macOS 27 software updates: moving to DDM and Jamf Blueprints

For years, Mac admins controlled software updates with MDM commands, deferral restrictions and a fair amount of scripting. In macOS 27 Golden Gate, Apple has switched those controls off. Apple’s own wording is plain: “Legacy software update management no longer functions in all 27.0 operating systems.” If your Macs still rely on the old settings, those settings no longer make them update.

What changed in macOS 27

Apple lists four things that stopped working in the 27.0 releases: software update commands, software update queries, recommended cadence settings, and software update restrictions such as deferrals and Background Security Improvements. Apple’s advice is to use declarative software update management instead, which it says gives “increased user transparency and more control”.

An update policy built the old way in Jamf Pro or another MDM no longer makes Macs on macOS 27 update. The fix is to move update management to Apple’s declarative model, which in Jamf Pro means Blueprints.

What declarative device management is

Apple describes declarative device management (DDM) as “an update to the existing protocol for device management”. With traditional MDM, the server sends a command and then has to keep asking the device what happened. With DDM, you tell the device the state it should be in, and the device works to reach that state and keep it there, without the server having to keep checking.

In everyday terms, classic MDM is like a manager who gives an instruction, then keeps ringing to ask whether it has been done. DDM is like giving someone a clear goal and a deadline. They get on with it, and tell you when it is done or when something changes.

Three ideas matter for IT teams:

• Declarations. Settings, the credentials they need, and rules for when they apply are sent to the device together.
• Device autonomy. The device can apply or remove settings itself when something changes, for example when its operating system version changes.
• Status reports. The device tells the server when something relevant changes, and sends a full report every 24 hours. You see what is really installed instead of what a command was meant to do.

DDM can run alongside classic MDM, so you can move one area at a time. Software updates are now the area that has to move first.

How enforced updates work

With declarative software updates, you choose a target version and a deadline. The deadline uses each Mac’s own local time, so one setting works across offices in different time zones. Before the deadline, people are told about the update and when it is due. At the deadline, if the update is still not installed, the Mac quits open apps and restarts to install it. Deferrals of between 1 and 90 days are still available for when updates are first offered.

That last step is why communication matters. Anyone with unsaved work at the deadline could lose it, so the deadline and the warnings need to be set with care and explained to staff before the first forced update.

Where Jamf Blueprints fit

Blueprints are how Jamf Pro delivers Apple’s declarative device management. A Blueprint can enforce a software update with a target version and a deadline, and report each Mac’s progress back to Jamf Pro. If you use Jamf, moving your update policies into Blueprints is the practical way to keep Macs on macOS 27 patched.

It works. For a global trading company with around 1,000 Macs, we moved updates to declarative management in Jamf and took update compliance from 65% to 98% in four weeks.

Settings that change when the Mac changes

With classic MDM, a change of setting needs a round trip. The Mac reports its details to the server, the server works out which group the Mac now belongs to, and then it pushes a new profile. Until that happens, the Mac keeps its old settings. A configuration profile is also only checked once, when it is installed.

Declarative management removes that wait. A declaration can carry an activation condition, which Apple calls a predicate, based on what the device knows about itself, such as its operating system version or the type of device. The Mac keeps checking its declarations as things change, and switches a setting on as soon as the condition is met, without waiting for the server. Jamf’s product team gives the example of a Blueprint that only activates once a Mac has updated to macOS 26.4 or later.

This suits settings that only work on newer versions, or that should change straight after an update. One thing to know: Jamf says there is not yet a view showing which Macs have activated a declaration and which have only received it, so the status reports matter.

Proving a Mac is genuine: Managed Device Attestation

Managed Device Attestation lets a device prove what it is, backed by Apple’s own servers rather than the device’s word. It confirms that the device is a genuine Apple device, that it is a specific device, that it is managed by your organisation, and that its private key is tied to its hardware. Apple says this reduces “the risk of a compromised or spoofed device gaining access to organizational resources”.

In practice, it is used when a Mac requests a certificate, for example for Wi-Fi or VPN access. With attestation, the certificate only goes to a real, managed Mac, and its key cannot be copied to another machine. Jamf Pro can install the certificate settings that use it, known as ACME, and you also need a certificate authority that supports attestation. On the Mac it needs Apple silicon and macOS 14 or later, which every Mac that runs macOS 27 already meets.

Intel Macs cannot move to macOS 27

macOS 27 runs only on Apple silicon Macs. Intel Macs stay on macOS Tahoe 26 or earlier, so for a while most organisations will manage two groups of Macs. Plan for both: declarative updates for the Apple silicon fleet, a clear end-of-life date for the Intel Macs, and a replacement budget for the ones you still rely on.

A migration checklist

1. Take stock. List every Mac with its model and macOS version, and mark the Intel Macs that cannot run macOS 27.
2. Find the old controls. Note every update policy, deferral restriction, cadence setting and script you use today. These are what stopped working.
3. Build the Blueprint. Set the target version, the deadline and the notification approach in one place.
4. Test on a pilot group. Start with IT and a few willing colleagues, then roll out in rings.
5. Tell people. Explain the deadline, what the reminders look like and what happens to unsaved work at the deadline.
6. Watch the status reports. Check which Macs have installed, which are waiting and which are stuck, and follow up the stragglers.
7. Remove the old settings. Once the Blueprint is working, retire the legacy policies so nobody relies on them by mistake.

Other declarative changes in macOS 27

Apple also added declarative network settings for VPN, DNS and relay, new status items such as the enrolment type and Lockdown Mode, and the option to deliver older configuration profiles as declarative assets. Updates are the urgent change, but the direction is clear: more of Mac management is moving to DDM.

How we help

A Jamf Pro health check shows which of your update settings stopped working and what to replace them with. If you want the move done for you, our projects team builds and tests the Blueprints, and our Mac IT support keeps your Macs patched afterwards.