apple devices the old way, you did too.

That job mostly ended with declarative device management, and by now everyone knows the pitch. The device holds its own declarations and reconciles its own state, then reports changes back over a status channel, so there's a lot less to poll. It shipped back in iOS 15. At WWDC this year Cyrus Daboo put it about as bluntly as Apple puts anything:

"It's here. It's shipping. It's in production across fleets around the world. If you're managing devices today without using it, you're working harder than you need to."Cyrus Daboo, WWDC 2026 Session 206

Fine. None of that is news. What I don't think got enough attention is how much of the 27 release moved onto that model.

The status channel reports things it never used to

On iPhone and iPad, device system health now covers the baseband, the camera, and the Face ID sensors. Supervised devices report whether the user turned on Lockdown Mode. Credentials became declarative assets, so you refresh a certificate once and every configuration that references it picks up the change on its own — anyone who has chased a cert rotation through a dozen profiles knows what that's worth. Network and VPN configurations went declarative this wave too, along with a new extensible SSO configuration.

  • Device system health (iPhone and iPad) — baseband, camera, and Face ID sensor status, reported over the status channel.
  • Lockdown Mode state (supervised iPhone and iPad) — devices now report whether the user enabled it.
  • Credentials as declarative assets — refresh a certificate once; every configuration that references it reconciles on its own.
  • Network and VPN configurations — moved onto the declarative model this release.
  • Extensible SSO — a new declarative single sign-on configuration.

Why this is the real headline of 27

For me, that's the story. The model absorbed the parts of device management a lot of us were still doing the old way. Your MDM server didn't go anywhere, and enrollment still runs through it — declarative management was never a new protocol, just an extension bolted onto MDM. There is just less reason to keep asking the server questions the device is already answering.

If you're standing up new configurations this cycle, that's the lens to use: for each thing you push, ask whether the device can now hold and report that state itself. More of the answers are "yes" in 27 than in any release before it.

This is the first in a short series on what changed in the 27 model. The next piece looks at something the WWDC talk sold as a convenience that the schema says is narrower than it sounds — the privacy consent changes, and why the "PPPC is dead" takes are early. When you need to rebuild or sanity-check a payload in the meantime, the PPPC Builder and the rest of the builders are here.

Sources

Every claim above traces to Apple's own primary material:

← Back to Field Notes