New MDM Features Coming in macOS 11 Big Sur & iOS 14

Last updated June 29, 2020

This article will be continually updated as Apple releases additional information and further clarification of upcoming functionality.

The Apple Worldwide Developer Conference (WWDC) started this week, and Apple has made public the changes coming in both the latest release of iOS 14 and macOS 11 (named “Big Sur”). We will be updating this page as additional information and clarifications are provided by Apple.

True App “Management” for macOS

Current app management in macOS is a far cry from the experience in iOS. For instance, an app can be installed via MDM in macOS today, however there is no mechanism for marking that app as managed or for uninstalling it. Apple indicates that, as of macOS 11, the app management experience will be much more similar to what it is in iOS today.

Apple also indicates that macOS apps can also now include configurations, much as iOS apps can include managed application configurations.

Lights Out Management for Mac Pro

macOS 11 will include a plethora of information and control MDM commands for managing lights-out devices (LOM). Presumably, Apple will include LOM functionality embedded in the hardware of new Mac Pro computers, allowing administrators to initiate remote power-on, restarts, and other out-of-band management activities.

To use LOM, administrators will need to deploy a dedicated macOS machine local to the Mac Pros that are to be managed. LOM will then be available for the Mac Pros via MDM.

Automated Enrollment Improvements

tvOS has supported a feature called auto-advance for some time now. This feature allows an admin to set up an Apple TV without having to click through the Setup Assistant screens. To start this process, the Apple TV is connected to ethernet so that setup may be orchestrated by Apple Configurator running on a computer on the same network.

As of 11.0, macOS will support this setup mode, or something similar, allowing a computer to transition from unboxing and power-on to the sign in screen with no additional interaction. This will work in tandem with Automated Device Enrollment (formerly Device Enrollment Program, or “DEP”), will require an ethernet connection, and appears to not utilize Apple Configurator.

Additionally:

  • Administrators can choose whether the user account created at device setup enrolls in the MDM user-channel or just the MDM device-channel
  • More setup assistant screens are now skippable

UAMDM And Supervision Consolidation

Previously, UAMDM and Supervision were separate concepts in macOS. Starting with macOS 11, UAMDM devices will now provide the same MDM functionality as supervised devices. For example, the following will become available for UAMDM:

  • Activation lock bypass
  • Bootstrap tokens
  • Scheduled software updates
  • Installation of profiles that require supervision

Furthermore, it appears that Apple is consolidating the terminology of enrollment states to simply organization-owned and user-owned. UAMDM/Supervised devices, and as a result, devices enrolled with Automated Enrollment (DEP) will be considered organization-owned. User-enrolled devices will be user-owned.

Managed OS Updates

Big Sur will add the ability for an MDM administrator to force macOS updates, including the reboot process. As is the case with iOS, macOS will also support OS update deferrals by up to 90 days.

Previously, a custom software update catalog URL could be set by the MDM admin. Admins who wished to control OS update availability and/or provide a local software update cache server would often use this feature to point devices to a local Reposado server.

Setup Assistant Skip Screens for Upgrades, Too

Apple Business Manager (ABM) and Apple School Manager (ASM) have long supported skipping setup assistant screens during device enrollment. Moving forward, MDM administrators will be able to configure screens to skip during OS upgrades as well.

Non-Removable iOS Apps

Previously, administrators could prevent users from removing any of their iOS apps on Supervised devices. Now, administrators can granularly select apps that are non-removable.

Content Caching Metrics via MDM

Content caching allows the “sharing” of downloads from Apple (whether they are apps, books, or OS updates) between devices on the same network. This effectively reduces the amount of internet bandwidth consumed for a site and also speeds up the delivery of already-cached downloads to devices.

In the upcoming release, the MDM protocol has been expanded to provide content caching metrics so that admins can determine how well content caching is being utilized by their enrolled devices.

Time Zone Awareness

The latest iOS and macOS releases will support setting the time zone via MDM, as well as retrieving the set value on a device.

Device Information

Devices will begin providing the number of resident users on a device. This relates to Shared iPad functionality.

Encrypted DNS Settings

Administrators can enhance the privacy and security of their users by encrypting DNS traffic between devices and DNS servers. Previously, a VPN connection was required to “wrap” DNS traffic in an encrypted channel.

Profile Changes

VPN-tied Profiles

Apple has added the ability to associate a number of different profile-specific payload types to VPN profiles, causing the OS to send traffic over a VPN connection when interacting with these services.

The new profiles to support this functionality are:

  • CalDAV
  • CardDAV
  • Exchange ActiveSync
  • Google Account
  • LDAP
  • Mail
  • Subscribed Calendar

Restrictions

Two functionalities have been added to the restrictions payload. They are:

  1. The ability to force delayed app software updates, and
  2. allow/disallow App Clips

Notifications

Notification configurations may now optionally specify a preview type.

SSO Kerberos Additions

The Single Sign On Kerberos extension has new configuration options. Namely, the ability to have a custom username label, define a “help” text string, configure the credentials cache and replication time, among other options.

Deprecated: Media Management Controls

The ability to manage media controls, such as eject, mount, and unmount has been deprecated and will no longer function in future macOS versions (presumably beyond 11.0).

Comments (6)

Do we know if the time zone stuff will allow us to turn on location services and automatic time zone? I’ve got an open case with Apple Enterprise support over that one 🙂

Hi Tony- Good question. We’re not sure. If Apple provides clarification this week we will update the article.

Just out of curiosity, will SimpleMDM support these new capabilities during the beta period or not until production builds are shipped in September?

Hi Marius- It depends. We triage incoming features and prioritize based on product roadmap and customer feedback. If you have particular features that you’d like to use, please submit them at https://suggestions.simplemdm.com/ . You will receive a notification if/when they are implemented.

Right now, enrolling a company-owned MacBook through DEP/ADE fails for us because the Setup Assistant is not capable of opening a browser for MFA. Did you see any information that this will finally change with Big Sur?

Hi Ben- We would need to better understand what you mean by “fails for us”. Are you using SimpleMDM, SAML authentication with an identity provider, and MFA provided by your identity provider? The webview presented during Setup Assistant in macOS 10.15+ is effectively a Safari browser and we have not seen issues with it.

Leave a Reply

Your email address will not be published. Required fields are marked *

See Why Apple Admins Prefer SimpleMDM

Start My FREE 30-Day Trial Now
  • New MDM Features Coming in iOS 13 & macOS Catalina 10.15

    By on June 3, 2019
    Read more
  • New MDM Features in Apple macOS 10.14, iOS & tvOS 12

    By on June 15, 2018
    Read more
  • Apple Announces New MDM Features for iOS 11.3 & macOS 10.13.4

    By on January 25, 2018
    Read more

See Why Apple Admins Prefer SimpleMDM No strings. No Spam.

Start My 30-Day Free Trial Now