Find out about the enterprise content that Apple has released for macOS Sequoia.
macOS updates improve the stability, performance or compatibility of your device and are recommended for all users. Device administrators can manage software updates using a device management service.
For information about general improvements, find out about updates to macOS Sequoia.
For details of the security content of these updates, see Apple security releases.
The softwareupdate —fetch-full-installer command completes successfully.
Mac computers no longer fail to obtain an IP address through DHCP when using a transparent proxy network extension.
Setup Assistant completes successfully if the user attempts to migrate data from a computer or backup and device management skips both Terms and Conditions and data migration.
Resolves an issue where Mac computers may boot to Recovery after installing a software update.
Platform SSO enrolment no longer fails when an associated domains configuration is required.
The authentication timeout is increased when manually entering 802.1X credentials.
macOS now supports the DHCPv6 Fully Qualified Domain Name option.
The Location Services pane is no longer skipped incorrectly during the setup process when MDM skips user creation and a user is created outside Setup Assistant.
Resolves an issue where Mac computers updating from macOS 15.4 with Platform SSO configured may start up in Recovery until FileVault has been disabled.
Resolves an issue where Control Centre presents repeated alerts that a screen-sharing application is accessing your screen.
Platform SSO keys no longer fail attestation.
Apple Filing Protocol (AFP) client has been deprecated and will be removed in a future version of macOS.
Improves reliability when installing macOS updates.
Setup Assistant allows authentication with passkeys and supported hardware security keys during MDM enrolment.
MDM can now configure enrolment into macOS beta programmes.
The “Transfer Your Data to This Mac” pane cannot be skipped by MDM during Setup Assistant. The "Restore" skip key still prevents transferring data from another computer or a backup during Setup Assistant.
A new Setup Assistant pane is displayed to enable automatic software updates. This pane is skipped when automatic updates are configured by MDM or when the "SoftwareUpdate" skip key is used.
When Private Wi-Fi Address is disabled by MDM for a managed Wi-Fi network, it cannot be manually enabled for that network by the user.
MDM can disable smart replies in Mail, the ability to summarise content in Safari, and Apple Intelligence reports.
When using TLS_ECDHE_RSA or TLS_DHE_RSA cipher suites, TLS certificates containing a Key Usage extension must have Digital Signature key usage set.
When using the TLS_RSA cipher suite, TLS certificates containing a Key Usage extension must have Key Encipherment key usage set.
Resolved an intermittent issue where the Login Window failed to accept a correct password.
Content filter extensions correctly receive non-TCP/UDP network protocol traffic.
Resolved an issue where Software Update offered a full installer requiring administrator authorisation to install instead of a smaller incremental update.
Resolved an issue where the Reactions tip would appear more than intended in video conferencing apps and would fail to be dismissed.
Resolved an issue that could cause a MacBook to boot to Recovery after a managed software update while not connected to power.
Resolved an issue where managed software updates incorrectly prompt for a user password when a bootstrap token is present.
Improves reliability for 802.1X authentication over Ethernet after a reboot when FileVault is enabled.
Kerberos tickets are successfully requested when iCloud Private Relay is enabled.
Finder no longer fails to copy some dataless files from SMB file shares.
Apple Intelligence is turned on automatically after updating to macOS 15.3 or during device setup unless MDM skips the Apple Intelligence setup pane.
MDM can require sign-in from a specified Workspace ID for requests to external intelligence integrations such as ChatGPT.
MDM can disable transcription summarisation in Notes.
AirPlay connects successfully when using the built-in firewall and a content filter extension.
Improves stability for apps over VPN connections when using the built-in firewall and a content filter extension.
MDM can manage Apple Intelligence Integrations including ChatGPT.
MDM can restrict Apple Intelligence image generation in Image Playgrounds and other apps.
AirPlay MDM payloads can be installed containing a password item with both the DeviceName string required for tvOS 18 and the deprecated DeviceID string used in earlier versions.
A new option is available to reset the OpenSSH configuration. Open man apple_ssh_and_fips in Terminal for details.
Multi-factor authentication in Safari reliably accepts the PIN for hardware security keys.
Improves stability for video-conferencing apps and DNS resolution when using the built-in firewall and a content filter extension.
Service discovery as part of account-driven enrolment can request the well-known resource from an alternative location specified by the MDM solution linked to Apple School Manager or Apple Business Manager.
MDM can manage Writing Tools and Mail summarisation.
MDM can prevent prompts triggered by apps using deprecated content capture technologies.
MDM can prevent users from enabling Media Sharing in System Settings.
Login and unlock complete without delay when a passcode policy is configured by MDM.
Upgrading to macOS 15 Sequoia completes successfully when a local user account is present without a valid home directory.
Improves network stability when using content filter extensions.
Improves APNs compatibility with legacy VPN products.
Improves compatibility with third-party security software
Improves reliability for single sign-on authentication in Safari
macOS Sequoia includes new features, such as Safari extensions management, a new disk management configuration for external and network storage, and enhancements for software update management.
MDM can manage which Safari extensions are allowed, always on or always off, and what websites they can access.
The new disk management configuration can be used to choose whether external or network storage is allowed or disallowed, or limit mounting to read-only volumes.
Software updates can now be managed entirely with declarative device management, replacing the MDM profiles for software update restrictions, settings, and software update commands and queries.
Executables, scripts and launchd configuration files can be installed using MDM and stored in a secure and tamper-resistant location.
The Profiles section of System Settings has been renamed as Device Management and now appears in the General section.
profiles renew -type enrolment no longer requires admin credentials if you are not already enrolled in MDM.
New authentication options are available for Platform Single Sign-on.
New configuration keys are available for the Kerberos SSO payload.
MDM can prevent a Mac from mirroring any iPhone.
MDM can prevent system extensions from being disabled in System Settings.
The new Welcome to Mac screen can be skipped when using auto-advance or by using the Welcome skip key.
MDM can configure the use of the hardware MAC address instead of a private MAC address on a managed Wi-Fi network. A privacy warning is shown when using the hardware MAC address because it allows tracking by Wi-Fi networks and nearby Wi-Fi devices.
The EnableLogging and LoggingOption keys in the Firewall payload are deprecated and no longer necessary. Application Firewall logging is increased by default for the socketfilterfw process.
Profile-based User Enrolment is no longer supported in macOS 15. For User Enrolment, sign in to a Managed Apple Account in Settings.
A third-party app or launch agent that wants to interact with devices on a user’s local network must ask for permission the first time it tries to browse the local network. This does not apply to launch daemons running as root. Similar to iOS and iPadOS, the user can go to System Settings > Privacy > Local Network to allow or deny this access, giving users control over their privacy.
dscl and dsimport will trigger privacy prompts when attempting to change the home directory of a user. Previously, this did not happen when a device was under MDM management. Apps can be pre-approved for SystemPolicySysAdminFiles access using MDM with a PrivacyPreferencesPolicyControl payload.
Application Firewall settings are no longer contained in a property list. If your app or workflow relies on changing Application Firewall settings by modifying /Library/Preferences/com.apple.alf.plist, then you need to make changes to use the socketfilterfw command line tool instead.
The new xprotect command can be used by administrators or users to manually invoke XProtect functionality.
The Security Framework can now import PKCS12 files created with AES-256-CBC encryption.
spctl can no longer be used to disable Gatekeeper.
By default, the sudo command in macOS 15 does not have logging enabled. To enable logging for sudo, remove the line Defaults !log_allowed from the sudoers configuration file.
DirectoryService plug-in support has been removed for third-party plug-ins. Developers should migrate to Platform SSO.
Performance is improved when running endpoint security extensions that use live detection.
Automatic login is successfully enabled when using the LoginWindow payload to configure AutologinUsername and AutologinPassword for an existing user.
When the RequireAdminForAirPortNetworkChange key is set to false in an MCX payload, “Require Administrator Authorisation to Change Networks” is no longer enabled.
Devices reconnect more reliably to managed hidden Wi-Fi networks.