Apple DDM FAQ
Short answers to the questions admins ask most when moving Apple devices to Declarative Device Management (DDM). Each answer links to the article with the full details.
Migration
Section titled “Migration”Does enabling DDM re-enroll or wipe the device?
Section titled “Does enabling DDM re-enroll or wipe the device?”No. Enable Apple DDM turns on DDM on top of the existing MDM enrollment. The device keeps its enrollment, apps, Legacy profiles, and data. See Enable Apple DDM.
Does the user notice anything when DDM is enabled?
Section titled “Does the user notice anything when DDM is enabled?”Not from the switch itself — there’s no prompt or restart. Users only notice the effect of new configurations, for example a request to set a passcode when Passcode Settings applies, or software update notifications from an enforcement.
Do my Legacy configurations stop working when a device moves to DDM?
Section titled “Do my Legacy configurations stop working when a device moves to DDM?”No. A device that runs DDM still accepts Legacy profiles and commands. Only Legacy settings that Apple has removed stop working — and that depends on the OS version, not on DDM. On iOS 27 and later, that’s software update management. See Legacy MDM to DDM Mapping.
What if the same setting comes from both a Legacy profile and a DDM configuration?
Section titled “What if the same setting comes from both a Legacy profile and a DDM configuration?”The device merges them and enforces the strictest value, the same way it handles two overlapping profiles. For software updates, the DDM configuration takes precedence. See How Multiple DDM Configurations Combine.
Can I move a device back from DDM to Legacy MDM?
Section titled “Can I move a device back from DDM to Legacy MDM?”No. Once a device runs DDM, it stays on DDM. This applies to every device: devices on iOS, iPadOS, or macOS 27 or later always run DDM, and on earlier versions DDM is your choice until you enable it for the device. A device on DDM can still receive Legacy configurations, so you can keep using Legacy configurations that Apple hasn’t deprecated.
Which devices move to DDM automatically?
Section titled “Which devices move to DDM automatically?”Devices that report iOS, iPadOS, or macOS 27 or later — whether they enroll on version 27 or update to it later. Devices on earlier versions stay on Legacy MDM until you decide to enable DDM for them. Make sure their DDM configurations, especially software update policy, are assigned before they update. See iOS 27 and Software Update Management.
Can I enable DDM on many devices at once?
Section titled “Can I enable DDM on many devices at once?”Enable Apple DDM is a device-page action, so you enable one device at a time. Devices on version 27 switch automatically. To migrate a large fleet on older versions, the most practical path is often to let devices update to version 27 — after the DDM configurations are in place.
Devices and enrollment
Section titled “Devices and enrollment”Which devices support DDM in CapaOne?
Section titled “Which devices support DDM in CapaOne?”iPhone and iPad on iOS or iPadOS 17 or later, and Mac on macOS 14 or later, enrolled in CapaOne — Supervised or Unsupervised. Individual configuration types have their own minimum versions. See DDM Configuration Types Reference.
CapaOne lists iPhone, iPad, and Mac endpoints under Apple → Endpoints. Other Apple platforms, such as Apple TV and Apple Vision Pro, have no endpoint list in CapaOne.
Does DDM work on unsupervised (BYOD) devices?
Section titled “Does DDM work on unsupervised (BYOD) devices?”Partly. Unsupervised devices accept many DDM types, such as accounts, certificates, passcode, and software update enforcement. Types such as App Settings, Intelligence Settings, Siri Settings, and Keyboard Settings need Supervised devices, and some types have individual settings that need supervision — for example, deferrals in Software Update Settings.
How do I see whether a device runs DDM?
Section titled “How do I see whether a device runs DDM?”Open the device in Apple → Endpoints. The badge shows Supervised DDM, Unsupervised DDM, or Kiosk Mode DDM when DDM is active.
What happens to DDM configurations when a device is unenrolled?
Section titled “What happens to DDM configurations when a device is unenrolled?”Removing the MDM enrollment removes everything delivered through it — DDM configurations, assets, and Legacy profiles alike. Settings return to the device’s defaults, and certificates and accounts installed by CapaOne are removed.
Do I need new network ports or firewall rules for DDM?
Section titled “Do I need new network ports or firewall rules for DDM?”No new ports. DDM uses the same MDM connection to CapaOne and the same Apple Push Notification service as Legacy MDM. Software updates enforced through DDM download from Apple’s servers as before. See Apple’s Use Apple products on enterprise networks.
Configurations
Section titled “Configurations”How fast does a DDM configuration apply?
Section titled “How fast does a DDM configuration apply?”When you assign or change a configuration, CapaOne notifies the device through Apple Push Notification service, and the device fetches only what changed. A connected device usually applies it within seconds to minutes. An offline device applies it the next time it connects.
How do I know whether a configuration applied?
Section titled “How do I know whether a configuration applied?”On the device page, select the Configurations tab. DDM configurations are marked DDM under Assigned. An error icon with a reason means the device rejected it — see DDM Status Reason Codes. Applied shows the settings the device received.
A configuration saves in CapaOne but doesn’t apply. Why?
Section titled “A configuration saves in CapaOne but doesn’t apply. Why?”CapaOne can’t know every device’s capabilities when you save. The device decides whether it supports the configuration, based on its OS version and enrollment type. The most common cause is an OS version below the type’s minimum. See DDM — Unknown Configuration Error or Cannot Be Applied.
What’s the difference between a configuration and an asset?
Section titled “What’s the difference between a configuration and an asset?”A configuration is policy that you assign. An asset is data — a certificate, identity, or credential — that a configuration points to. You never assign assets directly. See DDM Assets.
What happens when I remove a configuration?
Section titled “What happens when I remove a configuration?”The device removes it and its settings. For types that combine several configurations, such as Passcode Settings, the device recalculates the effective policy from the configurations that remain.
Is there a DDM equivalent for Wi-Fi?
Section titled “Is there a DDM equivalent for Wi-Fi?”Not yet. Wi-Fi stays a Legacy configuration, and it works on devices that run DDM.
Software updates
Section titled “Software updates”Do I still need Legacy software update policy?
Section titled “Do I still need Legacy software update policy?”For devices on iOS, iPadOS, or macOS 27 or later, no — it no longer functions. For older devices, it still works, but DDM software update configurations take precedence when both are present. Build new policy in DDM. See Software Update Settings and Enforce a Specific OS Update.
Can I force “always the latest version” automatically?
Section titled “Can I force “always the latest version” automatically?”Apple’s enforcement targets one specific version. To keep devices on the latest version, create a new Software Update Enforcement Specific configuration for each release, and combine it with Software Update Settings that turns on automatic downloads and installs on Supervised devices.
Good to know
Section titled “Good to know”- Still stuck? Start with DDM Status Reason Codes for configuration errors, and DDM Software Update Not Installing for update problems.
- Background reading — How DDM Works explains declarations, assets, and status reporting.