Managing OS 27 in the Field

with that, I’m Bryce. I’m joined today by Ponce. All things to all men, VP of security and our our own Addigy admin. So he himself, has had discussions with me about how we’re gonna be managing OS 27 internally. So… Alright. Today’s agenda. If you had attended, our session at our conference frontier last week, we did an abbreviated version of this. This is the same slides, but with, like, 10 or 15 other ones added, and then we’re also gonna be covering a few more pieces of content because the germ of the idea is the same. How do we manage OS 27? So first, we’ll talk briefly about the hardware support. There’s some changes there if if you’re not familiar. We’ll talk about some new device settings that are out there for, configuration. If you’re not familiar with the, you know, declarations and profiles, that’s, you know, where all those lives, the device settings now because it could be a configuration, a declarative configuration or a profile. We’ll talk about some changes with accessibility, privacy, and then the app settings, which is probably the most prominent thing with OS 27 outside of some of the support changes for the hardware and MDM. Then we’ll talk about the MDM based OS updates and upgrades, and then we’ll talk about everybody’s favorite point about how to defer and manage that. And we’ll talk about the the status channel and some changes with compliance. So, if you haven’t heard, real quick, the supported hardware, is changing. There is no Intel version of macOS 27. And I was curious, Ponce. Out of our own fleet internally, how much do we still have that are are Intel? It’s gotta be sub 20 or 30% now at this point, if not more. Zero. We have Zero? Yeah. I mean, in the chat, I would love to see, you know, how many of guys still manage intel. But to Bryce’s point, it’s been about six years. Yeah. Personally, I still have Intel. Right? I think probably many of us have it personally, but work wise, almost everybody has switched over to I got my replacement in the mail just the other day. Haven’t plugged it in yet. Yeah. But… Yeah. That’s a test device. Right? No. No. No. That’s my own money. The company didn’t buy me that. Okay. Okay. No. I finally bought a new computer instead of my one from 2013. But, yeah, some other people saying in chat, they’re twenty, fifteen, 30%. And and the numbers bear out when I’ve looked at where people are kinda, like, maxed out at 15. Because 15… Mac OS 15 on our back end, there’s there’s still a good chunk of devices on 15 when I… I’ve checked database wise. And that’s simply because, you know, a lot of those… That that first gen touch bar, a lot of those last devices of Intel, they capped out at 15. Very, very few got 26. So, you know, there’s there’s still a a few of them out there. But, you know, I think we’re gonna start to see that kinda taper off now. Because, obviously, this year, there will be no Intel support. And then next year, I mean, it’s not just no Intel. We’ll get to it. There’s gonna be no Rosetta support. There’s a slide coming up about that. So Yeah. We got a percent by end of October. Alright. Yeah. A lot of chat about, people still have them, but I would say one third to 30% is probably the highest I’ve saw based on the chat messages. And Yeah. So if you have those devices and you’re trying to figure out which one’s supported or not, new this… Not new this year. We’ve had this fact in the in the past built into the product, whereas is the new OS supported for macOS. However, this year, we also layered on, using a a… An an array that’s looking at the model identifiers. So what the team did is this now looks at iOS, iPadOS, and macOS. And, also, I think it does look at tvOS because there was two tvOS devices that were in the array when I was looking at it in in sandbox. So it’s actually looking at all of those of of what’s supported. Yeah. Yeah. Because I think… Yeah. Because the… That Apple TV there, the entertainment room, fifth one down, that’s some of my devices. That one is an Apple TV. So those, devices will show if they support that OS or not, which is nice to have because then you can kinda at least figure out, okay. You know, I’ve got these set of devices, granted that I’ll be silicon, you know, which ones support that. I don’t think we’ll see, and correct me if I’m wrong, if you have a different opinion, Ponce, I don’t think we’ll necessarily see them drop support for an m one for OS 28 next year. Like, they’re still pretty powerful. Yeah. Well… And if you think about it too, like, the neo isn’t even an m one. It’s an a series. So, like, that’s slower than an m… Well, on par with an m one. So Yeah. Cool. A couple things here too. If you go to the device itself, there’s the fact for it, and then, you know, you can see it light up there. Okay. Moving on. New device settings. These are just some of the new things that were added in device settings. The app settings configuration, which we’ll talk about more, Content caching configuration, which has existed previously as a profile, now is also a configuration with a few additional, key values there. DNS proxy and the DNS settings are now also a configuration. Extensible SSO, previously just a profile, is now also a configuration. A note on on on those where they previously existed. That doesn’t mean you have to migrate today. You can keep using the profile. However, if you wanna utilize some of the new key values or functionalities, like, for example, app settings where it doesn’t exist as a profile, yes, you you would need to utilize, that that declarative configuration. Same thing for the Apple Intelligence configuration features for things like mail, calendar. There’s a specific subset of keys that exist within that configuration. That’s not something that exists in a profile. Yes. In in the restrictions profile, there are some restrictions for Apple Intelligence, but that by no means, you know, covers all of the features of Apple Intelligence as they’ve… As Apple’s added to it. They are utilizing those declarative configurations. The Relay, website privacy, that’s a subset within Safari, which we’ve had Safari for the last, year plus. That’s just something you can have within the settings configuration as well. Siri settings configuration, and that’s for tvOS. VPN and the content filter and configuration is also there. So all new things that are added there. Alright. Hans, time to talk about your favorite thing. Accessibility and the changes here. So if you guys aren’t familiar or you’re new to Apple devices, Apple has some privacy and different things about what you can have for device control and data access. And what has changed about that, Pans? Yeah. If you… Go back one side before we Yeah. Say what’s changing. Right? So, this screen is on OS 27. This section does not exist prior to ’27 or doesn’t exist with this name. This is literally the accessibility pane. And I just wanna call out… This is what it looks like in ’27. Right? Device control and data access is no longer called accessibility in ’27. Alright. Next slide. Just making that crystal clear there. So accessibility and permissions have been changed for user transparency. And what that means is, exactly what we saw. Right? So they’re no longer calling accessibility, which is kind of vague. There’s a lot of app developers that need accessibility permission for a number of different reasons that probably nobody can even tell you. But too long didn’t read of it is Apple’s changing because they’re trying to lock down those settings. Right? They want to understand what those developers are doing. And because of that, they changed it to what we just saw, and it can no longer be whitelisted via an MDM profile like we’ve seen from OS 26 and every operating system before that. If you want to manage it now, Apple suggests using the new DDM or declaration app settings. You can find this in the catalog under device settings. But before we get into that, right, so if you upgrade… Or your users upgrade to OS 27, they’re gonna get notifications about this permission if there’s an accessibility profile that we’ve been deploying up until ’27. So, like, if any application has any accessibility profile, it’s gonna trigger that notification. I think we have a screenshot of it on Yep. The next slide. Yeah. The next one. Well… So we’ll get to that. And it’s pretty scary and frightening and vague and traditional traditional ways of notifications that we usually get here. So the new app settings configuration will prompt the users on the app first launch. That’s the the the new app screenshot of that too. Yeah. Yeah. And we have a screenshot of that. That new app setting, the one… This new app setting, you see all these bullet points. This new app setting app… New app setting. That’s that’s… What we’re talking about is the new declaration, the new way of doing it. So the new way of doing it prompts the user. So, basically, you can either let the system natively prompt the user, or you can build your own kind of model to prompt the user. But either way, we’re prompting the user. Basically, the big change here is Apple removed the way we had… The the feature that we were able to use to automatically wait list. And similar to screen recording, it has to be manually approved now or microphone or camera. So it’s only deployable to the user channel at this time, which is in the catalog. Ask them. And and you can do it today. The problem, if you guys aren’t familiar with user channel or what that means, that means that… I’m I’m gonna use a bunch of more jargon that you might not know what that means either, but, it’s an MDM managed user. This user is is only… Can only be one user on the device, and, it’s usually, maybe maybe can be more, but, I think that requires AD binding or something. Right, Bryce? So That would be the easy way to add more. Or you can have more than one if the accounts are created with platform SSO, etcetera. There… There’s ways. But, yeah, it’s normally a one to one relationship. Yeah. And it’s… If that device doesn’t have a MDM managed user, then you have to you have to go probably reenroll the device. There’s some other hacks around there. You could also kick off… There’s a command where you can make it seem like it’s doing another enrollment, like a Pseudo profiles type enrollment. Yeah. Correct. For new. Yeah. Yeah. So if you’re familiar with the pseudo profiles for new type enrollment, that’s what I meant by, like, reenroll the device, like, not uninstall and reinstall. Just reenroll with that command. If it’s ADE eligible. Right? So if you’re not sure, you can always go to go live device settings and try and deploy a device setting to a device, and you’ll see if that user has a managed device has a managed user. It will show up there, and you can see it. Otherwise, it won’t. And you can’t deploy the setting. Meaning, for a lot of devices, you may not be even able to use this new app setting. So our feedback is to tell Apple that. Right? Create Apple feedback. I think they’re probably getting hundreds of feedbacks around this. I was gonna say they’re they’re very aware of it. Yeah. It… They are working on putting it to device channel. Yeah. The more request, yeah. The more request, the better, though, because it shows the urgency and the need for something like this and the oversight to only put in user channel. Because I I would add, and this is slightly skirting NDA, but with the beta two of dot two out, still, it’s still, you know, not in there. So the more urgency, the better. To Phil’s question there in chat, I don’t know, Pat, since I’m sharing my screen, there is a KB that we have on how to provide feedback to Apple if you wanna post that in there. Sure. So Yeah. Yeah. So if you’re on beta too, I think you can… You should have on the beta, you have… Feedback assistant will already be loaded up. But… Yeah. Yeah. Yeah. Yeah. So here’s the here’s the screenshots that we were just talking about. So this is what the user experience might be when a user upgrades to OS 27. Now, you know, they just may be so used to all these privacy and security notifications that it’s… You know, they don’t even notice it. Some people just ignore the notification center because it’s just noise in general. Nick said I’d distracted myself talking about device versus user. So I I… So there’s two ways of deploying a a device setting or an MDM profile leg… Legacy profile. In both context, it was either user channel or device channel. Or, device channel is just deployed to the device. I don’t care what users are there. And then, user channel is just a managed user. So just to reiterate what the differences are there and what the implication of deploying one versus the other. So in most of the cases, most of you guys always use device channel. Almost everything is device channel, and user channel is very limiting. So that’s to reiterate what the difference is there and how you can deploy that. And a practical example would be, like, the dock payload. You could do a dock payload that would be system wide and change the dock for everybody, or you could do a dock payload that would be user channel and, like, Ponce gets a dock. And, like, the the use case there was back in the olden times when you had AD bound where it would make a managed user for each one. Like, when I was in higher ed, maybe you’d have, like, a subset of users would get one doc for, like, one class, and then a different class would get a different doc with different apps. Problem is, though, when it’s app settings like this, everybody probably is gonna be getting the same app settings so that you have access for screen recording, screen share. You know? Like, these are things that don’t make sense, frankly, as a per user basis, really. So there is… It will… But here’s my here’s my thought process. And this is… I mean, I completely… This is me pontificating. I have a feeling before we hit that December 13 deadline of the ninety day deferral, they will have it for system channel by then. I could be wrong. I hope I’m not. But, like, it needs to be there before people can fully manage all these things and when they can’t defer anymore. Yeah. Yeah. Okay. So the point of these screenshots, this is from my device. You know? Yes. It’s there. It starts stacked like it is on the right, and then I expanded it to show that for an example. But, frankly, most of the end users that I’ve worked with in the past don’t even look at notification center unless it’s a text message because it’s just so much other stuff in there. So it might wind up being a nothing burger in your organization. But, also, if you have users that are attentive to that, they may notice that. You know, not not to make light of it, but, also, it it is kind of within that that notification mess. Yeah. Yeah. I think the only other, impact you guys might see as IT admins, like, when you remote control… If that remote control session, you wanna control keyboard and mouse automatically, that won’t work anymore. You need the end user to approve it. So, like, if you’re doing a Zoom session, right, we’re on Zoom right now, and you request keyboard and mouse control, it’s gonna prompt the user to approve that setting before you can actually get keyboard and mouse just like screen recording would or just like camera and microphone. And that applies to any third party remote control tool. Including Splashtop, like like Mike was asking about in q and a there. Oh, okay. I wasn’t paying that. Let me pay No. You’re good. Yeah. So… Alright. I think next screenshot shows the, yeah. Live desktop is not impacted by this. This is only No. Third party tools. Yeah. Because Live desktop is using the built in remote management with a with a with a specific tunnel being set up. So if you’re using live desktop, you don’t have that that limitation. And this is what it looks like when you click on it. This was just me showing, like, if the end user clicks on it, what does it do? It takes them to this. Yeah. Exactly. Alright. So if you use the new declaration app setting, then this is what you’re gonna have the ability to do. Right? So it curates the notification. It still requires them to press allow or not now, like, to give an answer, but you can change it so that it’s a little bit more intuitive, but it’s basically the same prompt. You see, like, device control and data access. Apps with this access can view and send email, edit contacts, photos, monitor keyboard, that that that… They don’t… Nobody knows. Right? It really depends on each vendor And what that vendor can do with their application. Yep. In this example, I just filled in Addigy MacManage because I was just like, I don’t know. I I know the bundle ID off top of my head. It could be whatever it is in there. And then, like, I wrote the description. This is our self-service app. Like, that’s… That text I actually made, it was in that configuration. Also, for scale, this is how big it is on the screen. And so then this is, you know, how that configuration actually looks within the the the catalog there. And, basically, you’re you’re asking for those permissions there. To the the question in chat there, will we do this for MacManage? Yes. If need be, if we find out we need some of those permissions for different things with the system level, though. We won’t be doing this until we have the system level because just trying to shotgun blast it out to all the users, it… It’s gonna be a lot cleaner when we have the system channel. So that’s that’s an ongoing discussion that we’re working on with that. And then for things like location tracking with this, which is something we’re working on for for iOS, self-service, we’re we’re testing some of that stuff now. Yes. It it… We’re gonna have to be deploying that for that payload. But for for iOS, there isn’t a user channel really for for that. There is for shared iPad, but, for some things there. But it… It’s it’s system channel, so we don’t have that limitation there. Anything else you wanna say on the the app settings before we move on then, Pans? No. I think that covers it. Okay. Yeah, if you’re looking at white listing it or, like, giving a custom notification, that’s the way… If you don’t want those notifications to appear, we are currently saying move away from the accessibility MDM profile. Paul also asked the question, in our catalog, do we differentiate between a profile or a declaration? I don’t think so, but maybe all the new ones are all declarations. Is that right? All the new ones are declarations. There is a new tag. However, one of the things that’s a project that’s ongoing is we’re if you… I I gave a talk at Penn State. There’s gonna be a MacAdmins podcast episode coming up too that I talk about. I think it’s coming out this week or next. But one of the projects that we’re working on is the migration to legacy profile where we deploy the profiles as a configuration attachment. It’s a bad analogy. But, that is something that when we do that, we will also be then delineating because everything will be a declaration, but some of them will be a configuration. Some of them will be a profile. So kind of the ideal will probably be, like, a column in the catalog, which is probably what you’re looking for there, Paul. So not yet, but that is that is coming. Because right now, the only thing that has that overlap is passcode, extensible SSO, and the content caching. Those are the ones I could think off top of my head. Everything else is just a declaration to start. Yeah. Eventually, though, there will be more, at which point, we’re gonna make sure we have a a way to filter that done. Yeah. Yeah. You guys can, make sure to ask questions in the q and a section. Trying to watch chat. It’s a slight one. So just to move on then, Rosetta two, rest in pieces. One thing along with, some of the other deprecations we’ll be talking about for MDM on the next slide, Apple did announce that Rosetta two is going to be dead and completely removed in OS 28. So in OS 27, there is a slight change. When you do your upgrade in place, it removes Rosetta two, which is nice. If you’re using apps like I am that are still Intel only based, you then have to redownload Rosetta. Not a big deal. You just, you know, approve that and then agree to the terms again, and it downloads it. But that is just one thing to be, aware of. Apple has communicated this that Rosetta is going away. If you’re not familiar, Rosetta two is how you can run Intel based apps on your silicon based m or a series, macOS device. Rosetta one was how you could run power PC apps prior to 2006 or 2007 on your Intel based, Mac. And so now Rosetta two, it’s coming to an end. Everybody should have their apps migrated and moved over. Alright. Let’s talk another deprecation except now it’s actually a removal. So just a a a warning here that MDM based OS updates and upgrades are removed in OS 27, like, completely on iOS, iPadOS, tvOS, macOS. All of those have those removed. You cannot send an MDM update command. You can send a declarative, a DDM update command, and we’ll be talking a lot about those in a few slides. But the MDM update commands are gone. There is this KB, which, again, I don’t think I have the ability to post to everyone in chat here. Oh, I I do, but I don’t have this in my clipboard. But there is a KB link out there that we talk about how we handle this added with Addigy just in general. Because when that gets removed, that changes how go live is gonna function. And there’s some more information on that here. And Apple communicated this, starting last year at WWDC twenty five in their what’s new in management session. There is also a Apple KB out there that kinda details that as well. And what this looks like within Addigy is if you go to a device and go to the updates tab and you say, I wanna go see what updates this device has available. Well, that list update command is no longer gonna run on ’27. And, frankly, it didn’t really run on ’26. It was deprecated in ’26, and it was not being maintained. 15 was the last version where those commands were actually maintained, and you may have noticed it. I know I personally did because I’ve updated my parents, my aunts, and uncles, all the all the devices that are in my Addigy prod using those commands as a one off sometimes when working with them on the phone or or working with some small businesses, that I work with on the side. And so those commands, you know, they worked in fifteen, twenty six, fifty fifty shot that they would actually complete. And you you know, me, I I would check the logs, and you’d see the device acknowledged it, but it didn’t do anything with it because software update Damien wasn’t picking that up. So we made the determination that starting with ’26 and up, we removed the functionality for the one off command send because it would probably not complete on ’26, and it definitely wouldn’t complete on ’27. But what we did put in there was a new way of listing the available updates versus using that list command where it would pull it from the devices catalog, which, again, on ’27 was no longer gonna even give you anything. We put it in where it’s going to look at the device’s model identifier. It’s gonna look at what version the device is on. So in this case, 26 dot 6 dot 2. And it’s gonna say, okay. This is an m two Mac mini model identifier, you know, Mac whatever, comma, whatever. These are the updates within the public catalog from Apple that are available to the device, and it’s gonna then tag and list those of, you know, which one’s the latest. Granted, there’s two branches at this point right now because 26 dot 7 is the, you know, insider slow, and then 27 is the the regular normal channel. So it will list those out per device, and then the update history is the same as it ever was. This part where it’s looking at what time that command or the update completed, whether that be the MDM command of of yesteryear, because, like, these are some devices that… You know, this device has been in here a long time. It had that, run as an MDM command, and then, you know, it’s also gonna mix that in with the declarative commands and as well as declarative, status channel if the device had had that update. The update status tab is replacing that install, you know, update, refresh page that had been there previously for ’20, for ’26 and up. On 15 or iOS 18 and iPadOS 18 and lower, it will remain the same as it always has been because those commands will complete and work device side. How this will function now is this is actually going to pull from the device or actually pretty quickly. In my testing, it’s usually a minute or two, where it would actually pull that. We are relying on the device to send it to us. It’s kinda like an RSS feed, to use a bad analogy, for the status channel, of how that functions. So, like, we’re subscribing to what the device is telling us from that that channel. So we can see, okay. Yep. The updates started downloading. Great. Whatever. Because I sent a declaration in this case. There is also… If me, as the end user, went on my m two Mac mini and I go and hit upgrade to macOS 27, it’s also going to reflect that here now because this is gonna pull from that status channel data. So from the status channel data, I can see that I, the user, went into software update. I clicked go, and now it is downloading and doing that update too. So this tab, you know, we wanted to give it as much functionality as physically possible given the limitations OS side so that you can at least see that information device side in a, you know, a spot that it would make sense to have that. Additionally, the MDM updates have been, you know, removed for for, ’20, seven and up. So this allowed us to change, the MDM and o… Ddm OS updates, page in the policy view. So you will now notice that there is additional settings dot dot dot. And within that is where you could set the MDM updates, and what would be applying there for the older OSs that don’t support declarative. So twelve and thirteen, which are are not… They they can’t take any declarative OS updates. So if you need to go and change those, you have devices that are still on 12 or 13, that is where you would go and set it. And then at the bottom of the page where the schedule for the MDM updates used to exist, there’s now a button to open that as a modal as well for those legacy updates. Again, this only applies to twelve and thirteen for macOS, iOS 16 and older for for those devices, which we’re we’re getting towards the end of the life cycle on those. Additionally, you know, the reason we made this change is not only to simplify the UI. There’s a few other things we’ll be talking about in a couple slides that have, updated and changed this week for that. But, also, they’re on 12 or 13. Apple’s not really releasing new versions of 12 or 13. You know, it’s it’s… Those devices are kind of getting towards end of life. One thing of note, with that also coming soon, the team is working on this now that we’ve kinda got everything done and and the OS 27 support and everything is there, is there are endpoints that will be going public for this so you guys can consume this data via the API if you would like to do so. Because these are all the, you know… We build everything with an API first, and the UI, consumes that. Also, yes, Matthew. Yes. And you… When you install 27, it uninstalls Rosetta. These endpoints are things that we use to consume, you know, that stuff in the UI. So it’s one of those things that we’re gonna make it available in the, API so you guys can can do it as well. Alright. That’s kinda all what’s new. Let’s talk about how you wanna defer it. I have to use my meme of the no hands, guy. It’s… He’s made it into every, OS readiness session, that I’ve done here. So how do we defer? So there’s a couple ways to defer it. The first is just simply don’t push it, which we’ll talk about the the settings for that. The next is the legacy restrictions profile. If you have some of the older devices that don’t support the new, declaration, which would be, like, macOS 15 and up, macOS 18 and up, there are ways to do some deferral around that for the profile. However, the new settings configuration is really gonna be the way, forward for that. And then for macOS, you get an additional, ability of doing that with the prebuilt app that will block the full installer, which we’ll talk about. But quick… First, poll. Who here has deferrals in place? I don’t know, you know, if you have it, what that looks like, and and if you’re saying, no. Let’s just go to the latest version. Oh, I can’t vote. Host some panels. Yeah. I was trying to vote for them. Yeah. We got a question based on what we just talked about with Jose to Bryce about, he heard you say that on… In ’27, it uninstalls it. Yes. Correct. And in fact, I think this has been, like, something that’s been a pretty common thing for most of the operating systems. Apple would uninstall Rosetta. I don’t know if it was intentional or not, but in ’27, it seems intentional 100%. Yes. Yeah. It’s documented. Yeah. Think. Alright. Everybody’s voting now. You’re gonna move on. Yeah. That’s fine. So things that have changed is this is new as of this week. This is now a drop down. Because of that simplification we could make of no longer having MDM based updates in there, you basically are saying, I want to go to the latest. I wanna go to a specific version, or I just wanna do deferrals. So you could say, in this case, you know, I wanna just do a deferral, you know, I’m not gonna push anything either way. I’m just gonna defer. I’m not gonna have anything out there. That’s an option. If you wanna, you know, update to a specific version, you can do that, or you can have it, you know, update, to the latest. There’s there’s also… There’s not a screenshot of that there, but it’s just the latest version. So if you want to push… You know, don’t push that and defer, what would that look like? Well, if you set it to a maximum version, you’d say, okay. Well, how do I wanna deliver it? So the option would be deadline where you’d actually say for Mac OS 14 and up devices, they’re gonna say, okay. I, after ninety days at 05:30PM on Thursday or Friday, will go and do this update. And then if they’re also on 15, they will also get the deferral in addition to that deadline of when that’s gonna go at ninety days. And then you can also control, you know, how many notifications do they… End users see. Can a standard user go and just do that? No. And then the background security improvements. IOS, iPadOS, it’s a little bit different. There’s only, you know, the one deferral. There’s not for the the breakout of major minors. And then there’s also the recommended cadence where you’re gonna then offer that up, saying, you know, okay. I wanna show… In this case right now, like, you can get 26.7 or you can get 27.o. There’s a different cadence… Cadences of the oldest and newest. There is a a change here with this this logic, where if you have this setup with these deferrals this way, instead of previously where it would fragment where Mac OS 14 would get, you know, one thing in Mac OS 15, if you wanted to use the deferrals, you would have, you know, basically conflicting math if you wanted to use the, machine learning on 15. Now it’s just you’re picking it from the deadline of I wanna do just deadline or I wanna do just automatic actions. You can’t have both of those mixed together, in that policy, which… What that really just means is it’s simpler to set up because you’re picking from that drop down and you’re doing deadline or you’re doing auto actions. It’s not, you know, a divergent tree for fourteen and fifteen if you have that that key enabled in there. If you have the automatic actions, let’s say you wanna just defer it with those settings and you don’t wanna push anything, you don’t wanna have it have any, automatic update version go, that’s new where you’d be able have that drop and say, I just wanna defer with settings, and you’d set basically what you have on screen there, which is the same thing of ninety days or one to ninety days, your notification preferences, the cadence from iOS, iPadOS, and then the automatic actions at the bottom where you’re saying, I don’t wanna automatically download. I don’t wanna automatically update, either. And so, yeah, here’s another example of that with the the three drop downs there and then where you would be changing that for you wanna use the machine learning, device side. Pats, what else… What’s what’s another way macOS devices could upgrade? The blocker. Right? So I I know you just got to it, but, you definitely wanna make sure the blocker’s there. So in the case that the user does see it, maybe the deferrals aren’t working. I see said mentioned that for him. But if they do see it, it’ll run the app. The blocker will try and kill the app. Right? So there’s a lot of different ways of deferring things, and it’s kinda confusing. So we wanted to make crystal clear. Right? The deferrals prevents the user from seeing it. The software update settings in your policy prevents Addigy from deploying them. So that’s why Bryce said cap it. Right? Like, you don’t wanna say update to the latest because it’s gonna go the latest. So… And then, you know, there’s the legacy MDM profiles, which we don’t talk too much about right now, Bryce, because, you know, they’re deprecated, and they… You know, I don’t know if that’s what some people are using. You can still deploy them out, but from my experience, they don’t work all that great anymore, if at all. Yeah. And the thing I would add is, you know, if you’ve got devices on 15 and up, the the thing that kinda I’m going with when I’ve talked with people about, like, I just wanna straight up defer. I don’t wanna push anything. I just wanna kinda wait and see what happens here. This is how you’d wanna have that set. You’d say deferred with settings. You’re not even capping the version. Admin… Because, you know, this or, yeah. So, like, these two right here, both of these are going to accomplish the same thing if the devices are all on, let’s say, 26 dot nine if that existed. It’s not gonna push a version beyond that because we’re not gonna see the calculus to do it. But, also, if you have it set to deferred with settings and you’re not pushing anything, but you’re also deferring and turning all that stuff off and there’s no auto actions then because there… You’re… There’s no on device machine learning updates taking place either, that paired with PBA is gonna be your strongest blocker because you’re basically saying on that top one there, I wanna defer it, and I’m not pushing anything even if it’s a dot release, which you could obviously reassess if another dot release comes out. Frankly, I think we’re done here. Like, dot seven, I think, is gonna be the last one. And you could still do background security improvements if they do drop one for that because those are independent of that. You know, you could you could push a version of that if if you want, and have it be the same version because the the number would increment as a big letter. But the top one paired with PBA is gonna be your strongest deferral where you’re saying defer with settings, and here’s the PBA blocker because Addigy is not sending anything. There’s no MDM commands to even send anymore once they’re they’re on 27 if it’s there, and 26, they didn’t really complete. And that’s also being filtered out by the fact this is turned on. And you’re then also putting down the deferral, declaration and blocking the App Store. So, last thing then. Let’s say that you do want to upgrade to the latest OS, but you wanna do it before it even enrolls. Just a quick call out here. We’ve had this feature for a while now, I think almost three years, where if the device is going through enrollment, previously, you had to input a version number. This is now indexing the available catalog. Because we had some problems with using a specific version number because sometimes Apple would pull the availability of those dot releases, which means the number you input would no longer work because that value would return that it couldn’t push that version. So now what we’re doing is we are pulling from the Apple catalog what these version numbers are and then which ones are available to it. If you do pick, like, for example, their 26 dot 3 dot 2, and let’s say in the future, Apple pulls that version, we still do run into that scenario. But by us indexing the catalog, it makes that a lot smaller of a, possibility. And then, obviously, you’re saying, okay. I wanna go to the latest… You know? And it’s just gonna keep that up to date with whatever the latest one from the catalog is that, the device can support there. You can mix and match. It’s a question I’ve gotten on that before. Let’s say you wanna do it just for iOS, just for macOS, just for iPadOS. You can do that. You can say none, none, none, or a version of it then. What does that look like on a macOS device? What’ll happen when you’re going through ADE? You will get a pop up basically saying, hey. This is a a screenshot from ’26 because I couldn’t get one from ’27, because the device didn’t save it for some reason. But 26 four is required. You’re on 2631. You need to upgrade. You do the upgrade or, in this case, update to some minor version. You do the update, and then it would come back and finish the enrollment. So you’d be starting from that latest OS then. K. Well, let’s talk… Oh, let’s go. So I I I don’t know how many people have used this. I I love the idea in theory, and Bryce has heard me say this a lot. But the You you and Harold both. Yeah. The practicality of it, just from, like, an ITM perspective is, like, we love this because we don’t want devices coming in from Apple directly on old operating systems, which almost always happens. Right? Because, like, by the time that hardware ships from China or wherever, it’s already out of date. But, yeah, the user is probably just being onboarded at the time, and, you know, people have little patience during the onboarding to do an update immediately is the only thing I’ve seen challenges with when using this. So it’s not like, the feature is more reliable than I think it’s been. The problem is, like, user expectation experience when they just start using it. And the problem now has been, like, we’ve talked about internally with with us is when we’ve been buying… I think Harold said it was maybe the m five chip or no. There was some there was some amount of MacBook Pros that we bought for new hires at some point that they all shipped as, like, several versions older. They’ve been on the shelf or on the… In customs, whatever Apple’s doing. Because, like, even Apple’s doing some weird stuff with a shell game of how they’re trying to do customs now where, like, it doesn’t depart until or whatever because of tariffs. But as a result of that, we’ve had some devices come that it’s not like a, oh, you’re going from 26 dot, you know, six dot o to six dot one or six dot two. It’s like you’re jumping multiple versions, and that update, instead of being, like, a gig or a gig and a half, winds up being, like, six, seven, eight, nine gigs. And it really changes the math of how long that takes depending on the new hires connection and everything being fully remote and all that. So good idea in theory. Sorry for Oh, no. No. You’re good. You’re good. So status channel, like we talked about in go live, there is also a dashboard now. This is live now as of this Monday as well where if you wanna go to the system dashboard, there are new widgets that are pulling and populating the same exact data that you could see on that updates tab for go live. So as a result, you can then get a more holistic view of just these are the updates that have, you know, been stuck or why are they stuck. So there’s a couple different, widgets within here. There is the actual OS updates, which would basically just tell you, like, what, you know, version that device has installed or it has pending, if it’s failed. Then to the left or to the right of that, there’s the actual failure list where it takes whichever ones are, and then the failures then are broken down into actual error codes of what the device is returning to us through that status channel. So, like, for example, if I go and, you know, click on which ones are installed, it’ll tell me, okay. Yep. I can see here Janet’s MacBook Air had failed. Well, if I wanna go, I flip over to their, widget there and I click on a device, I can see, okay. The update access denied. Oh, look. Here’s the devices that have hit that error. And then it’s also gonna tell you how many occurrences of that error have happened. So, like, in these scenarios, these are devices that I I manage, for different small businesses or or friends and family. And these devices, like, for some of them, I know that they don’t ever reboot. They’re always online. And so I see more and more and more occurrences of these errors because the device is sitting there trying to do the update, trying to do the update, but it can’t because of this error. Or to Jeremy’s point there in chat, just force a reboot every fourteen days. That’s what Ponce is doing to us internally. But I’m a good boy. I I reboot every day or at least every other day, so I don’t ever get that pop up. But that does help. And the error codes, we list them… Make it the pencil out here. Right up here at the top underneath, this is kind of like a general description we get, and we’re kind of cataloging more and more of these as we get them for the status channel. And then we’re putting in there, that’s the actual error, and then it’s being passed when you expand this collapsible saying, okay. This device had this error, and it might help you be able to zero in on it. Like, the one I always think about is if we get, like, the, I think it’s negative 20, a key bag error from iPads and iPhones. Well, what that means is it’s at that screen where it’s asking for your passcode to do the authenticated reboot, and no one’s put the passcode in. We’ve seen this a lot with some EDU and also manufacturing customers where the iPads or iPhones aren’t used all the time. They’re sitting maybe in a cart for, you know, three, four days at a time, long weekend, different production schedules, whatever that may be. But then those devices aren’t being authenticated, so they’re not doing that update, and they’re getting that error. And this would kinda help you be able to see that then, for those devices. There is also an endpoint. So you can consume it through that dashboard within the system dashboard, or you can go in and use, the endpoint for that. With that endpoint, you can put in your organization ID, or you can specify policy IDs. You can get multiple different things. Right now, the dashboard is only looking at passcode and OS updates. Yes. Thank you, Dean. That’s, good. That’s a KB for that. But there are other ones that you can have, like the, you know, passcode security, the different service software update, like, is on there, content caching, the migration assistant has a channel. All of those are things that we’re subscribing to from the device. In due time, we’ll be adding widgets from. Obviously, we know software updates is the biggest pain points. We started there. But the endpoint is consuming all of them if you wanna go and be able to pull those through there. When you do a return, you could have it enumerate all the devices in that policy, or you could go and say just org wide. What do I have? An example here, if I’m looking at a specific policy for, the organization ID and my software updates, great. Like, I’m getting returned back, something very similar of what I’m seeing in that dashboard, but, you know, this is, a little bit, more specific of… Yeah. If you wanna be able to parse that out and use it in ticketing software or something you’re detecting for. And, mean, you can say, okay. Yeah. It’s gonna do that version or it failed or what version was prepped there. So with that, let’s talk benchmarks, Pans. Yeah. Yeah. The joys of compliance. Right? I think… And just out of curiosity, how many people in the chat are using benchmarks… Compliance benchmarks? One of the one of the things with benchmarks is that they’re defined per operating system. Right? So the the geniuses over at the CIS team and this team, you know, meet every week, and they talk about the rules, and they put together benchmark settings for each operating system prior to a major OS release or, like, right before. So they put out a prerelease of ’27 that’s still being fine tuned by them. And this is mainly a reminder that because 20 seven’s out, you need to build or clone your 27 benchmarks and assign them. Because once those devices do upgrade to 27, if you don’t have that assigned to your policies, they won’t be in compliance anymore. They just won’t have compliance because these specific benchmarks are designed per operating system, mainly because each operating system’s different. So they’ll have different rules and curated content that associates to them. So if you haven’t checked your benchmarks yet, check if you have a 27 benchmark and start testing that out on 27 devices. Usually, people that go to 27 are, liberal or lenient anyways, in terms of, like, being guinea pigs and testing and being brave, brave souls. Right? So as part of the big changes with Twenty Seven is that the, in this instance, yes, teams are moving things towards what do you… Well, you know, what have we been talking about this whole webinar? Declarations. Right? Like, everything is moving towards declarations. And some of the rules now have to be done through declarations because Apple’s providing that as the only mechanism. So right now, we’re we’re going to be rolling out those remediations via declaration. We don’t do it today as part of the prerelease or beta, but that will be coming shortly here. So things like what Bryce talked about, like software update stuff that can only be done declaration wise now in ’27. MDM, commands for software updates don’t work anymore. So, like, the automatic actions that he showed with always on or always off, those are gonna be, DDM settings that are controlled and checked now, via the benchmarks. So friendly reminder, go check your benchmarks. If you haven’t yet set up some for ’27, start rolling out to a handful of devices and make sure you understand the compliance requirements for your your fleet on ’27. With software updates and compliance, I usually recommend creating sec… Separate flex policies for each operating system and then applying those flex policies to the people on that operating system regardless of where they are, what department, what company they’re in. Because, yeah, if they’re on ’27, you’re usually managing it the same way. Right? Now, obviously, benchmarks or update settings may differ if they’re different clients and then want different things, but, that’s usually what I recommend. Next slide. And is that the only thing I had there in compliance, or did I No. Oh, yeah. For compliance, now now it’s, filters and intelligence. Okay. Okay. Yeah. So Bryce mentioned this new device fact that should be in all your environments to see if your devices even support OS 27. Right? Some of them may not support it. It may not be eligible, like, if you’re in… On an Intel device. Right? So that should give you a good device factor you can use in flex policies for your software update stuff. If you’re… Wanna take some people to 27, make sure they’re there. You can use smart filters part of the intelligence suite just to ask to show you those as another option. Excellent. Yeah. So I was telling Bryce… I’m probably gonna mess it up now because it was just off the top of my head, but that that… This is some of the Addigy intelligence features I have. I know about the Addigy stuff. I lack the intelligence. That’s what I told him. So sometimes, you know, it’s it’s nice to get help with some of this stuff. But if you haven’t checked it out, there’s some reporting functionality that’s included for everybody, and some of it’s in Addigy Intelligence. Like, you can tell it to create some of the dashboards or widgets, for your update status. So, like, if you didn’t know, you can actually go to, like, reports and and build, like, OS updates installed and see who’s actually installed or what’s happened on those devices from updates. And if you have the AI function, you can, like, just tell it to do it, and it’ll build it for you. And then you can run the report and see, know, who’s updated and installed onto 27 recently or historically. There’s a bunch of other functions in here. We’re not gonna go too far into them. The MCP, we’ve gotten a lot of great feedback on the MCP and, like, being able to use it through your preferred AI solution. I won’t, show any favoritism, but I’m sure a lot of people use cloud or some of the other options out there. It should help with you kinda digest some some, if not all of the massive amounts of data flowing through your platforms. We got a question around MCP, model context protocol server. That’s a fancy way of saying… It’s an… It’s a wrapper around the API, so you can use your favorite AI tool to talk to Addigy and human language and get your data back or tell it to go do things, depending on the API. It’s based on API keys and permissions around the API keys. So, if you don’t want it to write, you give it only read actions, and you can, use it, Nick, as a, like, a way to kind of easily get information about your fleet or your health, the device health, and stuff like that. We also talked about benchmarks. There’s a benchmark. If you go back a couple tabs real quick, Bryce, there’s a there’s a tab in the compliance that says AI basics. We’ve started using this internally, and we really like it. If you don’t want people using AI internally outside of the approved tools, this is really helpful because it gives you, like, basically, check boxes to say, hey. No ChatGPT or no DeepSeek or no, you know, perplexity. Whatever whatever AI tool you don’t want people using, you can go in there and set that. This doesn’t use any AI, to be clear. It’s a benchmark we curated to control what AI the teams are using so you don’t have people doing shadow AI stuff and using unapproved AI tools or free AI tools. Right? Where where they say when something’s free, that means you’re the product and your data is the product. Yeah. Whatever they’re using, you know, they’re probably gonna take that data and train who knows what with who knows where. So thank you, Bryce, for my… Let me do a diatribe here. Let’s go back to the the nice landing page here. So, yeah, there’s the Addigy intelligence feature set, and then we also have a security suite feature set that involves… Like, SentinelOne is the back end. So if you’re interested in all that, let us know. But by and large, everybody has an Addigy MDM here and can do most of all of the stuff that we talked about today except for, you know, the… Maybe the AI generating of reporting. So And I have another slide for the poll, but we already launched the poll, so we’re good there. So with some minutes to spare, I know we were trying to answer questions, as we were going through. I was trying to keep an eye on them and answer them. So I got a few more I wanted to answer here, and I know we’ll have, a few other ones that have just come in. I wanna answer Paul’s two questions here about the OS updates failures. Is there a way to kick the device? Well, there used to be something called the kick start, but after Mac OS 14 dot four, that was removed, on the Apple side. So that service can no longer be restarted. Sadly, really, the only way to, like, kick start it is to reboot the device. And if that doesn’t work, there’s been a number of times, I’ve had with customers as well as occasionally my own devices that still are stuck. There are some files, that you can do an RMRF on, remove recursively. Not super condoned, but sometimes when the device is really stuck, that is the only way forward. Specifically, that’s kind of more to OS, ’14 and ’15. It got better in in ’26, but there are, there are some things you can do there. But, really, what it boils down to is reboot the device, when there’s… When they’re stuck. Sometimes, though, those status channel, things about the failures, sometimes it’s like, hey. You don’t have enough free space. So, like, sometimes it’s a very, very cut and drive. Like, there’s not enough free space. It’s gotta, you know, build to download it and install it. Oh, I’ll answer Tyler’s question here. Yeah. There’s a bunch of questions. Yeah. Go ahead. Yep. Yep. So, Javier, I’ll I’ll take this one, and you do the next one, I’m reading. So Tyler’s question here about the declarative configurations versus the MDM profiles for device settings. I would not migrate at this time unless you have new feature. Like, passcode has a a few keys. Extensible SSO, I think, has a few. Really, right now, I would kinda just stay the course. Obviously, you can use the new declarative configurations where they exist because there is no analogous profile. That’s one of the things that we’re looking at internally as we prepare at some time, not this calendar year, probably. We’re not sure a 100% yet. But the idea would be that we would move everything to legacy profile, which is a wrapper where it puts the profile down as a declaration. We’ve been running it internally, actually, on all of our production. The device I’m talking to you right now has done that. We have not rolled it out to devices yet outside of Addigy ourselves, but it is something we’ve been testing with since 2023. We’ve been testing on and off. I’ve been doing all my sandbox stuff in there, and we’ve been running it in… Internally here. There were some, issues we had, with Mac OS 26, where it would, get stuck and and lock up. When you send more than 18 or so profiles, which was a problem, which is why we haven’t pushed this, to production for everybody. And we’ve been kinda working through that and working with Apple on some feedback on that. It seemed like beta five of ’27 made it better, but at the same time, with doing some of the benchmark testing this week, we were able to replicate some of that again. So we’re we’re once again working with Apple on that. But I would just say stay the course for now, Tyler. You know, if you wanna use the new features for Extensible SSO and use that configuration and where there’s devices that, are on on ’27 or or, is… I think, yeah, ’27 is the cutoff for that, then great. You can go and do that. To your point about what happens if you have a mixture in there, let’s say you had devices that were on, the older, OS, they will not get that. They can only get the profile. And then they’ll… You’ll see a headline when you’re in that declarative configuration of what OS it supports. Most of them are 27 and up. Some are 16 dot four and up, and then the rest are are 27 dot o and up. But, I I would say stick the course for now. Alright. What do you got, Pence? Saw you answer a few while I was talking. Yeah. I answered a bunch while you’re talking. I guess one of the questions is if the benchmarks… If you have multiple benchmarks assigned in one single policy for different operating systems, will the other benchmarks apply? No. The the benchmarks only apply to that specific operating system. Otherwise, the device is ignored. And Lars has a question here that… Let’s answer live. I’m not quite sure that I know the answer to this one, Bryce, but you might where it’s… If you pass the allowed declaration setting for app settings to allow, like, the old accessibility thing, is it a one click allow from that prompt, or do they still have to go to system settings, security and privacy, device and data access and press Yeah. Radio button again. I don’t remember. It it, it is one… Sorry. I’m trying to type here. I was trying to reply something in chat. So this… Let me go back. Picked Oh, the wrong thing. Hold on. Sorry. So this prompt is a one and done. You click… I can… It’s as far as my testing. I have never been prompted again once I had this. When I deployed it to the user channel, I got this pop up. I hit allow. It did not ask again. It’s just the first time that that… Whatever app bundle it’s referring to, when that app bundle launches, it asks you, you hit allow, and it does not ask again. But that also requires you deploy it to the user. We’ll see. I I have hopes that it will work the same way with device channel. I don’t see why it wouldn’t, but, you know, obviously, TBD. I’m trying to get back to q and a now because I I closed everything out. Okay. Yeah. That was last I think we got all the questions, and that’s… Everything in the chat I could find. Yeah. Well, we’re we’re overtime. But… So thank you everybody for making the time. Really appreciate it. Yeah. Thank you, Bryce, and, thank you, everybody. Join us in Slack and the Addigy channel. If you’re not part of it, we’re regularly there, And I hope everybody has a great I try and apply to whatever I can whenever I’m not running around with my hair on fire. So… And it’s always good to get the feedback. Alright. Thank you, guys. Have a good weekend. Have a good rest of your day, everybody. Bye. Bye.