# Apple DDM > Apple's next-generation device management protocol, and how CapaOne supports it alongside Legacy MDM. Source: https://docs.capaone.com/capaone/mobile-manager/apple-ddm/ Product: CapaOne — a separate CapaSystems product; do not apply this page to any other. Apple Declarative Device Management (DDM) is Apple's modern device management protocol. Instead of CapaOne sending a command and waiting for the device to respond, the device evaluates a set of declarations locally and reports status changes back on its own. Apple is phasing out the traditional command-and-response MDM protocol in favor of DDM, starting with devices running iOS 17 and later. ## Why DDM matters - **Faster, more reliable configuration** — declarations apply and reconcile on the device itself, without waiting on a round trip to the server. - **Software update management moves to DDM on iOS 27** — as of iOS 27, Legacy MDM's software update commands, software update queries, recommended cadence settings, and restrictions like deferrals and Background Security Improvements (BSI) no longer function. These commands don't error — they silently stop applying. Move software update policy to DDM's **Software Update Settings** and **Software Update Enforcement Specific** configuration types before deploying iOS 27 to your fleet. See [iOS 27 and Software Update Management](/capaone/mobile-manager/apple-ddm/ios-27-and-software-update-management/). - **Runs alongside Legacy MDM during the transition** — CapaOne supports both protocols, so you can migrate devices at your own pace instead of all at once. - **iOS 27 devices move to DDM automatically** — CapaOne automatically switches a device from Legacy MDM to DDM once it's running iOS 27, whether it's already on iOS 27 today or updates to it later. You don't need to request **Enable Apple DDM** for these devices — but this also means any DDM configuration you rely on (especially software update policy) must be in place *before* the device updates, not after. ## DDM in CapaOne CapaOne's DDM tab supports both **Supervised** and **Unsupervised (BYOD)** Apple devices running iOS 17 or later — the same management-mode split as Legacy MDM. DDM is only partially available on Unsupervised devices: which declarations apply depends on the device's iOS version and the specific declaration, not on management mode alone. See Apple's [declarative configurations guide](https://support.apple.com/guide/deployment/review-declarative-configurations-depf858becef/web) for the full breakdown of which declarations need Supervised mode. Configurations built for DDM live under their own **DDM** tab in **Apple → Configurations**, separate from your existing **Legacy** configurations — so nothing changes for devices you haven't migrated yet. ### Available configuration types Clicking **New** under **Apple → Configurations → DDM** opens the **Select a configuration type** picker, listing every available type as a flat, alphabetically sorted grid — CapaOne doesn't group them by category in the picker itself. The table below groups them by category for reference, so you can check whether a configuration type exists without opening the picker. For setup details on any individual type, see [DDM Configuration Types Reference](/capaone/mobile-manager/apple-ddm/ddm-configuration-types-reference/). ![CapaOne's Select a configuration type picker under Apple → Configurations → DDM → New, showing the Configurations tab with configuration types listed alphabetically](/attachments/capaone/apple-ddm-configuration-type-picker-configurations.png) | Category | Configuration types | |---|---| | Account | CalDAV, CardDAV, Exchange, Google, LDAP, Mail | | Network | DNS Proxy (Beta), DNS Settings (Beta), Relay (Beta), VPN Always On (Beta), VPN IKEv2 (Beta), VPN IPSec (Beta), VPN Plugin (Beta) | | Security | Certificate, Identity, Passcode Settings, Extensible SSO (Beta) | | Software Update | Software Update Settings, Software Update Enforcement Specific | | Intelligence & AI | External Intelligence Settings, Intelligence Settings, Siri Settings | | Apps & content | App Settings (Beta), Content Caching (Beta), Safari Bookmarks, Safari Extension Settings, Safari Settings, Web Content Filter Plugin (Beta) | | Device & input | Audio Accessory Settings, Keyboard Settings, Math Settings | | Legacy bridge (Supervised only) | Home Screen Layout | **External Intelligence Settings** is CapaOne's control for Apple's platform-level AI restrictions introduced in iOS 27 — it maps to Apple's `com.apple.configuration.external-intelligence.settings` declaration and can restrict Siri AI, Visual Intelligence, and third-party AI extensions such as ChatGPT. See [Apple's iOS 27 enterprise release notes](https://support.apple.com/en-us/148828) for the platform-level behavior this configuration controls. ### Assets: a second category alongside configurations **Apple → Configurations → DDM → New** has two tabs: **Configurations** and **Assets**. An asset isn't a configuration by itself — it's a reference to a credential, identity, or piece of data that a configuration can point to. For example, a Wi-Fi or VPN configuration might reference a Security Identity asset instead of embedding certificate material directly. ![CapaOne's Select a configuration type picker showing the Assets tab, listing the seven asset types](/attachments/capaone/apple-ddm-configuration-type-picker-assets.png) The Assets tab includes: - **Asset Credential ACME** — a reference to an ACME identity. - **Asset Credential Certificate** — a reference to a PKCS #1 or PEM encoded certificate. - **Asset Credential Identity** — a reference to a PKCS #12 password-protected identity. - **Asset Credential SCEP** — a reference to a SCEP identity. See [SCEP in CapaOne](/capaone/reference/scep-in-capaone/) for background on how SCEP issues certificates. - **Asset Credential User Name And Password** — a reference to data that describes a credential representing a username and password. - **Asset Data** — a reference to arbitrary data with a specific media type. - **Asset User Identity** — the user-identity data. See [DDM Assets](/capaone/mobile-manager/apple-ddm/ddm-assets/) for what each asset type is for and how to reference one from a configuration. ## In this section - [Enable Apple DDM](/capaone/mobile-manager/apple-ddm/enable-apple-ddm/) — migrate Apple devices from Legacy MDM to DDM, step by step. - [iOS 27 and Software Update Management](/capaone/mobile-manager/apple-ddm/ios-27-and-software-update-management/) — what breaks on Legacy MDM in iOS 27, and how to move software update policy to DDM. - [DDM Assets](/capaone/mobile-manager/apple-ddm/ddm-assets/) — credential, identity, and data assets that configurations can reference. - [DDM Configuration Types Reference](/capaone/mobile-manager/apple-ddm/ddm-configuration-types-reference/) — every available DDM configuration type, what it's for, and its status. ## Good to know - **DDM and Legacy MDM can coexist** — a device runs under one protocol at a time, but your organization can have devices on both while you migrate. - **Not every configuration needs to move immediately** — Legacy configurations that Apple hasn't deprecated keep working. Prioritize recreating configurations that are deprecated or unsupported under DDM. - **Legacy configurations can be delivered as declarative assets** — Apple can bridge a Legacy MDM profile into DDM by delivering it as a declarative asset, without a native DDM equivalent existing yet. **Home Screen Layout** is a live example in CapaOne: it's tagged **Supervised only** and is delivered as a legacy MDM profile declaration under the hood. - **Set up Apple MDM first** — DDM builds on the same push certificate, [Apple Business Manager (DEP)](/capaone/mobile-manager/apple-mdm/apple-dep-integration/), and enrollment already configured for [Apple MDM](/capaone/mobile-manager/apple-mdm/). See that section if you haven't enrolled Apple devices in CapaOne yet. - Seeing an unexpected error on a DDM configuration? See [DDM — Unknown DDM Configuration Error](/capaone/troubleshooting/ddm-unknown-configuration-error/).