iOS 18 Beta 3: Identity, Security, and MDM Changes Every Apple Admin and Developer Must Know

What Apple Just Shipped: iOS 18 Beta 3 (24A5380h) Identity & Security Updates

Apple released iOS 18.0 beta 3 (build 24A5380h) on July 6, 2026. This build is mandatory for developers targeting iOS 18 features, and is a critical preview for enterprise admins preparing fall deployments. Key identity and security changes shipped include:

• AuthenticationServices updates: New Swift APIs for Passkey UI integration, improved Sign in with Apple token verification, and flexible credential providers.
• MDM protocol enhancements: Declarative Device Management (DDM) now supports granular restrictions for managed Apple IDs and passkey sync.
• Passkeys & Secure Enclave: Expanded support for hardware-bound credentials and explicit device presence verification.
• Managed Apple ID federation: Fresh SCIM attributes for Okta, Entra ID, and Google Workspace, with better error reporting in Apple Business Manager.
• Wallet digital credentials: Driver’s license API refinements and new verifiable credential provisioning flows.

What’s Coming: WWDC 2026 Announcements & Preview Docs

Apple previewed several upcoming capabilities developers and admins must prepare for:

• Enterprise Platform SSO: iOS 18 introduces improved SSO Extension support, allowing per-app Kerberos and OIDC configuration directly via MDM.
• Passkey cross-device sign-in: iCloud Keychain sync now supports enterprise passkey sharing, with admin control over sync policies.
• Private Relay for Managed Apple IDs: Admins will be able to enforce Private Relay at the MDM/profile level for federated identities.
• Declarative device management: New ‘RequireCredentialSync’ restriction, and device compliance queries for passkey presence.

Why This Is Better

Concrete improvements versus iOS 17 and competing platforms:

• AuthenticationServices: Apps can now request Passkey authentication with more granular fallback behaviors and UI customization. Unlike Android’s FIDO2 implementation, Apple exposes platform-specific credential context, reducing phishing risk.
• MDM: DDM restrictions are more specific—admins can mandate passkey sync per device/user, not just globally. Windows Hello lacks comparable cross-device credential enforcement.
• Federation: Managed Apple ID error logging now surfaces SCIM provisioning failures directly in Apple Business Manager, streamlining troubleshooting vs. Okta and Entra ID.
• Digital Credentials: Wallet APIs allow direct device provisioning of ISO 18013-5 credentials. Apple’s privacy model is stricter than Android’s digital ID flows.

How to Implement or Respond

Developers: New AuthenticationServices APIs

To initiate Passkey authentication with fallback UI, use:

import AuthenticationServices

let request = ASAuthorizationPlatformPublicKeyCredentialProvider(rpId: "your.relyingparty.com")
  .createCredentialRegistrationRequest(options: [.allowDevicePresenceFallback])

let controller = ASAuthorizationController(authorizationRequests: [request])
controller.delegate = self
controller.presentationContextProvider = self
controller.performRequests()

Check: Ensure ASAuthorizationController returns ASAuthorizationPlatformPublicKeyCredentialRegistration with device presence attestation in the delegate.

Admins: MDM Profile for Passkey Sync Restriction

To require passkey sync for managed Apple IDs, deploy the following mobileconfig:

  
    PayloadContent
    
      
        PayloadType
        com.apple.declaration.device-management
        PayloadIdentifier
        com.example.passkey.sync
        PayloadDisplayName
        Require Passkey Sync
        RequireCredentialSync
        
      
    
    PayloadType
    Configuration
    PayloadVersion
    1
    PayloadIdentifier
    com.example.enterprise.passkey
    PayloadDisplayName
    Enterprise Passkey Sync Restriction
    PayloadUUID
    12345678-1234-1234-1234-123456789abc
    PayloadOrganization
    Example Corp
  

Check: In Settings > Passwords > Passkeys, confirm “Sync Required by Administrator” is visible and enforced for managed Apple IDs.

Admins: SCIM Error Auditing in Apple Business Manager

To verify SCIM provisioning errors:

1. Log into Apple Business Manager.
2. Navigate to Settings > Accounts > Federation > SCIM Logs.
3. Review error details for failed user syncs (new in iOS 18 beta).

Check: Confirm error messages include attribute-level failure and remediation steps.

What to Check

• Developers: Confirm Passkey flows succeed with device presence attestation in test builds.
• Admins: Validate MDM-driven passkey sync enforcement and SCIM error visibility in Apple Business Manager.
• Security Engineers: Audit Secure Enclave status and passkey presence using security CLI on test devices:

security show-keychain-info ~/Library/Keychains/CloudKeychain.keychain

Check: Output must show “iCloud Keychain” and “Passkey sync enabled”.

Bottom Line

• Prioritise iOS 18 beta testing for all enterprise identity features.
• Update apps to use new AuthenticationServices APIs for Passkey flows.
• Deploy MDM restrictions for passkey sync and credential enforcement.
• Audit federation setups using new SCIM error logging in Apple Business Manager.

These changes substantially tighten enterprise security posture and streamline identity workflows for Apple fleets. Begin implementation and testing now for a seamless iOS 18 rollout.