Under macOS 27, a Mac can show as managed in your DMS (formerly MDM) console and still be missing updates.
macOS 27 (Golden Gate) was released on 14 September 2026 and runs on Apple Silicon Macs only. This month, check three things with your IT team or provider: that your DMS manages updates the new way, how many Intel Macs you still have, and which apps need testing. Then pilot it on a small group first.
Is your DMS still managing updates on macOS 27?
Apple’s documentation says legacy software update management no longer works in any macOS 27.0 operating system. Deferrals and the older Background Security Improvements restrictions stop working too. Nothing fails visibly on launch day. A Mac can keep reporting as managed while quietly going unpatched, which is exactly the gap a Cyber Essentials renewal is designed to catch.
With a team of 70 to 150 people, nobody checks every Mac by hand, so the console is what you rely on. Ask your IT team or provider whether your DMS has moved to declarative device management, the newer method Apple uses for updates. A good answer names the DMS, confirms it supports macOS 27, and shows you a Mac that has updated successfully under it.
What else will quietly stop working?
Privacy permission profiles
Older privacy profile keys (PPPC) are being phased out, and Accessibility permissions granted through the old profile format are removed. Users can also now switch off Accessibility permissions that device management used to grant automatically. In practice, remote support tools and screen-recording software may start asking for permission, or fail silently, on Macs that updated without anyone reviewing this. Ask IT to test remote support on the pilot group first.
Intel Macs
macOS 27 won’t install on Intel Macs. macOS 26 Tahoe was the last release to support them, so any Intel Mac in the business is now on its final major version of macOS. Ask your IT team or provider for a list of which ones you have and how old they are, so they can go into your next refresh plan.
What’s new in macOS 27 that’s worth switching on
App and command-line control
macOS 27 adds built-in management of which apps and command-line tools are allowed to run on a Mac. That matters for ClickFix-style attacks, where a fake error page talks someone into pasting a command into Terminal. With this set up, IT can decide which tools are allowed to run. Most businesses haven’t configured it yet, so it’s worth asking your IT team or provider about.
Signing in with your company account at the login window
Platform Single Sign-On now reaches the login window and FileVault unlock, and you can require Touch ID or an Apple Watch. For your team, that means one company sign-in across more of the Mac experience and fewer separate passwords to forget or reset.
Checking a Mac is fully set up before it reaches the user
Admins can now confirm a Mac is fully configured before a new starter gets it. Paired with zero-touch deployment, a new starter’s Mac arrives ready to use on day one.
Is your DMS actually ready for macOS 27?
Dr Logic can check whether your update policies still work under Golden Gate, and flag any Intel Macs before they become a renewal problem.
Does macOS 27 affect your Cyber Essentials certification?
It can, in three ways. First, patching. Cyber Essentials v3.3 gives you 14 days to fix high-severity vulnerabilities, and missing that window is an automatic fail. If your DMS reports a Mac as managed while the old update commands silently fail, that Mac can miss the window without anyone noticing. Second, Intel Macs that can’t move to macOS 27 are worth flagging to whoever handles your renewal. Third, the new app control feature is worth raising with your assessor as a possible malware protection measure, alongside what you already have in place.
Should your business upgrade to macOS 27 now?
Pilot it first. macOS 27 fixes more than 200 vulnerabilities, which is a good reason to move, but first releases tend to need a few weeks to settle, and creative software (Adobe, plug-ins, fonts) needs testing before every Mac in the business is on it. Pick a small pilot group that includes at least one person who uses your most important apps every day, and widen the rollout once their Macs behave as expected.
macOS 27 readiness checklist for Mac fleets
| Check | Owner | Why it matters |
|---|---|---|
| DMS update method | IT team or provider | Confirms updates now run through declarative device management |
| DMS support for macOS 27 | IT team or provider | Addigy, Jamf and Iru (formerly Kandji) each need to confirm they support it |
| Intel Mac list | IT team or provider | Shows which Macs can't upgrade and need a refresh plan |
| App compatibility | IT team or provider, with team leads | Adobe, plug-ins and fonts need testing before a wide rollout |
| Pilot group | IT team or provider | A small group finds problems before they reach everyone |
| Privacy profiles | IT team or provider | Old PPPC profiles need updating so remote support tools keep working |
| Backups | IT team or provider | Confirms backups are current before any macOS upgrade |
| Staff communication | Business owner | People should know what's changing and when |
| Cyber Essentials evidence | IT team or provider, with the business owner | Patching records and device lists are ready before renewal |
Three questions to ask your IT team or provider this week
- Has our DMS moved to declarative device management for updates? A good answer names the DMS and shows you a Mac that has updated under it.
- How many Intel Macs do we have, and when is each one due for replacement? A good answer gives you a number and a date range.
- Who’s in the pilot group, and when does it start? A good answer names people and a start date.
If you’d like a second pair of eyes, Dr Logic can run a macOS 27 readiness review across your Macs and report back on what needs fixing before you roll out.
Related articles
- Explore the Apple September Event announcements
- iOS 27’s september patch batch: one of the largest on record
FAQs
When was macOS 27 released?
macOS 27, known as Golden Gate, was released on 14 September 2026, alongside iOS 27 and Apple’s other operating system updates for the y
Can Intel Macs run macOS 27?
No. macOS 27 requires an Apple Silicon Mac. macOS 26 Tahoe was the final version to support Intel hardware, so Intel Macs remain on that version going forward.
Will my old DMS update settings still work on macOS 27?
No. Legacy software update commands and deferrals no longer function under macOS 27. Update policies need to use declarative device management instead, which is worth confirming with your DMS provider directly.
Is macOS 27 safe to install on business Macs?
Yes, and it fixes more than 200 security vulnerabilities. The main caution is compatibility: pilot it on a small group first and confirm creative software and plug-ins behave as expected before rolling it out further.
What happens to Rosetta on macOS 27?
Rosetta continues to work as a general-purpose compatibility tool through macOS 27, letting Apple Silicon Macs run older Intel-built apps. If Rosetta was already installed before upgrading, it won’t be automatically restored, so it may need to be reinstalled after the update.
