Read the release note for Xcode 27 beta 6 (build 27A5252f, posted 10 August) and you’ll get exactly two links: downloads and release notes. No headline features, no deprecation drama. That’s normal for a beta 6 — this deep into the cycle Apple is stabilizing, not shipping new surface area.
The trap is treating the thin note as “nothing to do here.” The build you don’t care about carries the iOS 27, iPadOS 27, macOS 27, watchOS 27, tvOS 27, and visionOS 27 SDKs. Those SDKs become the ones the App Store expects your submissions to be built against, and the identity APIs inside them have been shifting from optional to load-bearing all cycle. If your login stack still assumes iOS 17-era assumptions, this is the beta where you should be fixing that — not the week the GA drops in September.
What you’re actually installing
Xcode 27 beta 6 requires macOS 26 (Tahoe) or later on the Mac running it, and it’s the toolchain that produces binaries linked against the 27 SDKs. Confirm what you’ve got before you trust a build:
xcodebuild -version
# Xcode 27.0
# Build version 27A5252f
xcodebuild -showsdks | grep -iE "ios|macos"
# iOS 27.0 -sdk iphoneos27.0
# macOS 27.0 -sdk macosx27.0
xcrun --sdk iphoneos27.0 --show-sdk-version
# 27.0Apple’s pattern for the last several cycles: roughly six months after a major SDK ships, new App Store submissions must be built with it. For the iOS 26 SDK that deadline landed in spring 2026. Plan for the iOS 27 SDK to gate submissions around April 2027. That sounds far off until you remember how many identity flows you’d need to regression-test before flipping the compiler over.
Automatic passkey upgrades stop being a demo
The single biggest identity win in this SDK lineage isn’t new to 27 — it’s conditional passkey registration, and it’s finally mature enough to ship in production without babysitting. If your users still authenticate with a password, you can mint a passkey for them silently at sign-in, no modal, no interruption, provided the platform decides the moment is safe (device passcode set, iCloud Keychain available).
import AuthenticationServices
func upgradeToPasskey(userName: String,
userID: Data,
challenge: Data) {
let provider = ASAuthorizationPlatformPublicKeyCredentialProvider(
relyingPartyIdentifier: "example.com")
let request = provider.createCredentialRegistrationRequest(
challenge: challenge,
name: userName,
userID: userID)
// The whole point: conditional == automatic upgrade.
// The system creates the passkey only if it can do so silently.
request.requestStyle = .conditional
let controller = ASAuthorizationController(authorizationRequests: [request])
controller.delegate = self
controller.performRequests()
}Two things bite people here. First, .conditional is silent by design — if your associated domain file is wrong or the webcredentials entitlement is missing, the request doesn’t error loudly, it just quietly does nothing. You’ll swear the API is broken. It isn’t; your apple-app-site-association is. Verify it directly:
curl -s https://example.com/.well-known/apple-app-site-association \
| python3 -m json.tool
# Confirm the "webcredentials" key lists "TEAMID.com.your.bundleid"Second, this is table stakes now, not a differentiator. Android’s Credential Manager has offered conditional passkey creation for two cycles. If you’re a consumer-facing shop still forcing password-only, you’re behind both platforms, not ahead of one.
Credential Exchange: the lock-in excuse is gone
The quieter shift that started in the iOS 26 cycle and carries forward is the Credential Exchange Protocol (CXP) and its format sibling CXF — the FIDO Alliance standard for moving passkeys and passwords between credential managers without exporting plaintext to a CSV. On device it surfaces under Settings → General → Transfer or Reset, and Passwords → move accounts to another app.
Why an identity architect should care: the number-one objection to standardizing on passkeys inside an enterprise was “we can’t get them back out if we switch password managers.” That objection is now technically false. If you’re a credential-manager vendor or building an enterprise password tool for Apple platforms, supporting CXP import/export is the difference between being a destination and being a roach motel. Users increasingly know the difference.
The enterprise side: Platform SSO is where the real money is
None of the developer APIs matter to a fleet admin if the Mac can’t get an identity in the first place. Platform SSO — the macOS Extensible Single Sign-On extension that lets a Mac authenticate against Entra ID, Okta, or Google directly at the login window — is the piece that’s genuinely matured across the 26/27 cycle, and it’s where I’d spend admin effort right now.
The configuration that matters is AuthenticationMethod. Set it to UserSecureEnclaveKey and the user’s IdP authentication is backed by a hardware-bound key in the Secure Enclave — phishing-resistant, passwordless, and closer to what Windows Hello for Business does on the other side of the fence. Here’s the payload shape for a Microsoft Entra deployment:
<dict>
<key>PayloadType</key>
<string>com.apple.extensiblesso</string>
<key>PayloadIdentifier</key>
<string>com.example.psso</string>
<key>PayloadUUID</key>
<string>E2C9F1A4-4A7B-4E1D-9F0C-3B2A1D6E8F00</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>ExtensionIdentifier</key>
<string>com.microsoft.CompanyPortalMac.ssoextension</string>
<key>TeamIdentifier</key>
<string>UBF8T346G9</string>
<key>Type</key>
<string>Redirect</string>
<key>URLs</key>
<array>
<string>https://login.microsoftonline.com</string>
<string>https://login.microsoft.com</string>
<string>https://sts.windows.net</string>
</array>
<key>PlatformSSO</key>
<dict>
<key>AuthenticationMethod</key>
<string>UserSecureEnclaveKey</string>
<key>UseSharedDeviceKeys</key>
<true/>
<key>EnableCreateUserAtLogin</key>
<true/>
</dict>
</dict>Verify registration actually took on an enrolled Mac — the extension will happily install and still not register the user:
# Is the SSO extension loaded and which method is active?
app-sso platform -s
# Broader profile/identity state
sudo profiles status -type enrollment
The thing Apple’s documentation soft-pedals: EnableCreateUserAtLogin plus UseSharedDeviceKeys changes your account model on shared and new devices, and getting the ordering wrong against your IdP’s provisioning leaves you with local accounts that don’t line up with directory identities. Pilot it on a ring of ten machines before you push it to the fleet. Six months from now the admin who blanket-enabled passwordless Platform SSO without testing recovery paths is the one filing the “users locked out after IdP password reset” ticket.
Digital credentials and the verification story
Worth having on your radar for this SDK generation: the Digital Credentials verification path for ISO 18013-5 mobile driver’s licences and other documents in Wallet. If you’re building age or identity verification into an app, the platform now brokers a request to Wallet rather than you rolling your own camera-and-barcode nightmare, with the presentation gated behind Face ID or Touch ID and scoped to the specific fields you ask for. Request only the claim you need — over-18, not date of birth — because ATT-era users and, increasingly, regulators will punish apps that hoover up the full document when a boolean would do.
The bottom line
- Install beta 6 for the SDK, not the note. The changelog is empty; the toolchain is the point. Building against the 27 SDK now buys you six months of margin before it’s mandatory for submissions around April 2027.
- Ship conditional passkey registration if you haven’t. It’s silent, it’s low-risk, and it’s now behind both Apple and Android as a default expectation. Check your
apple-app-site-associationfirst — that’s where 90% of “it doesn’t work” ends. - Admins: pilot Platform SSO with
UserSecureEnclaveKey. This is the highest-leverage identity change available to an Apple fleet right now. Test IdP password-reset and account-recovery flows on a small ring before you scale. - Support Credential Exchange if you build credential tooling. The lock-in argument against enterprise passkeys is dead. Act like it.
Betas this late are boring on purpose. The identity work they’re carrying is not.