Skip to content

Update what's new from WWDC 2026 w/ Fleet support + Apple IT summit #49440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
noahtalerman wants to merge 10 commits into
base: main
Choose a base branch
from
+7 −8
Draft

Update what's new from WWDC 2026 w/ Fleet support + Apple IT summit #49440

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
679c759
Display names for API endpoints are inconsistent w/ API reference
noahtalerman May 18, 2026
857ad98
Update rest-api.md
noahtalerman May 18, 2026
98b8335
Update custom.js
noahtalerman May 18, 2026
e0424cc
Fix conflicts
noahtalerman Jun 2, 2026
7f4a4f4
Update what's new from WWDC 2026 w/ Fleet support
noahtalerman Jul 16, 2026
bbb3417
Merge branch 'noahtalerman-patch-82' of https://github.com/fleetdm/fl…
noahtalerman Jul 16, 2026
5662366
Apply suggestion from @noahtalerman
noahtalerman Jul 16, 2026
3b02a71
Update wwdc-2026-what-it-admins-need-to-know.md
noahtalerman Jul 16, 2026
35b526f
Update fleet-server-configuration.md
noahtalerman Jul 16, 2026
87d64b7
Update wwdc-2026-what-it-admins-need-to-know.md
noahtalerman Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 5 additions & 7 deletions articles/wwdc-2026-what-it-admins-need-to-know.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,11 @@ Apple is raising the transport security floor for system processes involved in d

New requirement: TLS 1.2 minimum with ATS-compliant cipher suites and certificates. If your MDM or management infrastructure falls short, things break in ways that aren't always obvious. Enrollment failures, profiles not installing, update commands silently failing.

Apple published [support article 126655 ("Prepare your network environment for stricter security requirements")](https://support.apple.com/en-us/126655) to help you audit. Run it against your MDM and any internal management endpoints now, not in September.
Apple published [support article 126655 ("Prepare your network environment for stricter security requirements")](https://support.apple.com/en-us/126655) to help you audit. Run it against your MDM and any internal management endpoints now, not in September. If you're using Fleet, you no action needed. Fleet meets the new requirements.

@noahtalerman noahtalerman Jul 16, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@JordanMontgomery is this right?

@JordanMontgomery JordanMontgomery Jul 18, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not quite. There's nothing needed for cloud hosted customers however self hosted customers could still need to make changes


## New and migrated declarative configurations

> Enable the [`mdm.allow​_all​_declarations` feature flag](https://fleetdm.com/docs/configuration/fleet-server-configuration#mdm-allow-all-declarations) to deploy any device-scoped, configuration [declaration (DDM profile)](https://developer.apple.com/documentation/devicemanagement/devicemanagement-declarations) with Fleet. Assets and user-scoped declarations are [coming in Fleet 4.90](https://github.com/fleetdm/fleet/issues/38986). At the same time, Fleet will enable this feature flag out-of-the-box.
> Enable the [`mdm.allow​_all​_declarations` feature flag](https://fleetdm.com/docs/configuration/fleet-server-configuration#mdm-allow-all-declarations) to deploy any device-scoped, configuration [declaration (DDM profile)](https://developer.apple.com/documentation/devicemanagement/devicemanagement-declarations) with Fleet. Assets and user-scoped declarations are [coming in Fleet 4.90](https://github.com/fleetdm/fleet/issues/38986). At the same time, Fleet will enable this feature flag out-of-the-box. Custom activations are [coming in Fleet 4.91.0](https://github.com/fleetdm/fleet/issues/48222).

Apple keeps expanding what DDM can express. Here's what's new in OS 27.

Expand All @@ -45,8 +45,6 @@ Notable controls: `AllowGenmoji`, `AllowImagePlayground`, `AllowWritingTools`, `

**Content caching (macOS 27):** The `com.apple.configuration.content-cache.settings` configuration replaces the `com.apple.AssetCache.managed` profile. New status items for cache info, parents, and peers. Custom HTTPS reporting endpoints are supported. If you run content caches, plan the migration.

**Configuration profiles as declarative assets:** Legacy profiles can be delivered as declarative assets via the new `ProfileAssetReference` key in `com.apple.configuration.legacy`. Integrity verification is built in. This is a useful bridge for teams partway through the DDM transition.

@noahtalerman noahtalerman Jul 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI @kitzy I think we want to remove this because at the Apple IT summit in Cupertino we learned that the com.apple.configuration.legacy declaration is buggy. Some vendors mentioned they regret implementing it because it's not working as expected.

cc @JordanMontgomery @MagnusHJensen @melpike

@kitzy kitzy Jul 16, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm good w/ removing it.


## App management changes

**New unified app settings configuration:** `com.apple.configuration.app.settings` consolidates allowed and denied app management for iOS, iPadOS, tvOS, and visionOS. On macOS it adds binary-level control via Endpoint Security. A new `AlwaysAllowManagedApps` key preserves managed app access regardless of your allow-list configuration.
Expand Down Expand Up @@ -95,9 +93,9 @@ A few things worth setting user expectations on: Siri AI requires a user waitlis

If you're building your OS 27 response plan:

1. Verify your MDM vendor's DDM software update support. This is the fire drill. Do it today.
2. Audit TLS/ATS compliance across your MDM and management infrastructure using Apple's support article 126655.
3. Migrate Intelligence, Siri, and keyboard restrictions to the new declarative configurations.
1. Verify your MDM vendor's DDM software update support. This is the fire drill. Do it today. If you use Fleet, you're already set.
2. Audit TLS/ATS compliance across your MDM and management infrastructure using Apple's support article 126655. If you use Fleet, you're already set.
3. Migrate Intelligence, Siri, and keyboard restrictions to the new declarative configurations. Fleet already supports all declarations that are replacing deprecated v1 profiles (.mobileconfig). Assets and user-scoped declarations are [coming in Fleet 4.90](https://github.com/fleetdm/fleet/issues/38986). Custom activations are [coming in Fleet 4.91.0](https://github.com/fleetdm/fleet/issues/48222).

@noahtalerman noahtalerman Jul 16, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fleet already supports all declarations that are replacing deprecated v1 profiles (.mobileconfig)

@MagnusHJensen is this true today? (pre 4.90)

Do I have to turn on the feature flag? (mdm.allow​_all​_declarations)

4. Plan the app management migration away from `com.apple.applicationaccess.new` on macOS.
5. Update your re-enrollment runbooks to account for the backup restoration change.
6. Start the Intel Mac refresh conversation if you haven't already.
Expand Down
2 changes: 1 addition & 1 deletion docs/Configuration/fleet-server-configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3712,7 +3712,7 @@ Allows users to add custom Apple MDM profiles for FileVault management, includin

### mdm.allow_all_declarations

> Enable this feature flag to deploy any device-scoped, configuration [declaration (DDM profile)](https://developer.apple.com/documentation/devicemanagement/devicemanagement-declarations) with Fleet. Assets and user-scoped declarations are [coming in Fleet 4.89](https://github.com/fleetdm/fleet/issues/38986). At the same time, Fleet will enable this feature flag out-of-the-box.
> Enable this feature flag to deploy any device-scoped, configuration [declaration (DDM profile)](https://developer.apple.com/documentation/devicemanagement/devicemanagement-declarations) with Fleet. Assets and user-scoped declarations are [coming in Fleet 4.90](https://github.com/fleetdm/fleet/issues/38986). At the same time, Fleet will enable this feature flag out-of-the-box. Custom activations are [coming in Fleet 4.91.0](https://github.com/fleetdm/fleet/issues/48222).

If disabled (default), Fleet doesn't allow [these configurations](https://github.com/fleetdm/fleet/blob/9589631a7f25a342ed24571c08deffbc959661ec/server/fleet/apple_mdm.go#L704-L717).

Expand Down
1 change: 1 addition & 0 deletions website/config/custom.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ module.exports.custom = {
// 'docs/Contributing/reference/api-for-contributors.md': '', // « Covered in CODEOWNERS (2023-07-22)
'schema': 'rachaelshaw', // Data tables (osquery/fleetd schema) documentation
'docs/01-Using-Fleet/standard-query-library/standard-query-library.yml': 'rachaelshaw', //« Built-in queries
'server/api_endpoints/api_endpoints.yml': 'rachaelshaw', //« API endpoint display names in the Fleet UI (API-only users)
'docs/get-started/faq': 'zayhanlon',
'docs/Contributing/rituals': 'lukeheath',
'ee/cis': 'sharon-fdm',//« Fleet Premium only: built-in queries (built-in policies for CIS benchmarks) -- FYI: On 2023-07-15, we changed this so that Sharon, Lucas, and Rachel are all maintainers, but where there is a single DRI who is automatically requested approval from.
Expand Down
Loading