iOS 18.6 (23G71): Critical Identity, Passkey, and MDM Enhancements—What Enterprise Apple Admins Must Know Now

Apple’s release of iOS 18.6 (23G71) marks a decisive shift for enterprise identity and device security. With precision improvements for Managed Apple IDs, Passkeys, and mobile device management (MDM), this update directly impacts IT admins federating with Entra ID, Okta, or Google, and developers integrating AuthenticationServices and Passkey flows. Below is a deep technical breakdown of what’s new, what’s coming, and actionable steps for securing your Apple fleet.

What Apple Just Shipped: Key Features in iOS 18.6 (23G71)

• Managed Apple ID Federation: Enhancements in ABM/ASM support for SCIM-based provisioning and Just-in-Time attribute updates.
• Passkey Cross-Device Sync: iCloud Keychain improvements allow seamless passkey migration across enrolled devices, supporting Recovery Key fallback.
• MDM Declarative Restrictions: New payloads for restricting passkey use and enforcing Apple Platform SSO device onboarding.
• Sign in with Apple API: OIDC flow update mandates JWT audience validation on token introspection; all apps must comply before August 2026.
• Secure Enclave Update: Hardware-backed credential generation now supports platform attestation for enterprise passkey issuance.

What’s Coming: WWDC & Beta Announcements

• Federated Apple Platform SSO: Previewed at WWDC26, native SSO extension will support non-Kerberos identity providers, including Entra ID and Okta, via OIDC.
• Enhanced Passkey Management API: New AuthenticationServices APIs—ASAuthorizationPlatformPublicKeyCredentialProvider—allow admins to enumerate, revoke, and migrate passkeys fleet-wide.
• ABM/ASM Delegated Administration: Beta features enable granular admin roles for device and user provisioning workflows.
• Digital Credentials Expansion: Support for ISO 18013-5 driver’s licenses in Wallet expands to more US states and EU countries, with new MDM controls for credential provisioning.

Why This Is Better: Concrete Improvements

• Attribute Mapping: Managed Apple ID federation now includes dynamic mapping, solving the historic issue of static attribute propagation. Real-time updates improve compliance and HR workflows.
• Passkey Migration: Previous versions failed to sync passkeys when devices were wiped/re-enrolled. iOS 18.6’s iCloud Keychain resilience ensures credentials persist—even after device churn.
• MDM Enforcement: Declarative management allows admins to restrict passkey and sign-in features at scale, closing gaps found in older profile-based approaches.
• OIDC Compliance: JWT audience validation aligns Apple’s Sign in with Apple with NIST and EU eIDAS standards, reducing token replay risk.
• Platform Attestation: Secure Enclave attestation allows organizations to issue verifiable, hardware-bound credentials, moving Apple closer to parity with Google Titan and Windows Hello for Business.

How to Implement or Respond: Step-by-Step Guidance

Federated Managed Apple ID: SCIM & Attribute Mapping

Ensure your identity provider supports SCIM and configure attribute mapping for Managed Apple IDs.

  userPrincipalName
  apple_id


  department
  apple_department

Test real-time updates by changing user attributes in Entra ID and verifying the change propagates to ABM within 30 seconds.

MDM Restrictions: Passkey and Platform SSO Enforcement

  com.apple.declarative.device.management
  
    true
    true
  

Push this profile via your MDM and confirm devices reflect restrictions in Settings > Passwords > Passkeys.

Sign in with Apple: OIDC JWT Audience Validation

Update server-side validation logic to enforce audience claim checks:

// Swift OIDC validation snippet
func validateAppleIDToken(_ idToken: String, audience: String) throws {
    let jwt = try decodeJWT(idToken)
    guard jwt["aud"] as? String == audience else {
        throw ValidationError.invalidAudience
    }
    // ...additional validation...
}

Log token validation outcomes and audit for failures before the August 2026 compliance deadline.

Passkey Cross-Device Migration: API Example

import AuthenticationServices

let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: "your.rp.id")
let credentials = provider.credentials()
// Enumerate and manage passkeys
for credential in credentials {
    print("Credential ID: \(credential.credentialID)")
    // Optionally revoke or migrate
    provider.revokeCredential(withID: credential.credentialID)
}

Verify migration and revocation by confirming changes in Settings > Passwords > Passkeys on all enrolled devices.

What to Check: Verification Steps

• Federated Apple IDs: Attribute changes in Entra ID/Okta are reflected in ABM/ASM within 30 seconds.
• MDM Restrictions: Devices enforce new passkey and SSO rules in Settings; no passkey creation allowed if restricted.
• OIDC Validation: Server logs show failed audience claims are denied; no unauthorized tokens accepted.
• Passkey Migration: Passkey presence/absence matches administrative actions across all devices.

Bottom Line: Prioritised Recommendations

• Update your MDM profiles immediately to enforce new passkey and SSO restrictions.
• Upgrade Sign in with Apple server validation to check JWT audience claims before August 2026.
• Enable SCIM attribute mapping in ABM/ASM and test real-time propagation.
• Leverage new AuthenticationServices APIs for granular passkey management.

iOS 18.6 (23G71) is a mandatory update for organizations serious about identity security, compliance, and streamlined device management. Act now to leverage these improvements before legacy approaches become unsupported.