These capabilities began with the WWDC 2025 management updates. This guide has been revised against Apple’s documentation on October 12, 2026. Apple’s services have also changed: the company announced Apple Business in March 2026, combining built-in device management with business and customer-facing services. That platform change has an important migration limitation, explained below. Apple Business announcement.
Which devices can move to another MDM service?
Apple’s current migration requirements cover iOS 26, iPadOS 26 and macOS 26 or later. The normal route requires organization-owned devices enrolled through Automated Device Enrollment; macOS also supports a profile-based unenroll-and-reenroll route. Devices added manually with Apple Configurator must be past their 30-day provisional period.
Shared iPad is excluded. Migration to or from Apple Business’s built-in device management service is also unsupported. A company moving between supported third-party services therefore has a different deployment decision from one adopting Apple’s built-in management. Confirm the route before promising employees that they can retain their existing setup.
Rebuilding the destination configuration
The handover replaces the management relationship and its configuration. Apple’s migration planning guide tells administrators to document dependencies, connect the destination service to Apple services, recreate enrollment and configuration profiles, and test the transition. Identity providers, certificates, network access and app distribution all belong in that preparation.
Build the destination profiles before scheduling the move. Apple calls for matching configurations and using the await-configuration state for managed apps, Wi-Fi, FileVault and Activation Lock. The device should not be released for normal use while essential parts of its new configuration are still missing. Apple’s preparation sequence.
Managed apps need an explicit handover
On iPhone and iPad, preserving managed apps and their associated data depends on the destination service delivering those apps before it sends the DeviceConfigured command. Apple also says not to set a migration deadline longer than 30 days when apps purchased in volume are involved. Content-token transfer and app-license behavior need attention; retaining user data alone does not guarantee a continuous app deployment. App preservation and volume-purchase rules.
A useful pilot checks the complete work path after reenrollment: network connection, work-account sign-in, access to an existing file, required apps and security configuration. Apple recommends testing the migration and its operational process, then considering batches for a larger fleet. Migration testing and rollout guidance.
Mac work-account sign-in moves into setup
Apple’s WWDC 2025 identity changes brought Platform SSO registration into Setup Assistant during Automated Device Enrollment. The user authenticates with the organization’s identity provider before proceeding. A local Mac account is then created, using either a synchronized password or a user-set password with Secure Enclave-backed authentication. The identity-provider integration still has to support and configure this flow. Apple’s identity-integration session.
Shared Macs have a separate option: Authenticated Guest Mode. Users sign in with a cloud identity, and their session data is removed when they log out. That makes it a different choice from a dedicated employee Mac where files should persist. Tap to Login adds a compatible Wallet credential and an external NFC reader to that shared-device setup. Shared-Mac sign-in details.
App-update control serves a different purpose
The same WWDC session describes per-app update control and version pinning on iOS and iPadOS, plus declarative deployment of App Store apps, custom apps and packages on macOS Tahoe. These controls let IT stage changes to a required application. Validate the work application on a representative group of devices before expanding the release. App-management changes.
Before selecting a migration date, ask the destination MDM vendor to confirm the enrollment route, app-license transfer, configuration wait state and identity-provider setup. For a shared Mac, decide whether a session should persist or be cleared at logout. These decisions determine which of Apple’s management features the organization actually needs.
