Notes from What's new in device management - Thursday, June 13th 2024

What’s new in device management

• Apple services
• Platform updates
• Education enhancements

Apple services:

What's new in Apple Business Manager (ABM) / Apple School Manager (ASM)

• Apple Vision Pro support added to ABM / ASM

• Secure enrollment customization:

Automated Device Enrollment (ADE) on macOS 15 now supports WebAuthN for web authentication.

• Updated Setup Assistant skip keys

Check documentation for new and expanded skip keys for Setup Assistant windows in macOS 15. For example, the iOS Welcome skip key now also applies to macOS 15. The SkipSetupItems array in the Setup Assistant payload also can now be used on macOS.

Manage Activation Lock in ABM / ASM

Activation Lock can now be disabled for company-owned devices listed in ABM / ASM.

Management applies to:

• iPhone
• iPad
• Mac
• Apple Watch
• Vision Pro

Activation Lock management will be available for both organization and user Activation Lock.

For Macs, this means an organization can turn off Activation Lock even if a user enabled Activation Lock using their personal Apple ID before the Mac was enrolled in an MDM solution.


Identity:

Managed Apple Accounts (formerly Managed Apple IDs):

Domain capture:

Allow only managed Apple Accounts to be created:

If a DNS domain is registered with ABM / ASM, admins will have the ability to limit Apple Account creation to be only managed Apple Accounts. Unmanaged (aka personal) Apple Accounts will not be able to be created using that domain.

Initiate account capture after domain verification:

IT admins will be able to capture Apple Accounts which use their organization's domain without needing to connect to an identity provider.

- Previously, an identity provider needed to be connected to ABM / ASM to migrated unmanaged Apple Accounts to Managed Apple Accounts.

Users will also have the option to convert their existing unmanaged Apple Account directly to a Managed Apple Account. Previously, the unmanaged Apple Account needed to change their email address to an address outside of the organization's DNS domain.

This conversion process will automatically add the account to the organization in ABM / ASM. If no action is taken within 30 days, the account will remain an unmanaged Apple Account (aka a personal account) and will be renamed automatically to a new Apple-provided address which is outside of the organization's DNS domain.


Platform updates:

Managed software updates

Introducing new software update configuration
	- Replaces all legacy MDM software update management commands, profiles and restrictions.
	- New configuration can be used on iOS 18, iPadOS 18 and macOS 15, plus later versions of the OSs.
	- Control default notification behavior
		- Show notifications only 1 hour before enforcement times and the restart countdown
	- Manage beta updates


Safari management

Define allowed Safari browser extensions
Control managed Safari browser extensions
Configure Safari browser extension website access by domain and sub-domain

All controls work with Safari private browsing.

The user is provided with a visual indication of which extensions are managed.


Apple Vision Pro management

MDM enrollment options:

Device enrollment
User enrollment

For both enrollment types, users sign in using a Managed Apple Account.


Mac management:

Install IT management tools and other binaries using DDM
	- Tools and scripts are installed in a tamper-resistant location
	- Tools and binaries are delivered via .zip archive files.

LaunchD items can be deployed using the background task services configuration
	- Provides a way to create and control background tasks
	- LaunchD items deployed using this method are stored in a tamper-resistant location

Disk management configuration
	- Manage external and network storage
	- Allows IT admins to define a mount policy:
		- Allowed
		- Not allowed
		- Allowed as read-only
	- Replaces the media restrictions payload which was deprecated as of macOS 11 Big Sur.
		- Media restrictions payload will be removed in a future release of macOS.

Platform Single Sign On (PSSO)

	- Identity provider authentication can now unlock FileVault. This is because in macOS Sequoia, there's enough of a network stack at the FileVault pre-boot login screen to support connecting to PlatformSSO identity providers via a network connection (Wi-Fi, Ethernet, etc.)
	- Login policies can now require identity provider authentication in the following locations:
		- FileVault pre-boot login
		- OS Login window
		- Lock screen
	- Stronger security options
		- Hybrid public key encryption (HPKE): https://developer.apple.com/documentation/cryptokit/hpke

Demo of new PSSO capabilities applied to FileVault begins at 17:24 in the session video


Device Management in System Settings

	- Profiles section has been renamed to "Device Management"
	- Device Management is now in the General section of System Settings
	- Now more closely matches what's on iOS and iPadOS

Login Items and Extensions section has also been moved to the General section of System Settings.


iPhone and iPad management:

	- eSIM preservation when erasing a device
		- New management options for preventing eSIM deletion when device is wiped.
	- Manage transferring eSIM to a different device
		- New management options for controlling if an eSIM can be transferred to a newly setup device.
	- Set up eSIM on a device using link or QR code
	- Per-app VPN can route traffic to a specified 5G network slice
	- Multiple Private Cellular Network payloads are now supported

	- Locking and hiding apps
		- New management options for locking and hiding apps
		- Organizations can:
			- Restrict locking and hiding for all apps on supervised devices
			- Control locking and hiding on a per-app basis for managed apps
		Note: Hiding an app also locks an app, so restricting the ability to lock an app will also restrict the ability to hide the app.
		- On device enrollments, hidden apps remain visible to the MDM service.
		- On user enrollments, hidden managed apps remain visible to the MDM service.

	- Stolen device protection
		- On iOS 18, change to Stolen Device Protection specific to MDM enrollment
			- Enrolling in MDM, on a newly setup device without any familiar locations, will not cause a security delay for the first three hours after Stolen Device Protection is enabled.

	- Trust for in-house apps installed without the use of MDM
		- Installing proprietary in-house apps using a new team identity for code signing will require a restart, in addition to trusting the new team identity in Settings.
		- Each new team ID requires a single device restart.
		- This requirement only applies to in-house apps installed without the use of MDM.
		- Identities which were trusted before upgrading to iOS 18 / iPad OS 18 will be migrated, so restart is not required in this case.