DDM (Apple)

Declarative Device Management (DDM) is an advanced framework introduced by Apple to enhance the management of iOS, iPadOS, and macOS devices. Unlike traditional device management methods, DDM allows devices to proactively apply configurations and policies based on declarations provided by administrators or IT departments. These declarations define the desired state of the device, enabling it to autonomously enforce settings and make adjustments without constant communication with a management server. DDM can manage various aspects of device configuration, including account setups, security policies, app management, and compliance enforcement. By utilizing a more device-centric approach, DDM reduces network traffic and server load, allowing for more efficient and scalable device management. This framework provides organizations with a dynamic and responsive way to ensure devices remain configured correctly and adhere to organizational policies, even in changing environments or when devices are offline.

Apple Device Management - DDM Assets

What

In FileWave 15.5, a new feature called Assets has been introduced to enhance Apple’s Device Declarative Management (DDM). Assets are reusable components that can be shared among different configurations. They allow administrators to create common settings—such as user credentials, server information, or certificates—that can be referenced across multiple DDM configurations without duplication. This streamlines device management by centralizing shared elements, reducing redundancy, and simplifying updates.

image.png

When/Why

Use Assets when you need to:

This approach is particularly beneficial for organizations managing large numbers of devices that require consistent settings, such as educational institutions or enterprises with standardized environments.

DDM Assets & Configurations are supported on devices running the following versions and above: iOS 15, iPadOS 15, macOS 12 Monterey.


How

To create and use Assets in FileWave 15.5:

  1.  Create an Asset:
    • Create a new Fileset and pick DDM Asset from the Apple section.
  2. Configure the Asset:
    • Define the settings you wish to reuse, such as user credentials, server addresses, or certificates. 

      image.png

  3. Reference the Asset in DDM Configurations:
    • Create or Edit a DDM Configuration: Create a new Fileset and pick DDM Configuration from the Apple section.
    • In the configuration settings, add a reference to the Asset you created if the DDM Configuration supports it. An example is the CalDAV configuration which can include Authentication credentials from a DDM Asset.
  4. Automatic Dependency Handling:
    • When a configuration references an Asset, FileWave automatically manages the Asset as a dependency.
    • Deploying the configuration will also deploy the associated Asset to the target devices.
  5. Deploy to Devices:
    • Assign the configurations that reference the Assets to your devices or device groups.
    • Monitor the deployment to ensure that devices receive both the configuration and the associated Assets.

Digging Deeper

Assets in FileWave 15.5 represent a significant step forward in device management efficiency. By centralizing common configuration elements:

By leveraging Assets, administrators can reduce the complexity of managing multiple configurations, ensure uniformity across devices, and respond quickly to changes in shared settings.

Apple Device Management - DDM Configurations

What

Device Declarative Management (DDM) is Apple’s modern approach to device management, introduced to enhance and eventually replace traditional Mobile Device Management (MDM) protocols. With FileWave 15.5, support for DDM configurations is now available, allowing administrators to manage Apple devices more efficiently. DDM shifts some management logic to the device, enabling it to proactively apply configurations and report status updates, reducing server load and improving scalability.

image.png

DDM options will be gradually extended over following FileWave versions, gradually providing a broader scope of offerings.  The screenshots in this KB are from FileWave 16.x

When/Why

Implement DDM Configurations in FileWave 15.5 when you aim to:

This is particularly useful for organizations managing numerous devices, seeking to optimize performance and reduce overhead.

DDM Assets & Configurations are supported on devices running the following versions and above: iOS 15, iPadOS 15, macOS 12 Monterey.

How

To create and use Configurations in FileWave 15.5:

  1.  Create a Configuration:
    • Create a new Fileset and pick DDM Configuration from the Apple section. 

      image.png

  2. Configure the Configuration:
    • Pick the desired Configuration
  3. Reference a DDM Asset in DDM Configurations:
    • Some Configurations can reference Apple Device Management - DDM Assets. An example is the Account: CalDAV Configuration which can be fed credentials from a DDM Asset (configured with the DDM Asset Editor)

      image.png

  4. Automatic Dependency Handling:
    • When a configuration references an Asset, FileWave automatically manages the Asset as a dependency.
    • Deploying the configuration will also deploy the associated Asset to the target devices.
  5. Deploy to Devices:
    • Assign the configurations to your devices or device groups.
    • Monitor the deployment to ensure that devices receive both the configuration and the associated Assets.

Fileset Status

Unlike Profiles, DDM configurations are deployed with one single DDM command, meaning the Client Info > Command History tab will not show individual events per DDM configuration delivered.

Likewise, when viewing the installed Profiles on a device, the DMM Configurations will not show as Profiles, but, instead, within the FileWave MDM Configuration Profile.  Accessing the Profile list from Settings of a device, open the FileWave MDM Configuration Profile and scroll down to Device Declarations:

image.png

In the above example, opening Global Settings should reflect the settings delivered by Apple DDM Configuration Filesets.  For example:

image.png

Digging Deeper

Declarative Device Management (DDM) represents a significant evolution in Apple’s device management strategy:

Key Benefits:

By embracing DDM configurations in FileWave 15.5, organizations can achieve a more efficient, scalable, and responsive device management system that meets the demands of modern IT environments.

Conflicting Payloads:

Apple have not provided any alternate information, from MDM Payloads, regarding the experience if two DDM configurations are applied to control the same feature, but with differing settings.  Please consider the following:

For what it is worth, testing the conflict between MDM and DDM for a restriction provided the following result:

In would be sensible to avoid conflicts where possible, rather than rely on a tested experience.

Background Tasks (DDM status - macOS)

What

FileWave has integrated Apple’s Declarative Device Management (DDM) capabilities to enhance the monitoring of background tasks on macOS devices. This new feature allows administrators to receive detailed reports on the background tasks that are present. The information provided includes the service identifier, the application path (e.g., /Applications/1Password.app), the status of the service (such as enabled or not registered), the type of service (application or login item), the user ID (UID) under which the service is running, and the code signature details.

By leveraging DDM, macOS devices can autonomously report this information without the need for constant server queries. This enhancement improves the visibility of background processes across your device fleet, aiding in compliance, security auditing, and troubleshooting efforts.

When/Why

This feature is particularly useful when there is a need to:

Why This Feature Matters

Understanding which background tasks are running on your macOS devices is crucial for maintaining a secure and efficient computing environment. Background tasks can have significant impacts on device performance, battery life, and security. Unauthorized tasks might access sensitive data or provide an entry point for threats. By receiving detailed reports on these tasks, administrators can take proactive measures to manage and secure their device fleet effectively.

The integration of DDM enhances this process by allowing devices to report their status autonomously. This reduces the need for frequent server polling, decreases network traffic, and provides up-to-date information without delays.

How

Enabling Background Tasks Reporting

To utilize this feature, ensure that your macOS devices are enrolled in FileWave and running macOS 12 Monterey or later, that DDM is supported on these versions and ensure the FileWave Client is at least v15.5.0. 

Accessing Background Tasks Data

Background tasks based on a launch daemon are now reported in Inventory for macOS devices supporting DDM, once the FileWave Client is up to date on a supported version of macOS. The below image shows an example of this inventory data.

image.png