iOS 27 and Software Update Management

Before you start

This guide applies to Apple devices you plan to upgrade to iOS 27 or later. It assumes you’ve already read Enable Apple DDM and have DDM available for the devices in question.

Apple’s iOS 27 enterprise release notes confirm that Legacy MDM’s software update management no longer functions on devices running iOS 27. This doesn’t remove Legacy MDM as a whole — other Legacy configurations keep working — but any policy that controls software updates through Legacy MDM silently stops applying.

What stops working on iOS 27

The following Legacy MDM software update capabilities no longer function on iOS 27, according to Apple:

• Software update commands (for example, forcing an install or a download).
• Software update queries (checking what updates are available or pending).
• Recommended cadence settings.
• Deferral restrictions (delaying updates for a number of days).
• Background Security Improvements (BSI) restrictions.

None of these fail with an error. A device on iOS 27 simply stops honoring them, which means a policy that looked correct in CapaOne can quietly have no effect once a device updates.

Caution

CapaOne automatically switches a device from Legacy MDM to DDM once it’s running iOS 27 — whether it’s already on that version or updates to it while enrolled. This transition isn’t something you trigger, and there’s no gap afterward where you can still react: any DDM software update configuration a device needs must already be assigned before it updates to iOS 27, not after. See Enable Apple DDM for how this automatic switch fits into the broader migration.

Move software update policy to DDM

Apple’s replacement is declarative software update management. In CapaOne, this lives under Apple → Configurations → DDM as two configuration types:

• Software Update Settings — general software update policy for the device.
• Software Update Enforcement Specific — enforcement behavior for a specific update, such as requiring installation by a deadline.

To recreate a Legacy software update policy in DDM:

1. Navigate to Apple → Configurations → Legacy and open the configuration that currently controls software updates for the group you’re migrating. Note its cadence, deferral, and BSI settings.
2. Navigate to Apple → Configurations → DDM and click New.
3. On the Configurations tab, select Software Update Settings or Software Update Enforcement Specific, depending on which behavior you need to replace.
4. Configure the equivalent policy and save.
5. Assign the new DDM configuration to the same group as the Legacy configuration, following Step 3 of Enable Apple DDM.

Caution

Verify the new DDM configuration is assigned and applying before you consider a device’s migration complete. A device that upgrades to iOS 27 with only a Legacy software update policy in place has no effective software update policy at all.

Audit devices before upgrading

Before allowing a group of devices to upgrade to iOS 27, confirm whether they still depend on Legacy software update policy:

1. Navigate to Apple → Configurations → Legacy and identify configurations that set software update cadence, deferrals, or BSI restrictions.
2. Check which groups and devices those configurations are assigned to.
3. For each affected group, confirm a matching Software Update Settings or Software Update Enforcement Specific DDM configuration is assigned before the group is allowed to update to iOS 27.
4. Treat groups without a DDM software update configuration as not ready for iOS 27 — hold their update policy at the current OS version, or accept that software update management has no effect on them once they update.

Good to know

• This only affects software update management — other Legacy MDM configurations (Wi-Fi, restrictions, apps, and so on) aren’t affected by this change and keep working under Legacy MDM until you migrate them separately.
• The failure mode is silent — there’s no error or warning in CapaOne or on the device when a Legacy software update command stops applying on iOS 27. Auditing beforehand is the only reliable way to catch gaps.
• The move to DDM happens automatically, not on request — CapaOne switches a device to DDM as soon as it’s running iOS 27. Audit and configure software update policy for a group before you let it update, since there’s no manual step in between to catch a gap.
• Source: Apple iOS 27 enterprise release notes, published September 14, 2026.