macOS 27: When ‘Works Correctly’ Is No Longer User-Immutable

How Apple demonstrates its enterprise apathy with each new major release of macOS

The content of this post is purposely high-level to avoid advertising specific actions even Standard Users can take to hinder enterprise-specified settings (which Apple no longer renders to be user-immutable). IYKYK.

Background

When the first beta of macOS 27.0 was released, we opened an AppleCare Enterprise Case and filed Feedback to report some unexpected behavior.

The macOS 27.0 Beta 3 release notes acknowledged the keys “did not work,” and by macOS 27.0 Beta 5, they were marked as “working correctly,” yet the immutability behavior we rely on from macOS 26 is no longer present for Standard Users on supervised devices, which was just confirmed with macOS 27.2 Release Candidate.

Issue

With all versions of macOS 26 — on a supervised Mac — we can specify a setting which is user-immutable — even for local admins.

With all currently released versions of macOS 27 — again, on a supervised Mac — that same setting can be disabled by even a Standard user.

Who. Owns. The. Device?

This is an organizationally owned Mac, enrolled via Apple’s Automated Device Enrollment and supervised.

What is the point of device supervision if the organization cannot enforce its security posture?

… Deep, cleansing breath …

---

Primary Apple Statements

Apple Support (Deployment Guide)

“Your organization can manage the state of a device — and maintain that state — by having devices independently apply configurations based on certain criteria. This management process, known as declarative device management, gives you new ways to enforce software updates, deploy configurations, and keep an up-to-date view across your managed devices.”

“Declarative device management lets devices apply configurations independently based on certain criteria. The criteria are defined as logical conditions that work using predicates.”

“It allows the device to asynchronously apply settings and report status back to the device management service without constant polling. … Declarative device management gives organisations more confidence that devices are in the desired state and that essential data is kept secure, even without internet connectivity.”

Apple Developer Documentation

“Use declarative management to make devices more autonomous and proactive.”

Declarations “represent policies the organization wants to enforce on the device.” Configurations represent the policy applied to the device; a configuration has an active state that is true when the device is implementing that policy.

WWDC21 – “Meet declarative device management” (Apple engineers)

“Declarative management allows the device to be autonomous and proactive, freeing up the server to be lightweight, reactive, and subscribe to updates without constant polling.”

“An autonomous device reacts to its own state changes and then applies management logic to itself without prompting from the server.”

“As the device state changes, the activation predicates are reevaluated without intervention from the server. Policy associated with the new device state will be applied and any outdated policy removed.”

WWDC22 – “Adopt declarative device management”

Restates the same core claim: the device is autonomous (reacts to its own state changes and applies management logic without server prompting) and proactive (status channel reports asynchronously).

Key statements from WWDC26 (Cyrus Daboo / Apple)

Apple explicitly retires the old framing:

“The future of device management is declarative management” … But the future is now. Declarative management isn’t something on the roadmap anymore. It’s here. It’s shipping. It’s in production across fleets around the world. If you’re managing devices today without using it, you’re working harder than you need to.

So now “The standard for device management is declarative management.”