DDM — Unknown DDM Configuration Error

Problem

A DDM (Declarative Device Management) configuration is applied to an iOS device but reports an “Unknown DDM configuration error”. The configuration appears valid and saves without issue in CapaOne, but the device does not accept it.

Cause

Each DDM declaration has its own minimum iOS version requirement. If the declaration is not supported on the iOS version currently installed on the device, the device will reject it with an unknown error. This is a device-side limitation — the configuration itself is not broken.

Solution

Check the minimum iOS version required for the specific DDM declaration that is failing:

1. Identify which DDM declaration type the configuration uses (e.g., App Settings, Software Update, Passcode, etc.).
2. Look up the declaration in Apple’s developer documentation at developer.apple.com/documentation/devicemanagement and check the minimum supported OS version.
3. Confirm the iOS version currently installed on the affected device in Apple → Endpoints → Mobile Devices.
4. If the device is running an older version than required, the configuration will start working automatically once the device updates to a supported iOS version. No changes are needed in CapaOne.

Example — DDM App Settings

The App Settings declaration requires iOS 27 or later. Devices running iOS 26 or earlier will reject an App Settings configuration with an unknown error.

Note

iOS 27 is currently in beta and is planned for public release in mid-September 2026. Configurations using App Settings can remain assigned — they will apply automatically once the device updates.

It is not currently possible to delay or block the upgrade to iOS 27 through MDM. The MDM payload settings for software update delays were deprecated in iOS 26.

Good to know

• The error is always device-side — “Unknown DDM configuration error” means the device does not recognise the declaration, not that the configuration is set up incorrectly in CapaOne.
• Different declarations have different requirements — always verify the minimum iOS version for the specific declaration type before troubleshooting further.
• Other configurations are unaffected — a DDM declaration that is unsupported on a device does not affect other configurations assigned to the same device.
• No action needed in CapaOne — once the device updates to a supported iOS version, the configuration applies automatically without reassigning or recreating it.