Enable Apple DDM

This guide walks you through migrating Apple devices from Legacy MDM to Declarative Device Management (DDM) in CapaOne.

Before you start

• This guide applies to Apple devices running iOS or iPadOS 17 or later, or macOS 14 or later, enrolled in CapaOne — either Supervised or Unsupervised (BYOD).
• Don’t enable DDM on all devices at the same time. Start with a single device to confirm your setup works as expected before rolling out to a larger group.
• DDM configurations live under their own DDM tab in Apple → Configurations. Some Legacy configurations continue to work alongside DDM — you don’t need to recreate everything at once.
• The device needs a stable internet connection while it’s migrated. Use a Wi-Fi or cellular connection that isn’t managed by CapaOne, or the migration can fail.

Step 1: Plan your migration

Caution

As of iOS 27, Legacy MDM’s software update management no longer functions — software update commands, software update queries, recommended cadence settings, and restrictions like deferrals and Background Security Improvements (BSI) all stop working. These commands don’t error, they silently stop applying. If your fleet includes devices on iOS 27 or later, move software update policy to DDM before upgrading them.

CapaOne also switches a device to DDM automatically once it’s running iOS 27 — whether it’s already on that version or updates to it while enrolled. You don’t need to request Enable Apple DDM for these devices, but it also means any DDM configuration they depend on must already be in place: there’s no window after the update to react before the device is under DDM management.

1. Check device eligibility. The device must be running iOS or iPadOS 17 or later, or macOS 14 or later, whether it’s Supervised or Unsupervised (BYOD). Verify the OS version before proceeding — devices that don’t meet it can’t be enabled for DDM. If you plan to use a declaration that requires Supervised mode, confirm the device’s management mode as well.
2. Check for Legacy software update policy. Before migrating a group to iOS 27, confirm whether it currently relies on Legacy MDM for software update management — cadence settings, deferrals, or BSI restrictions. If it does, you need a Software Update Settings or Software Update Enforcement Specific DDM configuration in place first; see iOS 27 and Software Update Management for how to audit and configure this.
3. Review what the current groups assign. A device’s apps and configurations come from the groups it belongs to. If you move a device out of a group with many apps and configurations and into a DDM-only group, it can lose apps and configurations it still needs. List what each existing group assigns, and plan which group will deliver each item after the move.
4. Communicate with your users. Let them know their device management configuration is changing. No user action is required, but it’s good practice to set expectations.
5. Plan a phased rollout. Start with a pilot group or a single test device, confirm that configurations apply correctly, then expand to the rest of your fleet.

Step 2: Prepare configurations in DDM format

Before enrolling any devices, review your existing Legacy MDM configurations and identify which ones need a DDM equivalent.

1. Navigate to Apple → Configurations.
2. Switch between the Legacy and DDM tabs to compare what already exists in each format.

For each configuration that should be managed through DDM:

1. Navigate to Apple → Configurations → DDM.

2. Click New. This opens the Select a configuration type picker, with two tabs:

   • Configurations — every DDM configuration type, listed alphabetically. This is what you’ll use for most migrations. See DDM Configuration Types Reference for what each one does.
   • Assets — credentials, identities, and data that a configuration can reference, rather than configurations in their own right (for example, a certificate a Wi-Fi configuration points to). See DDM Assets if the configuration you’re recreating uses a certificate, identity, or stored credential.

   

3. Create a new configuration matching your existing Legacy configuration.

4. Save and verify the configuration.

Note

Legacy configurations that Apple hasn’t deprecated keep working alongside DDM. You don’t need to recreate all configurations immediately — prioritize any that are deprecated or flagged by Apple as unsupported under DDM.

Some Legacy configurations don’t have a native DDM equivalent yet. Apple can bridge these by delivering the Legacy MDM profile as a declarative asset. Home Screen Layout works this way in CapaOne today — it’s labeled Supervised only and is delivered as a legacy MDM profile declaration under the hood, even though it’s created from the DDM tab.

Step 3: Prepare a new group for DDM

Create a dedicated device group for DDM migration before you link any DDM configurations to devices. This keeps your rollout isolated from existing Legacy-managed groups and gives you a clear, at-a-glance view of migration progress.

1. Navigate to Management → Groups.
2. Click New and give the group a descriptive name, for example DDM - Pilot or DDM - Production.
3. Save the group. Don’t add devices yet.

Then link your DDM configurations to this group:

1. Navigate to Apple → Configurations → DDM.
2. Open each DDM configuration you prepared in Step 2.
3. Select the Assignment tab, and then Group.
4. Click Assign and move your new DDM group to Assigned.

Why a dedicated group?

Linking DDM configurations to a dedicated group — rather than your existing groups — lets you migrate devices one at a time simply by moving them into the DDM group. You can track exactly how many devices have migrated without disrupting devices that haven’t moved yet: devices in the DDM group have migrated, devices that aren’t are still on Legacy MDM.

The list you assign devices from can’t be filtered, so plan the time to select a large number of devices one at a time. See Managing Groups.

Caution

Don’t add a device to the DDM group until you’ve completed Step 4 and enabled DDM on it. Adding a device early doesn’t cause errors, but its DDM configurations won’t apply until the device is actually running under DDM management.

Step 4: Enroll and enable DDM on devices

Enroll the device as normal — see Apple Enrollment. The device enrolls under Legacy MDM initially.

Note

CapaOne automatically switches a device to DDM once it’s running iOS 27 or later — you don’t need the manual step below for those devices; it happens on its own once the device is on iOS 27, whether it’s already there at enrollment or updates to it later.

Use the manual steps below to enable DDM early on a device that’s still running an earlier iOS version — for example, to pilot your migration ahead of the rest of your fleet.

To enable DDM on an already-enrolled device:

1. Navigate to Apple → Endpoints.
2. Open the device page for the device you want to migrate.
3. Click the action menu (⋯) in the top right corner.
4. Select Request → Enable Apple DDM, and confirm.

Enable Apple DDM is only on the device page, so you enable one device at a time. It’s unavailable if the device runs an older OS version than iOS or iPadOS 17, or macOS 14. Point to the command to see the version the device reports.

When the device acknowledges the command, it runs under DDM management.

Step 5: Verify DDM enrollment

1. Open the device page in Apple → Endpoints. The device badge shows Supervised DDM or Unsupervised DDM (or Kiosk Mode DDM), confirming DDM is active.
2. Select the Configurations tab. On Assigned, DDM configurations are marked DDM. A DDM configuration that the device rejected shows an error icon with the reason. Applied shows the settings the device received.

If a configuration doesn’t apply, check that the correct group is assigned to it and that the device is a member of that group. See DDM — Unknown Configuration Error or Cannot Be Applied.