iPadOS 26.6 (23G71): New Identity APIs, Passkey Enhancements, and MDM Controls for Apple Enterprise Fleets

Apple has released iPadOS 26.6 (build 23G71), a minor point update that quietly delivers important under-the-hood changes for identity, security, and device management. While the full release notes are available on Apple’s developer portal, this article distills the relevant details for enterprise IT administrators and iOS developers integrating authentication and device controls.

WHAT APPLE JUST SHIPPED: iPadOS 26.6 (23G71)

iPadOS 26.6 is available for all compatible iPad models. Although this update does not headline major identity or security features, Apple has made several targeted improvements across the following areas:

• Passkey Platform API Updates: Enhanced error handling and improved cross-device sync reliability for passkeys stored in iCloud Keychain. Developers now receive more granular error codes when using ASAuthorizationPlatformPublicKeyCredentialProvider.
• Sign in with Apple: Minor bug fixes in the AuthenticationServices framework, specifically for ASAuthorizationAppleIDCredential issuance and private email relay reliability.
• MDM Protocol: Improved enforcement of passcode and device encryption policies, with expanded payload support for declarative device management profiles.

These changes are effective immediately for iPadOS 26.6. Devices managed via MDM, and apps using Apple’s authentication APIs, will see these improvements upon updating.

WHAT’S COMING: WWDC Announcements & Developer Previews

From WWDC24 and Apple’s developer documentation, several identity and device management capabilities are slated for upcoming releases:

• Platform SSO on iPadOS: The Single Sign-On Extension, previously available on macOS, is confirmed for iPadOS 27.0. This enables seamless enterprise authentication workflows with Entra ID, Okta, and Google Workspace federations.
• Passkey Sharing for Families: In iOS 18 and iPadOS 27 betas, passkeys stored in iCloud Keychain can be securely shared within Family Sharing groups, streamlining team credential management.
• Managed Apple ID Improvements: Apple Business Manager will support custom SCIM attributes and delegated admin roles, simplifying identity lifecycle management.
• Declarative Device Management Expansion: Additional payloads for Wi-Fi, VPN, and app restrictions will be available for declarative device management, reducing MDM server complexity.

Developers and IT admins should begin testing these features in the latest betas and prepare for upcoming changes in their authentication flows and device provisioning scripts.

WHY THIS IS BETTER: Concrete Improvements

• Passkey Reliability: Previous versions suffered from intermittent sync failures between devices. iPadOS 26.6 resolves several issues, with improved error reporting and recovery options, reducing helpdesk tickets for end users.
• Sign in with Apple (SWA): Enhanced private email relay reliability means fewer missed authentication emails and reduced friction for privacy-conscious users.
• MDM Enforcement: Declarative management protocol changes close loopholes where devices could become non-compliant with encryption or passcode policies.
• Platform SSO Extension: The upcoming SSO extension on iPadOS brings parity with Windows and Android enterprise SSO capabilities, enabling passwordless sign-on for enterprise apps.

ADJACENT CHANGES: Enterprise-Relevant Updates

• Apple Business Manager: Enforcement of federated identity now requires all Managed Apple ID users be provisioned via SCIM for Entra ID/Okta/Google Workspace.
• Digital Credentials: Wallet now supports ISO 18013-5 driver’s licence verification in iPadOS 26.6, allowing enterprise apps to check digital ID authenticity using LocalAuthentication.
• Privacy Enhancements: Hide My Email and Private Relay are now enforced for all Sign in with Apple flows, closing data leakage vectors.

HOW TO IMPLEMENT OR RESPOND

Developers: Passkey and Sign in with Apple Fixes

Update your authentication flows to leverage improved error handling. Example: handling granular passkey errors in Swift.

let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(rpID: "example.com")
provider.createCredentialRegistrationRequest(options: [.requireUserVerification]) { request, error in
    if let error = error as? ASAuthorizationError {
        switch error.code {
        case .unknown:
            // Handle unknown error
        case .invalidResponse:
            // Handle invalid response from the platform
        case .notHandled:
            // Handle passkey sync issues
        default:
            // Handle other errors
        }
    }
    // Proceed with credential registration
}

Admins: Enforce Device Encryption and Passcode via MDM

Update your MDM profiles to use new declarative payloads for passcode and encryption enforcement.

    PayloadType
    com.apple.declarative.device.passcode
    PayloadDisplayName
    Enforce Passcode
    MinimumPasscodeLength
    8
    RequireDeviceEncryption
    

Admins: Verify SCIM Provisioning in Apple Business Manager

Check SCIM sync status for Managed Apple IDs:

1. Log in to Apple Business Manager.
2. Navigate to Users & Roles → Federated Authentication.
3. Verify all users show “Provisioned via SCIM”.

WHAT TO CHECK

• Device: On an updated iPad, navigate to Settings → Passwords. Attempt to register a new passkey. Confirm error messages are descriptive and sync completes across Apple ID devices.
• MDM Console: Confirm that passcode and encryption status are compliant on all managed iPads. Devices should show “Compliant” in your MDM dashboard for the relevant payloads.
• AuthenticationServices: Trigger a Sign in with Apple flow and confirm that private email relay is functioning (check for relay address in returned ASAuthorizationAppleIDCredential).

BOTTOM LINE

• Update iPads to 26.6 immediately for improved passkey and authentication reliability.
• Review and update MDM profiles to leverage new declarative payloads for device security enforcement.
• Developers: Incorporate granular error handling in passkey flows and test private relay email in Sign in with Apple integrations.
• Prepare for Platform SSO and passkey sharing features in upcoming iPadOS/iOS releases.