Declarative Device Management (DDM)

Declarative Device Management (DDM) is Apple's modern, autonomous approach to managing software updates on macOS, iOS, and iPadOS devices, integrated with BigFix MCM.

What is Declarative Device Management?

Declarative Device Management (DDM) enables administrators to define a desired state for Apple devices, such as a target operating system version or update deadline, directly within the BigFix WebUI. Unlike traditional update methods that require the management console to continuously poll and push update commands, DDM empowers the device to autonomously fetch its update settings, download and install updates on schedule, and report progress back to BigFix in near real time.

Key Benefits

  • Automatic Progress Tracking: Administrators can monitor live updates as devices download, install, and complete OS updates.
  • Seamless Onboarding: New devices automatically receive update rules during initial setup, even before a user logs in.
  • Backward Compatibility: Older Apple devices continue to receive updates using standard management profiles, requiring no additional administrative effort.

Supported Operating Systems

Platform Minimum Version for DDM Updates Behavior for Older OS Versions
macOS macOS 14 (Sonoma) or later Uses standard update profile
Note: Devices running older OS versions continue to receive update policies without disruption using standard management profiles.

Prerequisites

Before deploying an OS Update policy using DDM, ensure the following prerequisites are met:

  • BigFix MCM version 3.8 or later is installed.
  • Apple devices are enrolled in BigFix MCM (via Automated Device Enrollment / DEP or User-Approved Enrollment).
  • macOS devices are Supervised (assigned through Apple Business Manager or Apple School Manager).
  • An active Apple Push Notification service (APNs) certificate is configured in BigFix.

DDM OS Policy versus Usual OS Policy

  • Usual (Legacy) OS Policy: Relies on repetitive server commands and check-ins to instruct the device on what action to take step-by-step.2
  • DDM OS Policy: Sends declarative sets (install declaration) once. The device evaluates its own state and executes enforcement locally at the designated deadline without waiting for further server instructions.
  • Usability: Usability-wise in the UI, they share the same seamless interface so the administrator experience is unified.

Pre-Enrollment Flow

In pre-enrollment, Declarative Device Management (DDM) policies are pre-configured on the server before a device is enrolled.
  • Goal: Deliver declaration sets to Apple devices during their initial setup/onboarding before any user logs in.
  • How it works:

    • For macOS, the admin stages declaration payloads (policy groups or platform defaults) in WebUI targeted at a Smart Group or as a platform default. Server-side DDM group collection is macOS-specific.

    • For iOS/iPadOS, OS Update policies are excluded from the policy-group picker; deployment is performed directly to enrolled devices via Deploy Policy.

    • When a new device enrolls (e.g. via ADE/DEP), MicroMDM/ddmsdk matches the device to the pre-staged declaration set and pushes declarations immediately during check-in.

Post-Enrollment Flow

Post-enrollment applies to devices that are already enrolled in the management system.
  • Deployment Request: An admin selects a specific active policy (e.g., an OS update target version and enforcement deadline) and deploys it to an individual enrolled device.
  • Plugin Action & API Routing: The plugin executes an install declaration command, passing a payload with the specific policy ID (policy:<policy_id>) through the MDM Gateway to the DDM SDK.
  • Sync & Fetching:
    1. The server triggers a notification command to the device, prompting a token comparison.
    2. If the device detects a mismatch between its local sync token and the server sync token, it calls the declaration items API.4
    3. The device retrieves the activation and configuration payloads directly from the server.
  • Execution & Status Reporting: The device stores the declarations and enforces the configuration autonomously on schedule. It then reports its compliance status (e.g., Compliant or Partially Compliant) back to the plugin.

The Role of Smart Groups

Smart groups allow pre-enrollment declarations to be dynamically targeted to specific sets of devices based on defined criteria rather than applying globally to all enrolling devices.
  • Targeting Logic: Pre-enrollment policy groups can be attached to specific smart group IDs.
  • Default Flag Management: When a policy group is assigned to a smart group, the backend sets the policy's default key to false (default: false). This informs the backend that the policy is no longer global and requires conditional group evaluation.
  • Dynamic Assignment: During device setup, if the device meets the criteria of a specific smart group, the backend serves the DDM declarations associated with that smart group.

How DDM is Seen on the Device

  • On an enrolled Apple device, open Settings $\rightarrow$ VPN & Device Management $\rightarrow$ Enrollment Profile.
  • Under the profile details, a dedicated Declarations or Configurations section appears once a DDM policy is successfully deployed.
  • Tapping the software update configuration displays the target OS version and the exact required enforcement deadline time.

Editing a Policy

To modify an existing DDM policy in BigFix Mobile:

  1. Open the policy in the BigFix WebUI.
  2. Update the desired settings as needed.
  3. Click Save to apply the changes.
Note: Saving an edit creates a new policy version and can mark existing policy-group references outdated.

All connected devices assigned to this policy will automatically synchronize and update their configurations to match the new settings.

Removing a Policy

Declarative Device Management (DDM) Policies: When you remove a policy set up through DDM, the system automatically unlinks the configuration. The device handles the removal automatically during its next sync, cleans up the settings locally, and updates its status in the Device Details page.

To remove a policy from BigFix MCM, you have two options:

  • Remove action: From the BigFix WebUI Actions menu, select Remove Policy action.
  • Remove from Policy Group: Remove the policy from the assigned Policy Group.

After removal, BigFix automatically instructs all targeted devices to remove the associated update rules.

Unenrolling a Device

When a device is removed from BigFix MCM, all Device Deployment Management (DDM) update policies are automatically cleaned up from the device record. No manual intervention is required to remove policies from unenrolled devices.