Apple managed apps: control licenses and versions with declarative MDM

Created August 15, 2026 · Source reviewed August 15, 2026 · Official source: Apple Developer · Topic: managed apps, Apple MDM, and compliance

Apple now documents the complete managed-app lifecycle with declarative management: installation, licensing, required or optional status, configuration, versioning, updates, and removal. For IT leaders, the value is not one more MDM command but a more predictable app policy across iPhone, iPad, Mac, and Apple Vision Pro.

1. What Apple officially documents

The AppManaged configuration can manage App Store and enterprise apps; on macOS, it can also manage an app installed through another channel. Apple documents managed attributes, including per-app VPN association, as well as app configuration and secrets. MDM can track declared status instead of inferring the outcome from a command that was merely sent.

For an App Store app, the management service must specify a device-assigned or user-assigned license. On Mac, a system-scope configuration requires a device license, while a user-scope configuration requires a user license. A mismatched assignment can therefore prevent installation or updating.

2. Required, optional, or pinned: three different policies

A required app must be installed and maintained by policy. In optional mode, Apple expects the user to initiate installation from a management app; an app already present is not automatically taken under management. This makes a clear distinction between the self-service catalog and the required business baseline essential.

Update behavior can follow App Store settings, remain always on, or remain always off. When the declaration specifies a version, that pin takes precedence over automatic updates. MDM can also change the ServerToken to trigger a fresh check without rebuilding the entire configuration.

3. What does this change for a Belgian or French organization?

For an SME, it provides a way to separate a small required baseline from apps employees choose, while avoiding unmanaged manual installations. For a mid-market organization, large enterprise, or public body in Belgium or France, it requires each critical app to have a defined business owner, license model, approved version, network path, and removal rule.

Security and compliance teams gain a more precise audit trail, but pinning must not become a permanent freeze: holding a known version helps qualification, while keeping it after a security fix increases risk. Every exception therefore needs an expiry date and an owner.

4. Underside analysis: design an app lifecycle matrix

Our view is that migration to declarative apps should begin with a matrix, not a fleet-wide switch. For each app, record the population, system or user scope, device or user license, required or optional status, target version, per-app VPN, configuration data, dependencies, and removal condition.

This matrix connects Apple Business Manager, Jamf or another MDM, Automated Device Enrollment, and support. It complements our guidance on ManagedApp secrets and moving apps to declarative management, with a specific focus on daily operations.

5. Recommended deployment plan

• Inventory apps, owners, licenses, and network dependencies.
• Separate the required baseline, optional catalog, and temporary or sensitive apps.
• Test system and user scopes on Mac together with their matching licenses.
• Define a pinning rule, maximum duration, and emergency unblocking procedure.
• Validate the states reported by MDM or Jamf before retiring legacy workflows.
• Document installation, updating, and removal in English and French runbooks.

Official source: Apple Developer — Installing, managing, updating, and removing apps.