How to Deploy macOS Declarative Device Management (DDM) Status Channels for Real-Time Compliance

Historically, Apple’s Mobile Device Management (MDM) protocol was entirely reactive. The MDM server (e.g., Microsoft Intune or Jamf Pro) would periodically poll a macOS device, requesting an inventory update. If the device was offline or sleeping, the server remained ignorant of its state. If a user maliciously disabled the local firewall, the MDM server would only discover this hours later during the next polling cycle. To modernize this architecture, Apple introduced Declarative Device Management (DDM). DDM fundamentally shifts the paradigm from server-polling to client-driven reporting. By utilizing DDM Status Channels, macOS devices can proactively, asynchronously, and instantaneously notify the MDM server the exact millisecond a compliance violation occurs.

The Architecture of Declarative Device Management

Declarative Device Management operates alongside the legacy MDM protocol (they are not mutually exclusive). In the legacy model, the server issues imperative commands (e.g., “Install this profile,” “Tell me your OS version”).

In the DDM model, the server sends a “Declaration” to the device. A Declaration is a JSON payload defining the desired state of the device (e.g., “FileVault must be enabled, and the OS must be at least version 14.2”). The macOS operating system itself (specifically the mdmclient daemon) assumes the responsibility for enforcing that state.

The most powerful feature of DDM is the Status Channel. The MDM server subscribes to specific device properties (e.g., passcode.is-compliant or os.version). When a change occurs locally on the Mac, macOS instantly triggers an HTTP POST request back to the MDM server, updating its status without waiting for the next polling cycle.

Deploying DDM via Configuration Profiles

To enable this capability, your MDM vendor must natively support the DDM protocol. Assuming you are utilizing a modern MDM like Intune or Kandji, the deployment is often abstracted behind the UI, but it relies on pushing a specific Declaration payload to the endpoint.

The MDM server sends a Declarations sync command to the Mac. The Mac downloads the JSON payload, which typically includes an Activation, a Configuration, and a Management Status subscription.

An example of the JSON payload the MDM sends to subscribe to the FileVault status channel looks like this:

{
  "Type": "com.apple.configuration.management.status-subscriptions",
  "Identifier": "com.company.status.filevault",
  "ServerToken": "token-12345",
  "Payload": {
    "StatusItems": [
      {
        "Name": "security.filevault.enabled"
      }
    ]
  }
}

Once this declaration is active on the macOS device, the local operating system begins actively monitoring the security.filevault.enabled property.

Real-Time Compliance Enforcement

The operational impact of this architecture is profound.

Imagine a scenario where an administrator has configured a Conditional Access policy in Microsoft Entra ID that strictly blocks access to Microsoft 365 if a Mac is not encrypted. Under the legacy MDM protocol, if a user somehow decrypts their drive, they could potentially continue accessing corporate data for up to 8 hours until the MDM finally polls the device, realizes it is unencrypted, marks it as non-compliant, and informs Entra ID to revoke the token.

With Declarative Device Management and Status Channels active, the workflow is radically accelerated:

1. The user initiates the FileVault decryption process locally on the Mac.
2. The very millisecond the decryption state registers in the OS, the mdmclient daemon fires an asynchronous JSON payload to the MDM server over the DDM Status Channel, explicitly declaring security.filevault.enabled: false.
3. The MDM server immediately receives this webhook, instantly flags the device record as Non-Compliant, and synchronizes this state to Entra ID.
4. Entra ID revokes the user’s PRT (Primary Refresh Token).

By the time the user’s decryption process finishes, their access to all corporate web applications and native tools has already been mathematically severed. By embracing macOS Declarative Device Management, security engineers can achieve true, real-time Zero Trust enforcement at the endpoint level.