They removed the alternative: the macOS 27 change that isn't PPPC
By now you know macOS 27 removed the legacy software update commands. The change in the same release that I keep seeing people miss is the one that fails silently: a stricter network security floor under all of your management traffic.
By now you know the software update commands are gone in 27. Apple announced the removal last year, and in every 27.0 operating system it landed. The legacy software update commands stopped functioning, along with the queries and the restrictions like deferrals. What's left is declarative enforcement, which works differently than the old commands did. You declare a target version and a date, and the device drives itself there. There's no "patch now" button in that model.
If you've been reading along, none of that is new. The mechanism is a deadline: the com.apple.configuration.softwareupdate.enforcement.specific configuration takes a target OS version and a date, and the device updates itself to meet it. You're setting a deadline, not pressing install.
The part in the same release I keep seeing people miss
In all 27.0 operating systems, select system processes now enforce stricter network security on management traffic. Your MDM service has to meet TLS 1.2 as a floor, with cipher suites and certificates that clear the new App Transport Security bar, or those connections can fail. And it isn't scoped to one function. Device management, enrollment, profile installs, app installs, and software update traffic all ride that stricter requirement now.
Apple's own wording hedges here: the new requirements "might cause connections to fail" if the service doesn't meet them. So this is a floor you need to clear, not a switch that flips your fleet dark on day one. But it's a floor under everything, not one feature.
Why this is the one I'd worry about
The two changes fail in opposite ways, and that's the whole problem.
The software update removal is loud. It shows up the moment you try to run a command that no longer exists, and you know exactly what happened. A TLS handshake your MDM can't complete just looks like the service going quiet, so you go hunting in the wrong place: the device, the network, the profile, anywhere but the certificate on your management service.
What strikes me about the pairing is that Apple didn't ask us to adopt any of this. They removed the alternative and raised the floor under it in the same release. That framing only holds for software update; it's the one place where the old path is genuinely gone rather than deprecated. It is worth saying plainly because it's easy to over-read into the rest of 27, and the PPPC picture is the opposite: there, the old payload is still doing real work.
Before you touch 27
Confirm two things with your MDM vendor. Does it do declarative software update enforcement, and does its service clear the new TLS bar? Then test on one machine before it goes anywhere near the fleet.
One honest caveat: the 27 deployment guide is still pre-release, so the exact wording can shift before it's final. The software update removal is not in that category. It was announced last year and it's in effect across the 27.0 releases now.
Sources
Both changes below are in Apple's deployment guide and device-management schema:
- Apple Support — Device management updates (software update removal, network security)
- Apple — Device management schema (software update enforcement configuration)