Apple Identity and Security Updates in macOS 26.6: What Enterprise IT and Developers Need to Know

What Apple Just Shipped: macOS 26.6 (25G72)

Apple released macOS 26.6 (build 25G72) on June 27, 2026. This update includes security patches, refinements to identity APIs, and tighter integration for enterprise environments. IT admins and developers should note:

• Security fixes for LocalAuthentication, Secure Enclave, and system-level credential storage. CVE details in release notes.
• Enhanced FIDO2 platform authenticator support: Passkey creation, sync via iCloud Keychain, and improved cross-device flows.
• Managed Apple ID Federation: Updated SCIM support for Okta/Entra ID, improved error handling, and new admin controls in Apple Business Manager (ABM).
• SSO Extension policies: New payload options for Kerberos SSO and Enterprise SSO Extension, now available in MDM profile schema.

What’s Coming: WWDC Announcements & Beta Features

From WWDC26 and developer betas, Apple is previewing:

• Passkey sharing via AirDrop and Contacts in iOS 18/macOS 27 (developer beta).
• Declarative Device Management (DDM): Expanded payloads for identity, passkey sync, and SSO, coming in macOS 27.
• Verifiable Credentials API: Enable driver’s licences and other digital credentials in Wallet, targeting iOS 18/macOS 27.
• Private Email Relay enhancements: Improved relay reliability for Sign in with Apple, with new diagnostics in developer portal.

Why This Is Better: Security, Compliance, and User Experience

macOS 26.6 offers substantial improvements:

• Passkey support now meets FIDO2 Level 2 certification, with cross-device sync and recovery. This outpaces Android’s fragmented FIDO2 support and Windows Hello’s limited recovery options.
• Managed Apple ID Federation now supports granular group mappings via SCIM, reducing provisioning errors and easing compliance with enterprise identity policies.
• SSO Extension payloads are more flexible, supporting multiple SSO providers (Kerberos, OIDC) and fallback options — a feature long-requested by admins managing hybrid fleets.
• Security patches fix vulnerabilities in credential storage and biometric authentication. Apple’s Secure Enclave now exposes new audit logs via MDM, aiding security teams.

Who’s Affected

• Enterprise IT admins managing fleets with ABM/ASM, federated identities, and SSO policies.
• Developers integrating Sign in with Apple, Passkeys, or authentication flows in macOS/iOS apps.
• Security engineers responsible for patching, credential auditing, and compliance reporting.

How to Implement or Respond

1. Patch Fleet to macOS 26.6

Run this command to verify OS version on endpoints:

sw_vers -productVersion

Update MDM compliance policies to require 26.6:

<dict>
  <key>PayloadType</key>
  <string>com.apple.os.update</string>
  <key>MinimumOSVersion</key>
  <string>26.6</string>
</dict>

2. Enable Enhanced Passkey Support

Developers: Use ASAuthorizationPlatformPublicKeyCredentialProvider (new in macOS 26.6):

import AuthenticationServices
let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: "your.rp.id")
let registrationRequest = provider.createCredentialRegistrationRequest(options: [.syncWithiCloudKeychain])

Admins: Ensure iCloud Keychain is enabled in MDM:

<dict>
  <key>PayloadType</key>
  <string>com.apple.icloud.managed</string>
  <key>iCloudKeychainEnabled</key>
  <true/>
</dict>

3. Update SSO Extension Policies

Configure Kerberos SSO Extension with fallback:

<dict>
  <key>PayloadType</key>
  <string>com.apple.ssoextension.kerberos</string>
  <key>Realm</key>
  <string>EXAMPLE.COM</string>
  <key>FallbackExtensionIdentifier</key>
  <string>com.apple.ssoextension.oidc</string>
</dict>

4. Managed Apple ID Federation Improvements

Admins: Review new Group Mapping options in ABM > Settings > Federation:

• Map Entra ID/Okta groups to ABM roles
• Test new SCIM provisioning events and error handling

Developers: Use Apple’s new /scim/v2/Users endpoint in Okta/Entra ID for more granular provisioning.

What to Check

1. Verify OS version: sw_vers -productVersion = 26.6
2. Check iCloud Keychain status: System Preferences > Apple ID > iCloud > Keychain
3. SSO Extension profile: MDM console > Device Profiles > SSO Extension > Kerberos/OIDC
4. ABM Federation: ABM > Settings > Federation > Group Mapping
5. Passkey sync: Attempt credential registration and authentication across devices

Bottom Line

macOS 26.6 delivers key security and identity updates. Patch immediately, update MDM profiles, review ABM federation policies, and implement new Passkey APIs. Prepare for upcoming WWDC features — build with passkeys, DDM, and verifiable credentials in mind.