Apple MDM: control app and binary execution with iOS and macOS 27
Apple has documented a declarative MDM configuration for iOS 27, iPadOS 27, tvOS 27, visionOS 27, and macOS 27 that can allow or block apps from launching. On Mac, control extends to binaries through the Endpoint Security framework. IT leaders now need to turn that capability into an operational compliance policy without freezing endpoints or creating avoidable support incidents.
1. What Apple has officially announced
The new com.apple.configuration.app.settings configuration is set to provide AllowedApps and DeniedApps keys on supervised devices running iOS, iPadOS, tvOS, and visionOS 27. Rules use bundle identifiers. If an app appears in both the allow and deny lists, it is blocked.
On supervised Macs running macOS 27, Apple plans AllowedBinaries and DeniedBinaries. Matching criteria can include CD Hash, Team ID, signing identifier, path, and binary state. Managed apps can be automatically permitted with AlwaysAllowManagedApps. Apple also says the former com.apple.applicationaccess.new profile is deprecated in macOS 27.
These features remain pre-release. Apple explicitly warns that they may be incomplete, changed, or removed before final release. Organizations should prepare and test, not promise definitive production behavior today.
2. Why this changes Apple fleet management
A strict allowlist can prevent anything that is not explicitly approved from running; a denylist instead targets apps or binaries known to be prohibited. On Mac, the announced granularity goes beyond application lists: helpers, command-line tools, and components embedded in an app bundle may all enter scope.
The potential value is high for regulated environments, kiosks, shared endpoints, and purpose-built fleets. So is the risk: poorly designed signing rules, forgotten updaters, Team ID changes, support scripts, or security binaries may be blocked. Software inventory and exception handling therefore matter as much as the MDM rule itself.
3. What does this change for a Belgian or French organization?
For an SMB, it opens a native route to limiting unapproved apps on supervised devices, provided its chosen MDM implements the configuration. A clean managed-app catalog and a rapid unblock procedure remain the priority.
For a mid-market company, large enterprise, or public-sector organization operating in Belgium or France, this development may strengthen ISO 27001, NIS2, and internal controls, but it requires evidence: target population, an owner for each exception, change records, pilot testing, and rollback capability. Policies must also account for local tools, French or Belgian business apps, and bilingual support teams.
4. Underside analysis: start with inventory, not a blocklist
Our view is that a sustainable policy starts by observing what actually runs, assigning ownership and criticality to apps and binaries, and then selecting the right model. A denylist may be appropriate for general-purpose Macs; an allowlist is more coherent for a kiosk or single-purpose device.
This preparation should connect Apple Business, Automated Device Enrollment, supervision, Jamf or another MDM, the app catalog, and incident response. It complements our guidance on ManagedApp on macOS, declarative privacy consent, and declarative update governance.
5. Recommended preparation plan
- Confirm planned support with the MDM or Jamf vendor and track changes throughout beta releases.
- Inventory bundle IDs, Team IDs, signatures, helpers, and binaries required by business and support teams.
- Separate policies for general-purpose endpoints, kiosks, shared devices, and sensitive environments.
- Start in audit mode and with a representative pilot group, using documented stop criteria.
- Define an exception process with expiry, ownership, approval, and an audit trail.
- Validate that MDM, EDR, VPN, FileVault, remote support, and update mechanisms remain operational.
Objective: prepare measurable, reversible execution control aligned with actual Apple fleet usage and ready for final validation of iOS, iPadOS, and macOS 27.
Prepare your Apple MDM policyOfficial source: Apple Platform Deployment — WWDC26 app management updates.