macOS 27: When ‘Works Correctly’ Is No Longer User-Immutable

How Apple demonstrates its enterprise apathy with each new major release of macOS

The content of this post is purposely high-level to avoid advertising specific actions even Standard Users can take to hinder enterprise-specified settings (which Apple no longer renders to be user-immutable). IYKYK.

Background

When the first beta of macOS 27.0 was released, we opened an AppleCare Enterprise Case and filed Feedback to report some unexpected behavior.

The macOS 27.0 Beta 3 release notes acknowledged the keys “did not work,” and by macOS 27.0 Beta 5, they were marked as “working correctly,” yet the immutability behavior we rely on from macOS 26 is no longer present for Standard Users on supervised devices, which was just confirmed with macOS 27.2 Release Candidate.

Issue

With all versions of macOS 26 — on a supervised Mac — we can specify a setting which is user-immutable — even for local admins.

With all currently released versions of macOS 27 — again, on a supervised Mac — that same setting can be disabled by even a Standard user.

Who. Owns. The. Device?

This is an organizationally owned Mac, enrolled via Apple’s Automated Device Enrollment and supervised.

What is the point of device supervision if the organization cannot enforce its security posture?

… Deep, cleansing breath …