{"code":"var Component=(()=>{var p=Object.create;var r=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var u=Object.getPrototypeOf,k=Object.prototype.hasOwnProperty;var y=(n,e)=>()=>(e||n((e={exports:{}}).exports,e),e.exports),f=(n,e)=>{for(var t in e)r(n,t,{get:e[t],enumerable:!0})},l=(n,e,t,s)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let a of m(e))!k.call(n,a)&&a!==t&&r(n,a,{get:()=>e[a],enumerable:!(s=g(e,a))||s.enumerable});return n};var w=(n,e,t)=>(t=n!=null?p(u(n)):{},l(e||!n||!n.__esModule?r(t,\"default\",{value:n,enumerable:!0}):t,n)),v=n=>l(r({},\"__esModule\",{value:!0}),n);var h=y((S,d)=>{d.exports=_jsx_runtime});var E={};f(E,{default:()=>o});var i=w(h());function c(n){let e={a:\"a\",code:\"code\",em:\"em\",h2:\"h2\",h3:\"h3\",img:\"img\",li:\"li\",ol:\"ol\",p:\"p\",pre:\"pre\",span:\"span\",strong:\"strong\",table:\"table\",tbody:\"tbody\",td:\"td\",th:\"th\",thead:\"thead\",tr:\"tr\",ul:\"ul\",...n.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsxs)(e.p,{children:[\"If you manage Macs, macOS 27 Golden Gate changes two things that don't show up on any user's screen but can take down a patching process or an enrollment flow in a day. First, the MDM software update commands, queries and restrictions that most fleets have used for a decade \",(0,i.jsx)(e.strong,{children:\"no longer function\"}),\" on devices running 27.0. Second, every connection in the management path \\u2014 MDM, Declarative Device Management, Automated Device Enrollment, profile installation, app installation and software updates \\u2014 now \",(0,i.jsx)(e.strong,{children:\"refuses servers that don't meet App Transport Security rules\"}),\", where earlier releases only logged a warning.\"]}),`\n`,(0,i.jsx)(e.p,{children:\"Neither change is new information. Apple announced both before and at WWDC 2026. But now that 27.0 has shipped (on 14 September, build 26A428), they're live on any Mac that upgrades. This guide goes through what stops working, using Apple's own schema and support documents, how to audit your servers before your first Macs hit the problem, and what replaces each legacy mechanism.\"}),`\n`,(0,i.jsx)(e.p,{children:(0,i.jsx)(e.img,{alt:\"A Mac fleet dashboard with legacy update commands fading out and declarative policies taking their place\",src:\"/images/blog/macos-27-mdm-software-update-commands-removed-tls-requirements-admin-checklist-2026/hero.webp\",width:\"1024\",height:\"541\"})}),`\n`,(0,i.jsx)(e.h2,{id:\"key-takeaways\",children:\"Key Takeaways\"}),`\n`,(0,i.jsxs)(e.ul,{children:[`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Legacy software update management is gone on 27.0.\"}),' Apple: \"Legacy software update management no longer functions in all 27.0 operating systems.\" That covers the ',(0,i.jsx)(e.code,{children:\"ScheduleOSUpdate\"}),\", \",(0,i.jsx)(e.code,{children:\"ScheduleOSUpdateScan\"}),\", \",(0,i.jsx)(e.code,{children:\"AvailableOSUpdates\"}),\" and \",(0,i.jsx)(e.code,{children:\"OSUpdateStatus\"}),\" commands, the \",(0,i.jsx)(e.code,{children:\"com.apple.SoftwareUpdate\"}),\" payload, and the deferral restrictions.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"The replacement is declarative.\"}),\" \",(0,i.jsx)(e.code,{children:\"softwareupdate.enforcement.specific\"}),\" enforces a version by a deadline. \",(0,i.jsx)(e.code,{children:\"softwareupdate.settings\"}),\" covers deferrals, automatic actions, Background Security Improvements and beta enrollment. Status items replace the queries.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Recommended cadence has no macOS equivalent.\"}),\" Apple's schema marks the declarative \",(0,i.jsx)(e.code,{children:\"RecommendedCadence\"}),\" key as not available on macOS.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"The TLS rules are now enforced for the management path.\"}),\" That means TLS 1.2 or later, forward-secret cipher suites, RSA \\u2265 2048 or ECDSA \\u2265 256 certificates signed with SHA-2, and the extended master secret extension. Only SCEP servers and content caching servers are exempt.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"You can audit before devices upgrade.\"}),\" On earlier releases the same checks log warnings. Apple documents the log predicate for finding them.\"]}),`\n`]}),`\n`,(0,i.jsx)(e.h2,{id:\"change-1-legacy-software-update-management-no-longer-functions\",children:\"Change 1: Legacy Software Update Management No Longer Functions\"}),`\n`,(0,i.jsx)(e.p,{children:`Apple's WWDC 2026 device management update put it in one sentence: \"Legacy software update management no longer functions in all 27.0 operating systems.\" It then lists what that covers: software update commands, software update queries, recommended cadence settings, and software update restrictions, including deferrals and Background Security Improvements.`}),`\n`,(0,i.jsxs)(e.p,{children:[\"Apple's published device-management schema \\u2014 the YAML files in the \",(0,i.jsx)(e.code,{children:\"apple/device-management\"}),\" repository that MDM vendors build against \\u2014 gives the precise status for each item. For macOS:\"]}),`\n`,(0,i.jsxs)(e.table,{children:[(0,i.jsx)(e.thead,{children:(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.th,{children:\"Legacy mechanism\"}),(0,i.jsx)(e.th,{children:\"Schema status (macOS)\"}),(0,i.jsx)(e.th,{children:\"Declarative replacement\"})]})}),(0,i.jsxs)(e.tbody,{children:[(0,i.jsxs)(e.tr,{children:[(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"ScheduleOSUpdate\"}),\" command\"]}),(0,i.jsx)(e.td,{children:\"Deprecated 26.0, removed 27.0\"}),(0,i.jsx)(e.td,{children:(0,i.jsx)(e.code,{children:\"com.apple.configuration.softwareupdate.enforcement.specific\"})})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"ScheduleOSUpdateScan\"}),\" command\"]}),(0,i.jsx)(e.td,{children:\"Deprecated 26.0, removed 27.0\"}),(0,i.jsx)(e.td,{children:\"Not needed \\u2014 the device scans on its own and reports status\"})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"AvailableOSUpdates\"}),\" query\"]}),(0,i.jsx)(e.td,{children:\"Deprecated 26.0, removed 27.0\"}),(0,i.jsxs)(e.td,{children:[\"Status item \",(0,i.jsx)(e.code,{children:\"softwareupdate.pending-version\"})]})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"OSUpdateStatus\"}),\" query\"]}),(0,i.jsx)(e.td,{children:\"Deprecated 26.0, removed 27.0\"}),(0,i.jsxs)(e.td,{children:[\"Status items \",(0,i.jsx)(e.code,{children:\"softwareupdate.install-state\"}),\", \",(0,i.jsx)(e.code,{children:\"softwareupdate.failure-reason\"}),\", \",(0,i.jsx)(e.code,{children:\"softwareupdate.install-reason\"})]})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"com.apple.SoftwareUpdate\"}),\" profile payload\"]}),(0,i.jsx)(e.td,{children:\"Deprecated 26.0, removed 27.0\"}),(0,i.jsx)(e.td,{children:(0,i.jsx)(e.code,{children:\"com.apple.configuration.softwareupdate.settings\"})})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsxs)(e.td,{children:[\"Restrictions \",(0,i.jsx)(e.code,{children:\"forceDelayedSoftwareUpdates\"}),\", \",(0,i.jsx)(e.code,{children:\"forceDelayedMajorSoftwareUpdates\"}),\", \",(0,i.jsx)(e.code,{children:\"forceDelayedAppSoftwareUpdates\"}),\", \",(0,i.jsx)(e.code,{children:\"enforcedSoftwareUpdateDelay\"})]}),(0,i.jsx)(e.td,{children:\"Deprecated 26.0, removed 27.0\"}),(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"softwareupdate.settings\"}),\" \\u2192 \",(0,i.jsx)(e.code,{children:\"Deferrals\"})]})]})]})]}),`\n`,(0,i.jsxs)(e.p,{children:[\"The schema snapshot we used is the repository's \",(0,i.jsx)(e.code,{children:\"release\"}),\" branch as of 18 September 2026. If your MDM vendor's console still shows the legacy options, they're for devices on 26.x and earlier. On a Mac running 27.0 they do nothing.\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"what-the-declarative-settings-cover\",children:\"What the declarative settings cover\"}),`\n`,(0,i.jsxs)(e.p,{children:[\"The \",(0,i.jsx)(e.code,{children:\"softwareupdate.settings\"}),\" configuration is where most legacy restrictions have moved. Its top-level keys, from Apple's schema:\"]}),`\n`,(0,i.jsxs)(e.table,{children:[(0,i.jsx)(e.thead,{children:(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.th,{children:\"Key\"}),(0,i.jsx)(e.th,{children:\"What it controls\"})]})}),(0,i.jsxs)(e.tbody,{children:[(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:(0,i.jsx)(e.code,{children:\"Notifications\"})}),(0,i.jsx)(e.td,{children:\"Whether the user sees update notifications\"})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:(0,i.jsx)(e.code,{children:\"Deferrals\"})}),(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"CombinedPeriodInDays\"}),\", \",(0,i.jsx)(e.code,{children:\"MajorPeriodInDays\"}),\", \",(0,i.jsx)(e.code,{children:\"MinorPeriodInDays\"}),\", \",(0,i.jsx)(e.code,{children:\"SystemPeriodInDays\"})]})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:(0,i.jsx)(e.code,{children:\"AutomaticActions\"})}),(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"Download\"}),\", \",(0,i.jsx)(e.code,{children:\"InstallOSUpdates\"}),\", \",(0,i.jsx)(e.code,{children:\"InstallSecurityUpdate\"})]})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:(0,i.jsx)(e.code,{children:\"RapidSecurityResponse\"})}),(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"Enable\"}),\", \",(0,i.jsx)(e.code,{children:\"EnableRollback\"}),' \\u2014 titled \"Background Security Improvements settings\" in the schema']})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:(0,i.jsx)(e.code,{children:\"AllowStandardUserOSUpdates\"})}),(0,i.jsx)(e.td,{children:\"Whether a non-admin user can install OS updates\"})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:(0,i.jsx)(e.code,{children:\"Beta\"})}),(0,i.jsxs)(e.td,{children:[(0,i.jsx)(e.code,{children:\"ProgramEnrollment\"}),\", \",(0,i.jsx)(e.code,{children:\"OfferPrograms\"}),\", \",(0,i.jsx)(e.code,{children:\"RequireProgram\"}),\" for AppleSeed and developer betas\"]})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:(0,i.jsx)(e.code,{children:\"RecommendedCadence\"})}),(0,i.jsx)(e.td,{children:'Marked \"n/a\" for macOS in the schema'})]})]})]}),`\n`,(0,i.jsxs)(e.p,{children:[`The schema also notes that Background Security Improvements \"aren't considered in `,(0,i.jsx)(e.code,{children:\"Major\"}),\", \",(0,i.jsx)(e.code,{children:\"Minor\"}),\", or \",(0,i.jsx)(e.code,{children:\"System\"}),` deferral mechanism\". A deferral on major updates doesn't hold back a background security fix. If you need to control those, use the `,(0,i.jsx)(e.code,{children:\"RapidSecurityResponse\"}),\" keys. Our \",(0,i.jsx)(e.a,{href:\"/blog/apple-background-security-improvements-bsi-macos-tahoe-guide-2026\",children:\"Background Security Improvements guide\"}),\" explains what those updates are.\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"the-recommended-cadence-gap\",children:\"The recommended cadence gap\"}),`\n`,(0,i.jsxs)(e.p,{children:['Legacy MDM let you set a \"recommended cadence\" that decided which update a user saw when both a minor update and a new major version were available. Apple lists recommended cadence among the legacy settings that stop working, and the declarative ',(0,i.jsx)(e.code,{children:\"RecommendedCadence\"}),\" key in the current schema says \",(0,i.jsx)(e.code,{children:\"introduced: n/a\"}),\" for macOS. That means there's no like-for-like replacement on the Mac today.\"]}),`\n`,(0,i.jsxs)(e.p,{children:[\"In practice, you shape what users see with \",(0,i.jsx)(e.strong,{children:\"deferrals\"}),\", which hide a release for a set number of days, and \",(0,i.jsx)(e.strong,{children:\"enforcement\"}),\", which pins the version you want by a deadline. That's more work than a single cadence switch, and it's worth telling your service desk about the change before users start asking why a major upgrade suddenly appears.\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"enforcing-a-version-on-270\",children:\"Enforcing a version on 27.0\"}),`\n`,(0,i.jsx)(e.p,{children:\"The enforcement declaration is the one you'll use most. It names a target and a deadline:\"}),`\n`,(0,i.jsx)(i.Fragment,{children:(0,i.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,i.jsxs)(e.code,{children:[(0,i.jsx)(e.span,{className:\"line\",children:(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"{\"})}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'  \"Type\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:'\"com.apple.configuration.softwareupdate.enforcement.specific\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\",\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'  \"Identifier\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:'\"com.example.su.macos-27-0-1\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\",\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'  \"Payload\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": {\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'    \"TargetOSVersion\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:'\"27.0.1\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\",\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'    \"TargetLocalDateTime\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:'\"2026-10-15T18:00:00\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\",\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'    \"DetailsURL\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:'\"https://intranet.example.com/updates\"'})]}),`\n`,(0,i.jsx)(e.span,{className:\"line\",children:(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"  }\"})}),`\n`,(0,i.jsx)(e.span,{className:\"line\",children:(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"}\"})})]})})}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.code,{children:\"TargetOSVersion\"}),\" and \",(0,i.jsx)(e.code,{children:\"TargetLocalDateTime\"}),\" are the core keys. There's also \",(0,i.jsx)(e.code,{children:\"TargetBuildVersion\"}),\" for pinning an exact build, which takes precedence when both are set. The version in the example is illustrative \\u2014 as of this writing no 27.0.1 has shipped. Your MDM vendor will usually give you a form rather than raw JSON, but knowing the keys helps when you're reading the declaration in a device's status to find out why it didn't install.\"]}),`\n`,(0,i.jsx)(e.h2,{id:\"one-policy-written-both-ways\",children:\"One Policy, Written Both Ways\"}),`\n`,(0,i.jsx)(e.p,{children:\"A concrete example makes the migration easier to picture. Take a common policy: hold major upgrades for 30 days, and keep automatic downloads and security updates switched on.\"}),`\n`,(0,i.jsxs)(e.p,{children:[\"The legacy version is a set of restriction keys in a \",(0,i.jsx)(e.code,{children:\"com.apple.applicationaccess\"}),\" payload:\"]}),`\n`,(0,i.jsx)(i.Fragment,{children:(0,i.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,i.jsxs)(e.code,{children:[(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"<\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#22863A\",\"--shiki-dark\":\"#85E89D\"},children:\"key\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\">forceDelayedMajorSoftwareUpdates</\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#22863A\",\"--shiki-dark\":\"#85E89D\"},children:\"key\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\">\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"<\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#22863A\",\"--shiki-dark\":\"#85E89D\"},children:\"true\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"/>\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"<\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#22863A\",\"--shiki-dark\":\"#85E89D\"},children:\"key\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\">enforcedSoftwareUpdateMajorOSDeferredInstallDelay</\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#22863A\",\"--shiki-dark\":\"#85E89D\"},children:\"key\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\">\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"<\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#22863A\",\"--shiki-dark\":\"#85E89D\"},children:\"integer\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\">30</\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#22863A\",\"--shiki-dark\":\"#85E89D\"},children:\"integer\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\">\"})]})]})})}),`\n`,(0,i.jsx)(e.p,{children:\"A Tahoe Mac honours this. A Golden Gate Mac ignores it.\"}),`\n`,(0,i.jsx)(e.p,{children:\"The declarative version puts the same intent in one configuration:\"}),`\n`,(0,i.jsx)(i.Fragment,{children:(0,i.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>',children:(0,i.jsxs)(e.code,{children:[(0,i.jsx)(e.span,{className:\"line\",children:(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"{\"})}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'  \"Type\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:'\"com.apple.configuration.softwareupdate.settings\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\",\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'  \"Identifier\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:'\"com.example.su.settings\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\",\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'  \"Payload\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": {\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'    \"Deferrals\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": { \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'\"MajorPeriodInDays\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\"30\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\" },\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'    \"AutomaticActions\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": {\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'      \"Download\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:'\"AlwaysOn\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\",\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:'      \"InstallSecurityUpdate\"'}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\": \"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:'\"AlwaysOn\"'})]}),`\n`,(0,i.jsx)(e.span,{className:\"line\",children:(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"    }\"})}),`\n`,(0,i.jsx)(e.span,{className:\"line\",children:(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"  }\"})}),`\n`,(0,i.jsx)(e.span,{className:\"line\",children:(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#24292E\",\"--shiki-dark\":\"#E1E4E8\"},children:\"}\"})})]})})}),`\n`,(0,i.jsx)(e.p,{children:\"Three details from Apple's schema are worth knowing before you write your own:\"}),`\n`,(0,i.jsxs)(e.ul,{children:[`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Deferral values run from 1 to 90 days\"}),\", the same range as the legacy delay keys.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"When several declarations set the same key, the device combines them by rule.\"}),\" Deferrals use \",(0,i.jsx)(e.code,{children:\"number-max\"}),\" (the longest deferral wins), the automatic actions use \",(0,i.jsx)(e.code,{children:\"enum-last\"}),\", and \",(0,i.jsx)(e.code,{children:\"Notifications\"}),\" uses \",(0,i.jsx)(e.code,{children:\"boolean-and\"}),\" \\u2014 if any declaration turns notifications off, they're off. A leftover test declaration with a 90-day deferral will quietly override your 30-day policy, so check what's assigned before you debug anything else.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsxs)(e.strong,{children:[\"The automatic actions take \",(0,i.jsx)(e.code,{children:\"Allowed\"}),\", \",(0,i.jsx)(e.code,{children:\"AlwaysOn\"}),\" or \",(0,i.jsx)(e.code,{children:\"AlwaysOff\"})]}),\", and default to \",(0,i.jsx)(e.code,{children:\"Allowed\"}),\". Apple's schema describes \",(0,i.jsx)(e.code,{children:\"AlwaysOn\"}),' as \"always enabled\" and ',(0,i.jsx)(e.code,{children:\"AlwaysOff\"}),' as \"always disabled\". ',(0,i.jsx)(e.code,{children:\"Allowed\"}),\" is the one to pick if you want to leave the choice to the user.\"]}),`\n`]}),`\n`,(0,i.jsx)(e.h3,{id:\"reading-the-result-back\",children:\"Reading the result back\"}),`\n`,(0,i.jsxs)(e.p,{children:[\"Declarative management reports state through status items instead of queries. The \",(0,i.jsx)(e.code,{children:\"softwareupdate.install-state\"}),\" item takes one of five values: \",(0,i.jsx)(e.code,{children:\"none\"}),\", \",(0,i.jsx)(e.code,{children:\"downloading\"}),\", \",(0,i.jsx)(e.code,{children:\"prepared\"}),\", \",(0,i.jsx)(e.code,{children:\"installing\"}),\" or \",(0,i.jsx)(e.code,{children:\"failed\"}),\". Paired with \",(0,i.jsx)(e.code,{children:\"softwareupdate.pending-version\"}),\", which says what the device intends to install, and \",(0,i.jsx)(e.code,{children:\"softwareupdate.failure-reason\"}),\" when something goes wrong, that's everything the old \",(0,i.jsx)(e.code,{children:\"OSUpdateStatus\"}),\" query told you. And the device sends it when the state changes, rather than when you remember to ask.\"]}),`\n`,(0,i.jsx)(e.h2,{id:\"the-mixed-fleet-trap\",children:\"The Mixed-Fleet Trap\"}),`\n`,(0,i.jsx)(e.p,{children:\"For the next year your fleet will include Macs on Tahoe 26.x, which still honour the deprecated legacy mechanisms, and Macs on Golden Gate 27.0, which ignore them. That creates three risks:\"}),`\n`,(0,i.jsxs)(e.ol,{children:[`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"A deferral that only half works.\"}),\" A legacy \",(0,i.jsx)(e.code,{children:\"forceDelayedMajorSoftwareUpdates\"}),\" restriction still holds Tahoe Macs back. Once a Mac is on 27, only a declarative \",(0,i.jsx)(e.code,{children:\"Deferrals\"}),\" setting affects it. If you want the same policy on both, define it in both places.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Reporting that goes blank.\"}),\" Dashboards built on \",(0,i.jsx)(e.code,{children:\"OSUpdateStatus\"}),\" and \",(0,i.jsx)(e.code,{children:\"AvailableOSUpdates\"}),' responses show nothing for 27.0 devices. Switch your reports to the declarative status items before those devices look \"unknown\".']}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Scripts that assume the command landed.\"}),\" Automation that sends \",(0,i.jsx)(e.code,{children:\"ScheduleOSUpdate\"}),\" and waits for a result will wait forever on a 27.0 Mac. Check your runbooks and any API scripts against your MDM for legacy command calls.\"]}),`\n`]}),`\n`,(0,i.jsxs)(e.p,{children:[\"The simplest approach is to move every Mac to declarative software update management now, including those still on Tahoe, where DDM software update declarations already work. Keep the legacy settings only as a safety net for devices you can't move yet. Our guide to \",(0,i.jsx)(e.a,{href:\"/blog/macos-27-not-showing-software-update-mac-wont-upgrade-fix-2026\",children:\"why macOS 27 isn't showing in Software Update\"}),\" covers how deferrals decide whether the upgrade is offered in the first place.\"]}),`\n`,(0,i.jsx)(e.p,{children:(0,i.jsx)(e.img,{alt:\"Two groups of Macs receiving different kinds of update policies side by side\",src:\"/images/blog/macos-27-mdm-software-update-commands-removed-tls-requirements-admin-checklist-2026/content-1.webp\",width:\"1024\",height:\"541\"})}),`\n`,(0,i.jsx)(e.h2,{id:\"change-2-stricter-tls-for-the-management-path\",children:\"Change 2: Stricter TLS for the Management Path\"}),`\n`,(0,i.jsxs)(e.p,{children:[\"Apple published the requirements in its support article \",(0,i.jsx)(e.em,{children:\"Prepare your network environment for stricter security requirements\"}),\", dated 9 June 2026, and repeats them in the macOS 27 release notes. Servers in the management path must:\"]}),`\n`,(0,i.jsxs)(e.table,{children:[(0,i.jsx)(e.thead,{children:(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.th,{children:\"Requirement\"}),(0,i.jsx)(e.th,{children:\"Detail\"})]})}),(0,i.jsxs)(e.tbody,{children:[(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:\"Protocol\"}),(0,i.jsx)(e.td,{children:'TLS 1.2 or later; TLS 1.3 \"whenever possible\"'})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:\"Cipher suites\"}),(0,i.jsx)(e.td,{children:\"Forward secrecy \\u2014 any TLS 1.3 suite, or TLS 1.2 suites with ECDHE\"})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:\"Certificate keys\"}),(0,i.jsx)(e.td,{children:\"RSA at least 2048 bits, ECDSA at least 256 bits\"})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:\"Signature hash\"}),(0,i.jsx)(e.td,{children:\"SHA-2 with a digest of at least 256 bits\"})]}),(0,i.jsxs)(e.tr,{children:[(0,i.jsx)(e.td,{children:\"TLS 1.2 extension\"}),(0,i.jsx)(e.td,{children:\"Extended master secret (EMS), RFC 7627\"})]})]})]}),`\n`,(0,i.jsx)(e.p,{children:\"The affected workflows, in Apple's list: mobile device management, Declarative Device Management, Automated Device Enrollment, configuration profile installation, app installation (including enterprise app distribution), and software updates.\"}),`\n`,(0,i.jsxs)(e.p,{children:[\"Two exceptions are spelled out. Connections to a \",(0,i.jsx)(e.strong,{children:\"SCEP server\"}),\", while installing a profile or resolving a DDM asset, aren't affected. Neither are \",(0,i.jsx)(e.strong,{children:\"content caching servers\"}),\", even when they serve app or software update assets.\"]}),`\n`,(0,i.jsx)(e.p,{children:`What changes on 27.0 is the consequence. Apple's article: \"Non-compliant connections are blocked and the log messages appear as errors instead of warnings.\" The check itself isn't new. Earlier releases already logged these violations as warnings, and that's what makes it possible to audit now.`}),`\n`,(0,i.jsx)(e.h3,{id:\"where-old-tls-is-still-hiding\",children:\"Where old TLS is still hiding\"}),`\n`,(0,i.jsx)(e.p,{children:\"Public MDM services have been compliant for years. The risk lives in what you host or put in the path yourself:\"}),`\n`,(0,i.jsxs)(e.ul,{children:[`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Self-hosted MDM\"}),\" behind an older reverse proxy or load balancer, where the TLS configuration was set once and never revisited\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"In-house app distribution\"}),\" \\u2014 the server hosting enterprise app manifests and \",(0,i.jsx)(e.code,{children:\".ipa\"}),\" or \",(0,i.jsx)(e.code,{children:\".pkg\"}),\" files\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Package and asset hosts\"}),\" that DDM asset declarations or custom install workflows point to\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"TLS-inspecting firewalls and proxies\"}),\" that re-sign traffic with their own certificate, which then has to meet the same key-size and hash requirements\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Old certificate chains\"}),\" \\u2014 RSA 1024 keys or SHA-1 signatures on an internal CA\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Old TLS stacks\"}),\" that negotiate TLS 1.2 but not the extended master secret extension\"]}),`\n`]}),`\n`,(0,i.jsx)(e.h2,{id:\"how-to-audit-before-your-macs-upgrade\",children:\"How to Audit Before Your Macs Upgrade\"}),`\n`,(0,i.jsxs)(e.h3,{id:\"step-1-test-each-server-with-nscurl\",children:[\"Step 1: Test each server with \",(0,i.jsx)(e.code,{children:\"nscurl\"})]}),`\n`,(0,i.jsx)(e.p,{children:\"macOS includes an ATS test tool. Point it at each server in your management path:\"}),`\n`,(0,i.jsx)(i.Fragment,{children:(0,i.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,i.jsx)(e.code,{children:(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"nscurl\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --ats-diagnostics\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" https://mdm.example.com\"})]})})})}),`\n`,(0,i.jsxs)(e.p,{children:[\"It tries the connection under a series of ATS configurations and prints \",(0,i.jsx)(e.code,{children:\"Result : PASS\"}),\" or \",(0,i.jsx)(e.code,{children:\"Result : FAIL\"}),\" for each one. The first block, \",(0,i.jsx)(e.strong,{children:\"Default ATS Secure Connection\"}),\", is the one that matters here. As a sanity check we ran it on a Tahoe Mac against two public servers. \",(0,i.jsx)(e.code,{children:\"www.apple.com\"}),\" passed all 61 checks. A public test server that only offers TLS 1.0 passed none, starting with the default secure connection.\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"step-2-check-the-extended-master-secret\",children:\"Step 2: Check the extended master secret\"}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.code,{children:\"nscurl\"}),\" doesn't break out EMS separately, and it's the requirement older TLS stacks are most likely to miss. OpenSSL 3.x reports it directly. The system \",(0,i.jsx)(e.code,{children:\"openssl\"}),\" on macOS is LibreSSL, so use one from Homebrew:\"]}),`\n`,(0,i.jsx)(i.Fragment,{children:(0,i.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,i.jsxs)(e.code,{children:[(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\"echo\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" openssl\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" s_client\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -connect\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" mdm.example.com:443\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -tls1_2\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -servername\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" mdm.example.com\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" 2>\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"/dev/null\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" \\\\\"})]}),`\n`,(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\"  |\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -E\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:' \"Protocol|Cipher|Server public key|Extended master secret\"'})]})]})})}),`\n`,(0,i.jsxs)(e.p,{children:[\"Against \",(0,i.jsx)(e.code,{children:\"www.apple.com\"}),\", this prints \",(0,i.jsx)(e.code,{children:\"Protocol: TLSv1.2\"}),\", an \",(0,i.jsx)(e.code,{children:\"ECDHE-RSA-AES256-GCM-SHA384\"}),\" cipher, a 2048-bit server key and \",(0,i.jsx)(e.code,{children:\"Extended master secret: yes\"}),\". You want every server in the path to look like that or better.\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"step-3-let-the-devices-tell-you\",children:\"Step 3: Let the devices tell you\"}),`\n`,(0,i.jsx)(e.p,{children:\"Server-by-server testing only covers servers you know about. Apple's recommended audit catches the rest by recording what devices actually connect to:\"}),`\n`,(0,i.jsxs)(e.ol,{children:[`\n`,(0,i.jsxs)(e.li,{children:[\"Install Apple's \",(0,i.jsx)(e.strong,{children:\"Network Diagnostics Logging\"}),\" profile on a test Mac.\"]}),`\n`,(0,i.jsx)(e.li,{children:\"Run the workflows you care about: enrollment, profile installation, app installation, a software update.\"}),`\n`,(0,i.jsx)(e.li,{children:\"Collect a sysdiagnose from that Mac.\"}),`\n`,(0,i.jsx)(e.li,{children:\"Search the log archive with Apple's predicate:\"}),`\n`]}),`\n`,(0,i.jsx)(i.Fragment,{children:(0,i.jsx)(e.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'<svg viewBox=\"0 0 24 24\"><path d=\"m 4,4 a 1,1 0 0 0 -0.7070312,0.2929687 1,1 0 0 0 0,1.4140625 L 8.5859375,11 3.2929688,16.292969 a 1,1 0 0 0 0,1.414062 1,1 0 0 0 1.4140624,0 l 5.9999998,-6 a 1.0001,1.0001 0 0 0 0,-1.414062 L 4.7070312,4.2929687 A 1,1 0 0 0 4,4 Z m 8,14 a 1,1 0 0 0 -1,1 1,1 0 0 0 1,1 h 8 a 1,1 0 0 0 1,-1 1,1 0 0 0 -1,-1 z\" fill=\"currentColor\" /></svg>',children:(0,i.jsx)(e.code,{children:(0,i.jsxs)(e.span,{className:\"line\",children:[(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"log\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" show\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --archive\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" system_logs.logarchive\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --info\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -P\"}),(0,i.jsx)(e.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:` \"p=appstoreagent|appstored|managedappdistributionagent|managedappdistributiond|ManagedClient|ManagedClientAgent|mdmclient|mdmd|mdmuserd|MuseBuddyApp|NanoSettings|Preferences|profiled|profiles|RemoteManagementAgent|remotemanagementd|Setup|'Setup Assistant'|'System Settings'|teslad|TVSettings|TVSetup|XPCAcmeService AND s=com.apple.network AND m:'ATS Violation'|'ATS FCPv2.1 violation'\"`})]})})})}),`\n`,(0,i.jsx)(e.p,{children:\"On a Mac running 26.x, any hits are warnings: those connections will be blocked when that Mac upgrades. On a 27.0 Mac, the same hits appear as errors, and those connections are already failing.\"}),`\n`,(0,i.jsx)(e.p,{children:\"Run the test on a Tahoe Mac and you get a list of what will break, before anything actually has.\"}),`\n`,(0,i.jsx)(e.p,{children:(0,i.jsx)(e.img,{alt:\"A checklist of server connections with most marked secure and one flagged for attention\",src:\"/images/blog/macos-27-mdm-software-update-commands-removed-tls-requirements-admin-checklist-2026/content-2.webp\",width:\"1024\",height:\"541\"})}),`\n`,(0,i.jsx)(e.h2,{id:\"a-rollout-checklist\",children:\"A Rollout Checklist\"}),`\n`,(0,i.jsx)(e.p,{children:\"Here's the order we'd work through it in, for a fleet that's about to see its first 27.0 upgrades:\"}),`\n`,(0,i.jsxs)(e.ol,{children:[`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"List every server in the management path\"}),\": MDM server and check-in URLs, the Automated Device Enrollment configuration, app manifest and package hosts, DDM asset URLs, and any proxy or firewall that inspects that traffic.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsxs)(e.strong,{children:[\"Run \",(0,i.jsx)(e.code,{children:\"nscurl --ats-diagnostics\"}),\" against each one\"]}),\" and fix anything that fails the default secure connection.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Check EMS\"}),\" with OpenSSL 3.x on every server that terminates TLS 1.2.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Run Apple's log audit\"}),\" on one Tahoe test Mac through a full enrollment-to-update cycle.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Recreate your update policy declaratively\"}),\": enforcement declarations for target versions, \",(0,i.jsx)(e.code,{children:\"softwareupdate.settings\"}),\" for deferrals, automatic actions and Background Security Improvements.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Switch reporting\"}),\" from \",(0,i.jsx)(e.code,{children:\"OSUpdateStatus\"}),\" and \",(0,i.jsx)(e.code,{children:\"AvailableOSUpdates\"}),\" to the declarative status items.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Search your automation\"}),\" for legacy command names: \",(0,i.jsx)(e.code,{children:\"ScheduleOSUpdate\"}),\", \",(0,i.jsx)(e.code,{children:\"ScheduleOSUpdateScan\"}),\", \",(0,i.jsx)(e.code,{children:\"AvailableOSUpdates\"}),\", \",(0,i.jsx)(e.code,{children:\"OSUpdateStatus\"}),\".\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Tell the service desk\"}),\" that cadence-based update hiding is gone on 27.0, and what users will see instead.\"]}),`\n`,(0,i.jsxs)(e.li,{children:[(0,i.jsx)(e.strong,{children:\"Upgrade a pilot group\"}),\", and confirm that enrollment, app installation and update enforcement all still work on real 27.0 hardware before widening it.\"]}),`\n`]}),`\n`,(0,i.jsx)(e.h2,{id:\"troubleshooting-common-issues\",children:\"Troubleshooting Common Issues\"}),`\n`,(0,i.jsx)(e.h3,{id:\"a-270-mac-ignores-the-update-deadline-you-set\",children:\"A 27.0 Mac ignores the update deadline you set\"}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Problem\"}),\": A Mac that upgraded to Golden Gate doesn't install the minor update your policy requires.\"]}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Solution\"}),\": Check which mechanism the policy uses. If it's a legacy \",(0,i.jsx)(e.code,{children:\"ScheduleOSUpdate\"}),\" command or MDM restriction, it no longer functions on 27.0. Deliver a \",(0,i.jsx)(e.code,{children:\"softwareupdate.enforcement.specific\"}),\" declaration instead, and read the device's \",(0,i.jsx)(e.code,{children:\"softwareupdate.failure-reason\"}),\" status if it still doesn't install.\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"update-reports-show-unknown-for-new-macs\",children:'Update reports show \"unknown\" for new Macs'}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Problem\"}),\": Your patch dashboard shows no update data for Macs on 27.0.\"]}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Solution\"}),\": The dashboard is reading legacy query responses. Switch it to the declarative status items \",(0,i.jsx)(e.code,{children:\"softwareupdate.install-state\"}),\" and \",(0,i.jsx)(e.code,{children:\"softwareupdate.pending-version\"}),\".\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"enrollment-works-on-tahoe-and-fails-on-golden-gate\",children:\"Enrollment works on Tahoe and fails on Golden Gate\"}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Problem\"}),\": A new Mac running 27.0 fails during Automated Device Enrollment, while a Tahoe Mac with the same configuration succeeds.\"]}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Solution\"}),\": This is the TLS change until proven otherwise. Test every URL in the enrollment flow with \",(0,i.jsx)(e.code,{children:\"nscurl --ats-diagnostics\"}),\", and check the device's logs for ATS errors from \",(0,i.jsx)(e.code,{children:\"mdmclient\"}),\", \",(0,i.jsx)(e.code,{children:\"Setup Assistant\"}),\" or \",(0,i.jsx)(e.code,{children:\"profiles\"}),\".\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"enterprise-apps-wont-install-on-270\",children:\"Enterprise apps won't install on 27.0\"}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Problem\"}),\": Custom apps distributed from your own server fail to install.\"]}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Solution\"}),\": The manifest or package host probably fails the TLS requirements. It's often an older web server that was never part of the MDM hardening effort. Content caching servers are exempt, so the problem is the origin host.\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"a-tls-inspecting-firewall-breaks-management-traffic\",children:\"A TLS-inspecting firewall breaks management traffic\"}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Problem\"}),\": Everything works off the corporate network and fails on it.\"]}),`\n`,(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.strong,{children:\"Solution\"}),\": The inspecting device re-signs connections with its own certificate and TLS settings, which now have to meet the ATS requirements. Either upgrade its configuration or exclude your management hosts and Apple's MDM endpoints from inspection.\"]}),`\n`,(0,i.jsx)(e.h2,{id:\"faq\",children:\"FAQ\"}),`\n`,(0,i.jsx)(e.h3,{id:\"do-legacy-software-update-commands-still-work-on-macos-26\",children:\"Do legacy software update commands still work on macOS 26?\"}),`\n`,(0,i.jsx)(e.p,{children:\"Yes. Apple's schema marks them deprecated in 26.0 and removed in 27.0, so Macs on Tahoe still honour them. Macs on 27.0 don't. During the transition, define policies declaratively so every Mac gets the same result.\"}),`\n`,(0,i.jsx)(e.h3,{id:\"what-replaces-the-recommended-cadence-setting\",children:\"What replaces the recommended cadence setting?\"}),`\n`,(0,i.jsxs)(e.p,{children:[\"On macOS, nothing directly. Apple's schema marks the declarative \",(0,i.jsx)(e.code,{children:\"RecommendedCadence\"}),\" key as unavailable on macOS. Use deferrals to hide releases and enforcement declarations to require the version you want.\"]}),`\n`,(0,i.jsx)(e.h3,{id:\"are-content-caching-servers-affected-by-the-tls-change\",children:\"Are content caching servers affected by the TLS change?\"}),`\n`,(0,i.jsx)(e.p,{children:'No. Apple lists content caching servers as an exception, \"even when requesting assets related to app installation or software updates\". SCEP servers are also exempt.'}),`\n`,(0,i.jsx)(e.h3,{id:\"how-do-i-know-which-of-my-servers-fail-before-any-mac-upgrades\",children:\"How do I know which of my servers fail before any Mac upgrades?\"}),`\n`,(0,i.jsx)(e.p,{children:\"Install Apple's Network Diagnostics Logging profile on a Tahoe test Mac, run your workflows, collect a sysdiagnose and search it with the log predicate in Apple's support article. On 26.x, violations appear as warnings, so you see them before they break anything.\"}),`\n`,(0,i.jsx)(e.h3,{id:\"does-this-change-anything-for-macs-that-arent-managed\",children:\"Does this change anything for Macs that aren't managed?\"}),`\n`,(0,i.jsxs)(e.p,{children:[\"The software update change doesn't. The TLS rule also covers software updates and app installation for every Mac, but those normally connect to Apple's own servers, which meet it. You can check whether a Mac is managed with \",(0,i.jsx)(e.code,{children:\"profiles status -type enrollment\"}),'. On an unmanaged Mac, both lines read \"No\".']}),`\n`,(0,i.jsx)(e.h2,{id:\"conclusion\",children:\"Conclusion\"}),`\n`,(0,i.jsx)(e.p,{children:\"macOS 27 finishes a move Apple has been signalling since declarative management arrived. Update control is now declarative-only on 27.0, and the management path now enforces the same transport security as any modern app connection. Neither change touches the user interface, so a fleet can walk into both without noticing \\u2014 until a deadline is missed or an enrollment fails.\"}),`\n`,(0,i.jsx)(e.p,{children:\"Both can be avoided with preparation you can do on Tahoe today. Test your servers, run Apple's log audit on one Mac, rebuild the update policy declaratively, and repoint your reporting. Do that before the first 27.0 Macs arrive, and the upgrade is routine.\"}),`\n`,(0,i.jsx)(e.p,{children:(0,i.jsxs)(e.em,{children:[\"Related reading: \",(0,i.jsx)(e.a,{href:\"/blog/macos-27-not-showing-software-update-mac-wont-upgrade-fix-2026\",children:\"Why macOS 27 isn't showing in Software Update\"}),\" \\xB7 \",(0,i.jsx)(e.a,{href:\"/blog/apple-background-security-improvements-bsi-macos-tahoe-guide-2026\",children:\"Background Security Improvements explained\"}),\" \\xB7 \",(0,i.jsx)(e.a,{href:\"/blog/macos-27-app-data-containers-access-denied-operation-not-permitted-fix-2026\",children:\"macOS 27 blocks access to other apps' data\"}),\" \\xB7 \",(0,i.jsx)(e.a,{href:\"/blog/macos-27-golden-gate-release-day-update-guide-september-14-2026\",children:\"macOS 27 Golden Gate day-one update guide\"}),\" \\xB7 \",(0,i.jsx)(e.a,{href:\"/blog/macos-tahoe-enterprise-deployment-guide-2025\",children:\"macOS Tahoe enterprise deployment guide\"})]})})]})}function o(n={}){let{wrapper:e}=n.components||{};return e?(0,i.jsx)(e,{...n,children:(0,i.jsx)(c,{...n})}):c(n)}return v(E);})();\n;return Component;","toc":[{"title":"Key Takeaways","url":"#key-takeaways","depth":2},{"title":"Change 1: Legacy Software Update Management No Longer Functions","url":"#change-1-legacy-software-update-management-no-longer-functions","depth":2},{"title":"What the declarative settings cover","url":"#what-the-declarative-settings-cover","depth":3},{"title":"The recommended cadence gap","url":"#the-recommended-cadence-gap","depth":3},{"title":"Enforcing a version on 27.0","url":"#enforcing-a-version-on-270","depth":3},{"title":"One Policy, Written Both Ways","url":"#one-policy-written-both-ways","depth":2},{"title":"Reading the result back","url":"#reading-the-result-back","depth":3},{"title":"The Mixed-Fleet Trap","url":"#the-mixed-fleet-trap","depth":2},{"title":"Change 2: Stricter TLS for the Management Path","url":"#change-2-stricter-tls-for-the-management-path","depth":2},{"title":"Where old TLS is still hiding","url":"#where-old-tls-is-still-hiding","depth":3},{"title":"How to Audit Before Your Macs Upgrade","url":"#how-to-audit-before-your-macs-upgrade","depth":2},{"title":"Step 1: Test each server with nscurl","url":"#step-1-test-each-server-with-nscurl","depth":3},{"title":"Step 2: Check the extended master secret","url":"#step-2-check-the-extended-master-secret","depth":3},{"title":"Step 3: Let the devices tell you","url":"#step-3-let-the-devices-tell-you","depth":3},{"title":"A Rollout Checklist","url":"#a-rollout-checklist","depth":2},{"title":"Troubleshooting Common Issues","url":"#troubleshooting-common-issues","depth":2},{"title":"A 27.0 Mac ignores the update deadline you set","url":"#a-270-mac-ignores-the-update-deadline-you-set","depth":3},{"title":"Update reports show \"unknown\" for new Macs","url":"#update-reports-show-unknown-for-new-macs","depth":3},{"title":"Enrollment works on Tahoe and fails on Golden Gate","url":"#enrollment-works-on-tahoe-and-fails-on-golden-gate","depth":3},{"title":"Enterprise apps won't install on 27.0","url":"#enterprise-apps-wont-install-on-270","depth":3},{"title":"A TLS-inspecting firewall breaks management traffic","url":"#a-tls-inspecting-firewall-breaks-management-traffic","depth":3},{"title":"FAQ","url":"#faq","depth":2},{"title":"Do legacy software update commands still work on macOS 26?","url":"#do-legacy-software-update-commands-still-work-on-macos-26","depth":3},{"title":"What replaces the recommended cadence setting?","url":"#what-replaces-the-recommended-cadence-setting","depth":3},{"title":"Are content caching servers affected by the TLS change?","url":"#are-content-caching-servers-affected-by-the-tls-change","depth":3},{"title":"How do I know which of my servers fail before any Mac upgrades?","url":"#how-do-i-know-which-of-my-servers-fail-before-any-mac-upgrades","depth":3},{"title":"Does this change anything for Macs that aren't managed?","url":"#does-this-change-anything-for-macs-that-arent-managed","depth":3},{"title":"Conclusion","url":"#conclusion","depth":2}],"estimatedTime":16}