With the next releases of macOS and iOS, DDM is no longer secondary to traditional MDM. It’s the standard.
Introduction
Why am I talking about this now? Declarative Device Management has existed for some time now, but has been described as the future of Apple device management. With the next releases of macOS and iOS, that description no longer fits. Apple is moving device management away from legacy MDM and into the declarative model. In some cases, the old way isn’t just being improved. It’s being replaced.
Software updates are a perfect example. The traditional MDM commands administrators have relied on are giving way to declarative software update enforcement, where the device is given the desired outcome and handles much of the work itself. That’s more than a new way to install an update. It represents a much larger change in how Apple expects devices to be managed. DDM isn’t something we need to prepare for anymore. It’s here.
Section 1: From Commands to Desired State
Traditional MDM has always been built around commands. The management server tells a device to do something, waits for a response, checks the result, and decides what needs to happen next. It works, but it also means the management server is responsible for much of the process.
DDM changes that relationship. Instead of telling a device each step it needs to take, the management platform declares the state it expects the device to maintain. The device evaluates that declaration against its current state and takes action when needed. Think of the difference as instruction versus intent.
Traditional MDM says, “Do this.”
DDM says, “This is what needs to be true.”
That distinction may seem small, but it changes where much of the work happens. The device no longer needs to wait for the management server to evaluate every change and determine the next action. It already knows what is expected of it and can respond locally. It also changes how the device communicates back to the management platform.
Rather than relying heavily on the server to repeatedly query the device for its current state, DDM allows the device to proactively report when relevant state changes occur. The management server still defines policy and remains in control of the desired outcome. What changes is how that outcome is achieved. And perhaps nowhere is that difference easier to see than software updates.
Section 2: Software Updates Show Us the Transition
Software updates are one of the clearest examples of what the transition from traditional MDM to DDM actually looks like. Traditionally, managing an OS update required the MDM server to do much of the orchestration. It had to determine what updates were available, send commands to the device, initiate the update, and then check back to see what happened. If the device wasn’t ready, didn’t respond, or the update failed, the process could start all over again.
Declarative Software Update Enforcement takes a very different approach. Instead of managing each step, the MDM platform declares the version the device needs to reach and when that update must be enforced. The device now has the information it needs to manage the process locally and reach that required state. The difference is simple:
Traditional MDM: “Install this update.”
DDM: “Be on this version by this date.”
More importantly, Apple isn’t positioning declarative software updates as another option administrators can choose alongside the old method. Traditional software update management is giving way to the declarative model.
And software updates aren’t an exception. Apple continues to move more management capabilities into DDM, including application configuration, credentials, security controls, and device status. The implementation may differ, but the idea behind them is the same: declare what should be true and allow the device to participate in maintaining that state. Software updates simply make the transition impossible to miss. What was once an alternative way to manage an Apple device is increasingly becoming the way to manage one.
Section 3: When DDM Simply Becomes Device Management
As more capabilities move into the declarative model, the distinction between MDM and DDM starts to matter less. Administrators shouldn’t have to think about whether a setting in their management console uses a traditional MDM command, a configuration profile, or a declaration. They need to define the outcome they want and trust their management platform to use the framework Apple provides to make it happen.
That puts much of the responsibility on MDM vendors. Supporting DDM can no longer mean implementing a few declarative capabilities while continuing to rely on traditional MDM everywhere else. As Apple makes more functionality declarative, management platforms need to expose those capabilities quickly and completely. This doesn’t make MDM platforms less important. In many ways, it makes them more important.
Apple provides the framework, but the MDM platform is still where administrators turn that framework into policy. How well a platform translates Apple’s declarative capabilities into something administrators can deploy, monitor, and troubleshoot will increasingly determine how well it manages Apple devices. And that brings us to an interesting point.
We’ve spent years treating Declarative Device Management as something separate from MDM. It was the newer model, the alternative, and eventually the future. But what happens when declarative management becomes the standard? At some point, the distinction disappears. DDM simply becomes device management.
Conclusion: The Future Is Now
For years, Declarative Device Management has been described as the future of Apple device management. That made sense when DDM existed alongside traditional MDM and adoption could happen gradually. That time has ended. Software update enforcement has given us a clear look at what happens next. The declarative method isn’t simply the newer option. It became the way the capability is managed.
For administrators, that means DDM can no longer be something to learn later. For MDM vendors, supporting only parts of the declarative framework is no longer enough. As Apple moves more management capabilities to DDM, vendors need to move with it. Full support is quickly becoming a requirement, not a feature.
DDM doesn’t need to replace traditional MDM all at once. It only needs to become the standard one capability at a time. And that’s exactly what we’re seeing. Declarative Device Management isn’t the future anymore. It’s already here.