I'm trying to better understand how Apple's Declarative Device Management (DDM) software update declarations interact with software update deferrals.
Configuration
Our managed iOS devices receive:
Software Update Settings
- Automatic Download = Always On
- Automatic Install = Always On
- CombinedPeriodInDays = 90
Software Update Enforcement
- Target OS Version = 26.2
- Target Date Time = August 2026 (already passed)
What I expected
My understanding was:
- Once a device reached 26.2, the enforcement declaration would be satisfied.
- New releases (for example iOS 27) would remain hidden until the 90-day deferral period expired.
- Devices would therefore remain on some version of iOS 26 until iOS 27 became visible after the deferral period.
What I'm seeing
Two devices with apparently identical configuration:
Device A
- Running iOS 26.6.2
- Build 23G90
- Software Update Settings declaration reports successful
- Software Update Enforcement declaration reports compliant because current version exceeds target 26.2
Device B
- Running iOS 27.0
- Build 24A437
- Same update settings declaration
- Same enforcement declaration
- Same target version (26.2)
- Same 90-day deferral policy reports successful
Additional observations
- The device that is now on iOS 27 was already enrolled and managed before iOS 27 was released.
- The device did not recently enrol or restore from backup.
- The target version has not been changed to iOS 27.
- The deferral profile reports successfully applied on both devices.
- The enforcement profile reports as expected because both devices are already above the required target version of 26.2.
Question
When a device has:
- CombinedPeriodInDays = 90
- TargetOSVersion = 26.2 (already satisfied)
should iOS 27 remain unavailable until the 90-day deferral expires?
Or is there a scenario where a device can legitimately move to iOS 27 even though the 90-day update deferral declaration is successfully applied?
I'm specifically trying to understand whether this is expected DDM behaviour, a declaration-merging issue, or something else in Apple's update evaluation logic.