# iOS 27 and Software Update Management > Move software update policy from Legacy MDM to DDM before upgrading devices to iOS 27, where Legacy software update management stops working. Source: https://docs.capaone.com/capaone/mobile-manager/apple-ddm/ios-27-and-software-update-management/ Product: CapaOne — a separate CapaSystems product; do not apply this page to any other. :::note[Before you start] This guide applies to Apple devices you plan to upgrade to **iOS 27 or later**. It assumes you've already read [Enable Apple DDM](/capaone/mobile-manager/apple-ddm/enable-apple-ddm/) and have DDM available for the devices in question. ::: Apple's [iOS 27 enterprise release notes](https://support.apple.com/en-us/148828) confirm that Legacy MDM's software update management no longer functions on devices running iOS 27. This doesn't remove Legacy MDM as a whole — other Legacy configurations keep working — but any policy that controls software updates through Legacy MDM silently stops applying. ## What stops working on iOS 27 The following Legacy MDM software update capabilities no longer function on iOS 27, according to Apple: - Software update commands (for example, forcing an install or a download). - Software update queries (checking what updates are available or pending). - Recommended cadence settings. - Deferral restrictions (delaying updates for a number of days). - Background Security Improvements (BSI) restrictions. None of these fail with an error. A device on iOS 27 simply stops honoring them, which means a policy that looked correct in CapaOne can quietly have no effect once a device updates. :::caution CapaOne automatically switches a device from Legacy MDM to DDM once it's running iOS 27 — whether it's already on that version or updates to it while enrolled. This transition isn't something you trigger, and there's no gap afterward where you can still react: any DDM software update configuration a device needs must already be assigned *before* it updates to iOS 27, not after. See [Enable Apple DDM](/capaone/mobile-manager/apple-ddm/enable-apple-ddm/) for how this automatic switch fits into the broader migration. ::: ## Move software update policy to DDM Apple's replacement is declarative software update management. In CapaOne, this lives under **Apple → Configurations → DDM** as two configuration types: - **Software Update Settings** — general software update policy for the device. - **Software Update Enforcement Specific** — enforcement behavior for a specific update, such as requiring installation by a deadline. To recreate a Legacy software update policy in DDM: 1. Navigate to **Apple → Configurations → Legacy** and open the configuration that currently controls software updates for the group you're migrating. Note its cadence, deferral, and BSI settings. 2. Navigate to **Apple → Configurations → DDM** and click **New**. 3. On the **Configurations** tab, select **Software Update Settings** or **Software Update Enforcement Specific**, depending on which behavior you need to replace. 4. Configure the equivalent policy and save. 5. Assign the new DDM configuration to the same group as the Legacy configuration, following [Step 3 of Enable Apple DDM](/capaone/mobile-manager/apple-ddm/enable-apple-ddm/#step-3-prepare-a-new-group-for-ddm). :::caution Verify the new DDM configuration is assigned and applying before you consider a device's migration complete. A device that upgrades to iOS 27 with only a Legacy software update policy in place has no effective software update policy at all. ::: ## Audit devices before upgrading Before allowing a group of devices to upgrade to iOS 27, confirm whether they still depend on Legacy software update policy: 1. Navigate to **Apple → Configurations → Legacy** and identify configurations that set software update cadence, deferrals, or BSI restrictions. 2. Check which groups and devices those configurations are assigned to. 3. For each affected group, confirm a matching **Software Update Settings** or **Software Update Enforcement Specific** DDM configuration is assigned before the group is allowed to update to iOS 27. 4. Treat groups without a DDM software update configuration as not ready for iOS 27 — hold their update policy at the current OS version, or accept that software update management has no effect on them once they update. ## Good to know - **This only affects software update management** — other Legacy MDM configurations (Wi-Fi, restrictions, apps, and so on) aren't affected by this change and keep working under Legacy MDM until you migrate them separately. - **The failure mode is silent** — there's no error or warning in CapaOne or on the device when a Legacy software update command stops applying on iOS 27. Auditing beforehand is the only reliable way to catch gaps. - **The move to DDM happens automatically, not on request** — CapaOne switches a device to DDM as soon as it's running iOS 27. Audit and configure software update policy for a group *before* you let it update, since there's no manual step in between to catch a gap. - **Source:** [Apple iOS 27 enterprise release notes](https://support.apple.com/en-us/148828), published September 14, 2026.