tvOS 26.6 Beta 2: Enhanced Sign In with Apple, Passkeys Sync, and MDM Improvements for Enterprise Environments

Apple has released tvOS 26.6 beta 2 (build 23L5744d), introducing new capabilities and security improvements for Apple TV devices in managed environments. This update is part of the larger Apple platform push following WWDC24, with parallel changes coming to iOS 18 and macOS 15. This article breaks down the most impactful identity, authentication, and device management features relevant to enterprise IT admins, security engineers, and developers.

What’s New in tvOS 26.6 Beta 2

• Expanded Sign In with Apple (SIWA) API support on tvOS, including improved token validation and private email relay integration.
• Passkeys sync via iCloud Keychain for Apple TV, allowing cross-device authentication and platform credential portability.
• MDM protocol updates for device restriction and identity provisioning, aligning with new Declarative Device Management standards.
• Managed Apple ID enhancements—including federation and SCIM support—mirroring recent changes in ABM/ASM and iOS/macOS.
• Support for Platform SSO Extension on tvOS, enabling enterprise SSO flows and conditional access policies.

Exact Requirements

• tvOS 26.6 beta 2 (23L5744d) for Apple TV HD, 4K, and future models.
• iOS 18 and macOS 15 for cross-device passkey and federated identity sync.
• Apple Business Manager or Apple School Manager with federated Managed Apple IDs (Entra ID, Okta, Google Workspace).

What’s Coming: WWDC24 Announcements and Beta Features

• On-device Passkey storage—passkeys will now be directly accessible from Apple TV, managed via iCloud Keychain, and can be provisioned by MDM.
• Private Email Relay updates—SIWA now supports improved privacy mechanisms for app logins on tvOS, including Hide My Email integration.
• Declarative Device Management (DDM)—MDM vendors can push new identity and security policies to Apple TV, including updated restrictions and user provisioning payloads.
• Platform SSO Extension—tvOS will soon support the SSO extension, enabling Kerberos and OIDC-based authentication for enterprise apps.

Why This Is Better

• SIWA Improvements: Previous tvOS versions required manual handling of OIDC flows. Now, SIWA APIs natively manage token validation and privacy, reducing developer burden and improving security.
• Passkeys Sync: Apple TV now participates in the FIDO2 ecosystem, offering passwordless authentication and seamless credential portability across iOS, macOS, and tvOS.
• MDM Enhancements: With Declarative Device Management, admins can enforce tighter controls, automate provisioning, and reduce drift, rivaling Android Enterprise and Windows Autopilot.
• Managed Apple IDs: Federation is now more robust, matching parity with iOS and macOS. SCIM support simplifies user lifecycle management for Apple TV endpoints.

How to Implement or Respond

Developers: Integrating Sign In with Apple on tvOS

Use the AuthenticationServices framework for SIWA. The new API requires less manual handling of token validation.

import AuthenticationServices

struct SIWAButton: View {
    var body: some View {
        SignInWithAppleButton(.signIn, onRequest: { request in
            request.requestedScopes = [.fullName, .email]
        }, onCompletion: { result in
            switch result {
            case .success(let authResults):
                guard let credential = authResults.credential as? ASAuthorizationAppleIDCredential else { return }
                // Use credential.identityToken (JWT) for server-side validation
            case .failure(let error):
                print("Sign in failed: \(error.localizedDescription)")
            }
        })
        .frame(height: 50)
    }
}

For server-side validation, use the updated Apple public keys endpoint to verify JWTs.

Admins: Enforcing Passkey and SIWA Policies via MDM

Declarative Device Management allows you to enforce Passkey sync and SIWA usage. Example mobileconfig for SIWA restrictions:

  
    PayloadType
    com.apple.declaration.device
    PayloadVersion
    1
    PayloadIdentifier
    com.example.siwa.policy
    SIWAEnforced
    
    PasskeySyncAllowed
    
  

Push this via your MDM console to enforce SIWA and Passkey policies.

Managed Apple ID Federation: SCIM Integration

Apple TV now supports SCIM-based provisioning for Managed Apple IDs. In your IdP console (e.g., Entra ID, Okta):

1. Enable SCIM provisioning for Apple Business Manager.
2. Map users to Apple TV devices/groups.
3. Verify attribute sync (e.g., email, role, device assignment).

What to Check

• On Apple TV, navigate to Settings > Users > Managed Apple ID. Confirm federation and proper SCIM provisioning.
• Test SIWA flow in your tvOS app; verify token is valid via your backend.
• In your MDM console, ensure Declarative Device Management policies are applied and Passkey sync is enabled.
• Confirm cross-device passkey sync: create a passkey on iOS/macOS and authenticate on Apple TV.

Bottom Line

Prioritise tvOS 26.6 beta 2 for managed Apple TV fleets: Upgrade SIWA integrations, enable passkey sync, and update MDM policies for improved security and identity management. Monitor Apple Business Manager for SCIM changes, and prepare for full Platform SSO support in final tvOS 26.6 release.