Create DDM Declaration

Use this to control whether macOS can mount external storage and network storage. Apple supports this declaration on macOS 15+ for supervised or local enrollments at system scope.

Devices typically report declaration validity under management.declarations. Apple does not expose a rich live storage-mount status stream here the way software updates do.

If you leave both storage policies blank, this declaration would save as an empty payload and would not change device behavior.

Use this to require a passcode or tighten passcode complexity. Apple combines multiple passcode declarations and effectively enforces the strictest resulting settings.

If you need `CustomRegex` or localized regex descriptions, use Advanced Custom with Apple's exact schema.

Apple treats omitted keys as defaults. If you leave every passcode control blank/off, this declaration would save as an empty payload and would not change device behavior.

Use this to move devices to a newer version. If you type a version manually, enter the version you want the device to update to, not the version it is currently running.

Use this when you know the exact newer OS version/build you want to install on devices.

Apple supports this declaration on supervised iOS/iPadOS 18+, macOS 15+, and tvOS 18.4+ devices.

Use this to control deferrals, automatic download/install behavior, rapid security response preferences, and standard-user permissions. It does not by itself tell devices to move to a newer OS version. Use Enforce Latest or Enforce Specific when you want devices to actually update.

Apple treats omitted keys as defaults. If you leave every control at its default value, this declaration would save as an empty payload and would not change device behavior.

Use this only when you already know the exact Apple declaration type and schema. This path is intentionally low-level and does not auto-validate arbitrary payloads against Apple's documentation.