What’s New in visionOS 26.6 Beta 3: Identity & Security Enhancements for Enterprise and Developers

What Apple Just Shipped: visionOS 26.6 Beta 3 (23O5752d) Identity & Security Features

On June 29, 2026, Apple released visionOS 26.6 beta 3 (build 23O5752d) for developers. This release continues Apple’s push to unify identity and security across its platforms, with targeted improvements for passkey authentication, Enterprise SSO, and device management controls. Full release notes are available at Apple Developer News.

Key Identity & Security Changes in 26.6 beta 3

• Passkey Platform Authenticator Refinements: Improved API stability for ASAuthorizationPlatformPublicKeyCredentialProvider and cross-device passkey login flows.
• Managed Apple ID Sign-In Enhancements: Improved reliability for Managed Apple ID authentication in federated enterprise (Entra ID, Okta, Google) environments on visionOS devices.
• MDM Policy Enforcement: Fixes to declarative device management profile installation, with new payload keys for visionOS-specific restrictions.
• Secure Enclave API Updates: Hardened cryptographic key management for LocalAuthentication and passkey storage.

What’s Coming: visionOS Identity Roadmap from WWDC26 and Developer Betas

• Platform SSO Expansion: Announced at WWDC26, visionOS will support Enterprise SSO Extension in 27.0, enabling seamless SSO across managed apps, similar to iOS/macOS. Admins can start prepping MDM payloads now.
• Passkey Sync with iCloud Keychain for Shared Devices: Upcoming API will let organizations enable passkey storage in managed iCloud accounts, supporting multi-user workflows in Apple Vision Pro labs and classrooms.
• Device Attestation for Vision Pro: Apple previewed device-bound attestations for visionOS, letting enterprise apps and MDM confirm device integrity and enrollment status at runtime.

Why This Is Better: Concrete Improvements Over Previous visionOS Releases and Competing Platforms

• Enterprise SSO Parity: visionOS 26.6 closes the gap with iOS/macOS—finally allowing managed app SSO via Apple’s Enterprise SSO Extension (vs. app-by-app login). Competing platforms (e.g., Meta Quest) lack this unified, policy-driven SSO approach.
• Managed Apple ID Federation Stability: Prior visionOS betas struggled with token refresh and sign-out flows for Entra ID and Okta. 26.6 resolves these, reducing helpdesk tickets and improving compliance for regulated verticals.
• Tighter Passkey Security: Secure Enclave APIs are better hardened to prevent local passkey extraction—even on developer units—mitigating attack vectors present in earlier betas.
• Declarative MDM: VisionOS now fully supports the declarative management protocol, letting admins push context-aware security policies that auto-remediate without device re-enrollment.

How to Implement or Respond: Admin and Developer Action Items

1. Enable Passkeys for Your visionOS App

Update your sign-in UI to adopt ASAuthorizationController with passkey support. Here’s a Swift snippet for initiating a platform passkey sign-in:

import AuthenticationServices

let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: "example.com")
let request = provider.createCredentialAssertionRequest(challenge: challengeData)
let controller = ASAuthorizationController(authorizationRequests: [request])
controller.delegate = self
controller.presentationContextProvider = self
controller.performRequests()

2. Prep MDM for Platform SSO & Declarative Management

Update your MDM profiles to include the latest SSO extension payload, targeting visionOS 26.6+:

<dict>
  <key>PayloadType</key>
  <string>com.apple.extensiblesso</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
  <key>PayloadIdentifier</key>
  <string>com.example.sso.visionos</string>
  <key>SSOAppExtensions</key>
  <array>
    <dict>
      <key>TeamIdentifier</key>
      <string>ABC123XYZ</string>
      <key>ExtensionIdentifier</key>
      <string>com.example.sso-extension</string>
    </dict>
  </array>
</dict>

For declarative device management, ensure your MDM supports the new visionOS restriction payloads. Example (block screen recording):

<dict>
  <key>PayloadType</key>
  <string>com.apple.applicationaccess</string>
  <key>allowScreenShot</key>
  <false/>
</dict>

3. Harden Secure Enclave Usage

Audit your app and MDM configuration to ensure all cryptographic keys are tagged as non-exportable and stored with kSecAttrTokenIDSecureEnclave. Example Swift update:

let attributes: [String: Any] = [
    kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
    kSecAttrKeySizeInBits as String: 256,
    kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
    kSecAttrLabel as String: "com.example.visionos.key"
]
SecKeyCreateRandomKey(attributes as CFDictionary, nil)

4. Managed Apple ID Federation: Ensure Compliance

If you federate Managed Apple IDs via Entra ID, Okta, or Google, audit your org’s configuration in Apple Business Manager. For visionOS 26.6, confirm the federation status under Settings > Accounts > Federated Authentication.

What to Check: Verification Steps

• Developer: On a visionOS 26.6 beta 3 device, test passkey sign-in. It should perform a local biometric challenge (FaceID or device PIN) and not prompt for Apple ID password or fallback to password fields.
• Admin: In your MDM console, deploy a new SSO extension profile to a test Apple Vision Pro. In Settings > General > Device Management, confirm the profile is present and SSO works across managed apps.
• Federation: In Apple Business Manager, go to Settings > Accounts > Federated Authentication and check all domains show as Verified and last sync < 24h ago.

Bottom Line: Immediate Actions & Recommendations

• Developers: Test your visionOS app’s passkey integration in 26.6 beta 3 and start planning for Platform SSO Extension adoption.
• Admins: Update your MDM profiles for declarative device management and SSO, and audit federation for Managed Apple ID compliance before visionOS 27.0 ships.
• Security: Configure Secure Enclave-backed keys for all sensitive data and disable legacy password authentication wherever possible.

visionOS 26.6 beta 3 is a pivotal update for Apple identity and security. Tighten your deployment pipeline now to be ready for the rapid enterprise adoption cycle expected with visionOS 27.0 this fall.