Xcode 26.6 RC 2: Enterprise Identity APIs, Passkey Evolution, and MDM Readiness for iOS 18/macOS 15

Xcode 26.6 RC 2 (build 17F113) is now available, marking a critical milestone for enterprise Apple identity, authentication, and device management readiness. With iOS 18, macOS 15, and the latest AuthenticationServices, LocalAuthentication, and MDM payloads, admins and developers gain immediate access to new flows, tighter security primitives, and expanded control for Apple Business Manager deployments.

What Apple Just Shipped

• Xcode 26.6 RC 2: Required for targeting iOS 18, macOS 15, tvOS 18, watchOS 11. Ships with updated AuthenticationServices, Passkey APIs, LocalAuthentication, and MDM configuration profile payloads.
• AuthenticationServices Framework Enhancements: Sign in with Apple now supports federated Managed Apple IDs (Entra ID, Okta, Google Workspace) with new OIDC claims and improved private email relay.
• Passkeys (FIDO2/WebAuthn) APIs: New controls for enterprise passkey lifecycle management, including device-bound passkey restrictions and org-scoped sync across iCloud Keychain.
• MDM Protocol Updates: Fresh mobileconfig payloads for declarative device management, updated restrictions for passkey use, and expanded support for digital credentials in Wallet (ISO 18013-5 driver’s license, Verifiable Credentials).
• Secure Enclave & LocalAuthentication: Improved biometrics enrollment attestation and stricter fallback controls for Face ID/Touch ID on supervised devices.

Version Requirements

• iOS 18.0 (RC)
• macOS 15.0 (RC)
• Xcode 26.6 RC 2 (17F113) required—do not use earlier betas for production builds

What’s Coming: WWDC & Developer Beta Announcements

• Apple Platform SSO for Managed Apple IDs: Enterprise SSO extension gains MFA enforcement and cross-platform session sync for federated identities (coming in iOS 18/macOS 15 GA).
• Passkey Delegation and Recovery: Organizations can delegate passkey creation and recovery to IT admins for supervised fleets, enabling seamless onboarding and lost-device workflows.
• Digital Credential Expansion: Wallet APIs to support employee badges, government IDs, and verifiable credentials with new MDM controls for credential lifecycle.
• Declarative Device Management (DDM): DDM expands to cover passkey usage, app notarization status, and digital ID provisioning—admins should prep DDM payloads now.

Why This Is Better: Concrete Improvements

• Federated Managed Apple ID Support: Sign in with Apple now recognizes enterprise SSO claims, allowing orgs to provision and audit OIDC flows natively—no custom backends required.
• Device-Bound Passkey Control: IT admins can restrict passkey sync to device-only or org-scoped, preventing cross-user credential leakage and strengthening phishing resistance.
• Declarative MDM Payloads: New payloads support granular passkey restrictions, digital credential onboarding, and biometrics fallback policies—eliminating legacy profile limitations.
• Secure Enclave Attestation: Enhanced attestation for biometrics enrollment aids compliance checks (e.g., NIST, ISO 27001) on supervised devices.
• Competitive Edge: Apple’s passkey and OIDC improvements offer faster onboarding, lower risk, and stronger privacy compared to Android and Windows—especially for regulated enterprises.

How to Implement or Respond

For Developers: Updated Sign in with Apple OIDC Flow

Update your backend to verify new OIDC claims for Managed Apple ID federation. Example Swift integration:

import AuthenticationServices

let request = ASAuthorizationAppleIDProvider().createRequest()
request.requestedScopes = [.fullName, .email]
request.requestedClaims = ["org_id", "federated_identity"]

let controller = ASAuthorizationController(authorizationRequests: [request])
controller.performRequests()

On the backend, validate org_id and federated_identity claims in the returned JWT.

For Admins: MDM Passkey Restriction Payload

Push new mobileconfig to restrict passkey sync to device-only on supervised fleet:

<payload>
  <dict>
    <key>PayloadType</key>
    <string>com.apple.passkey</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>RestrictPasskeySync</key>
    <true/>
    <key>AllowedPasskeyDomains</key>
    <array>
      <string>your-org.com</string>
    </array>
  </dict>
</payload>

For Security Engineers: Audit Biometrics Enrollment Attestation

Audit supervised devices for Face ID/Touch ID attestation with:

profiles status -type configuration | grep 'com.apple.biometrics.attestation'

What to Check

• In Apple Business Manager, confirm federated domain status and Managed Apple ID SSO session persistence.
• MDM console should show updated passkey restriction profiles pushed and active.
• Backend logs should include new OIDC claims (org_id, federated_identity) for SIWA flows.
• Supervised device audit logs must show biometrics attestation payload applied.

Bottom Line

• Upgrade to Xcode 26.6 RC 2 for iOS 18/macOS 15 targeting—earlier versions will miss critical identity and MDM updates.
• Integrate new Sign in with Apple OIDC claims and passkey controls now; update MDM payloads for device-bound restrictions.
• Monitor Apple Business Manager and MDM console for federated SSO and passkey enforcement status.
• Prepare for declarative device management and digital credential onboarding in Wallet.

Xcode 26.6 RC 2 sets the stage for tighter enterprise identity control, advanced passkey lifecycle management, and streamlined MDM policy enforcement. Move quickly to audit, update, and deploy—these changes are foundational for iOS 18/macOS 15 fleets.