watchOS 26.6 Beta 3: New Identity APIs, Passkey Enhancements, and MDM Controls for Secure Enterprise Integration

Apple’s release of watchOS 26.6 beta 3 (build 23U5049c) marks a pivotal update for enterprise security, identity management, and developer integration on Apple Watch. As Apple continues expanding managed device support and authentication APIs, this beta cycle—alongside recent WWDC announcements—delivers concrete improvements for fleet admins and developers targeting watchOS in regulated or federated environments.

What’s New in watchOS 26.6 Beta 3

• Enhanced Passkey support: Platform authenticator APIs now expose richer credential flows and cross-device sync via iCloud Keychain, allowing Apple Watch to act as a passkey holder and FIDO2 authenticator.
• AuthenticationServices updates: Sign in with Apple and passkey APIs are unified on watchOS, enabling seamless OIDC flows and credential management for third-party and enterprise apps.
• MDM control expansion: New configuration profile payloads and declarative device management support for watchOS, including restrictions for passkey provisioning and SSO extension management.
• LocalAuthentication integration: Improvements to Secure Enclave-backed authentication, now including support for biometric unlock (Face ID/Touch ID equivalents) and secure API access for watchOS apps.
• Managed Apple ID enhancements: Foundation laid for upcoming federation features and SCIM provisioning, visible in beta profile options for ABM/ASM-enrolled watches.

What’s Coming: WWDC 2026 and Developer Beta Roadmap

• Passkey provisioning for managed fleets: Announced at WWDC, Apple intends to allow device admins to pre-provision passkeys to Managed Apple IDs on Apple Watch, streamlining onboarding for enterprise apps.
• Apple Platform SSO on watchOS: SSO Extension support and Kerberos integration are slated for watchOS 27, enabling federated login directly on Apple Watch for enterprise apps and managed configurations.
• Declarative Device Management: Expanded support for declarative management profiles, allowing admins to enforce identity and authentication requirements without manual scripting or device polling.
• Digital credentials in Wallet: ISO 18013-5 digital driver’s license support is coming to watchOS, enabling secure presentation and verification workflows for regulated industries.
• Private Relay and App Tracking Transparency: Improved privacy controls and reporting for managed watchOS fleets, building on iOS/macOS privacy-preserving identity features.

Why This Is Better: Concrete Improvements

• Unified authentication APIs: Developers can now target AuthenticationServices on watchOS with the same codebase as iOS/macOS, reducing platform fragmentation and simplifying secure login flows.
• Enterprise-grade passkey management: Admins gain granular control over passkey provisioning, revocation, and cross-device sync for Apple Watch users—previously only available on iOS/macOS.
• Broader MDM coverage: Declarative management and expanded payloads allow for tighter security enforcement and compliance reporting, matching Android Enterprise and Windows Autopilot capabilities.
• Secure Enclave-backed authentication: Enhanced LocalAuthentication support ensures credentials and biometric unlock are hardware-protected, closing gaps with competing platforms.

How to Implement or Respond

Developers: Integrate Passkey and Sign in with Apple on watchOS

Use the updated AuthenticationServices APIs to enable secure login and credential management in your watchOS app:

import AuthenticationServices

@main
struct WatchApp: App {
    var body: some Scene {
        WindowGroup {
            ContentView()
        }
    }
}

struct ContentView: View {
    @State private var credential: ASAuthorizationCredential?

    var body: some View {
        Button("Sign In") {
            let request = ASAuthorizationAppleIDProvider().createRequest()
            request.requestedScopes = [.fullName, .email]
            let controller = ASAuthorizationController(authorizationRequests: [request])
            controller.delegate = self
            controller.performRequests()
        }
    }
}

extension ContentView: ASAuthorizationControllerDelegate {
    func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
        self.credential = authorization.credential
        // Validate token server-side
    }
    func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
        // Handle error
    }
}

Admins: Enforce Passkey and SSO Restrictions via MDM

Apply new payloads in your MDM console to control passkey provisioning and SSO extension usage:

    PayloadType
    com.apple.configuration.profile
    PayloadDisplayName
    Passkey Restriction
    PayloadContent
    
        
            PayloadType
            com.apple.passkey
            AllowPasskeyProvisioning
            
        
        
            PayloadType
            com.apple.ssoextension
            AllowedSSOExtensions
            
                com.microsoft.sso
                com.okta.sso
            
        
    

Audit Device Compliance

Verify passkey and SSO status on managed Apple Watch devices:

mdmctl status --device "Apple Watch" --payload "com.apple.passkey"

Or check via Apple Business Manager for ABM/ASM-enrolled watches:

• Login to Apple Business Manager
• Navigate to Devices > Apple Watch > Profiles
• Confirm “Passkey Provisioning” and “SSO Extension” payloads are applied

What to Check: Verification Steps

• Confirm watchOS 26.6 beta 3 is installed via Settings > General > About
• Validate AuthenticationServices and Passkey API availability in Xcode 16 beta
• Review MDM profile logs for passkey and SSO restrictions
• Test Sign in with Apple flow using Managed Apple ID on Apple Watch

Bottom Line

watchOS 26.6 beta 3 delivers foundational improvements to authentication, passkey management, and MDM integration. Developers and admins should begin testing the new APIs, updating MDM profiles, and preparing for expanded SSO and managed credential provisioning ahead of watchOS 27. Prioritise integration of AuthenticationServices, enforce passkey restrictions, and verify compliance via Apple Business Manager for Apple Watch fleets.