Apple showcased macOS 27 Golden Gate at WWDC on 8thJune. The public beta arrived in July, and it ships in September alongside iOS 27.
Siri AI is the story, and it's a genuinely big feature. But if you look after a Mac fleet, the thing that's going to land in September isn't the new Spotlight.
Apple has finished a transition it started three years ago, and this is the release where the old ways stop working.
Your software update policy might quietly stop working
This one's the big one, and it's easy to miss because nothing breaks loudly.
Apple has removed all the legacy MDM software update commands across iOS 27, iPadOS 27 and macOS 27 — the update commands and queries, cadence settings, deferral restrictions, Background Security Improvements, the lot. It was announced a year ago, so it's not a surprise, but that doesn't mean everyone's ready.
Apple's own words at WWDC were about as clear as Apple gets: declarative management is the standard for device management now.
If your MDM already handles declarative software updates, you’re good. Enforcement is tighter and users get a much clearer runway to a deadline. If your update policy is still built on deferrals and cadence keys, though, those profiles just stop doing anything the moment a device upgrades. You won't get an error. Devices will simply stop patching, and you'll find out weeks later.
Worth checking in August rather than October.
Rosetta is going …going…
Golden Gate won't install on Intel Macs at all — Tahoe was the last one that would. If you've still got Intel hardware in service, it's now out of runway for security updates.
The sneakier problem is Rosetta. Golden Gate is the last version of macOS with full Rosetta 2; macOS 28 keeps only a cut-down layer for old games. It also won't install Rosetta automatically any more, so anyone who opens an Intel-only app after upgrading gets an alert, and another one every time they restart.
That's a support-ticket factory, and a one-release deadline on every Intel-only binary you've got.
In our experience it's almost never the big suites that cause the trouble — it's the niche utility one department can't work without, the lab instrument driver, the internal tool whose original developer left in 2019. Those are the conversations worth starting with vendors now, while there's still time for them to say yes. (Keeping third-party Mac apps on current native builds is the whole reason we built Zappl — Golden Gate just turns it from a preference into a deadline.)
Siri AI is impressive
We'll say it plainly: this is a proper rebuild, not a refresh. Siri holds back-and-forth conversations, reads what's on screen, searches across Mail, Messages, Notes, Reminders and Calendar, and takes action inside apps. On the Mac it lives in Spotlight — Command + Space now gives you a "Search or Ask" field, and Visual Intelligence sits on Command + Shift + Space.
There's plenty more: Write with Siri, AI photo editing in Photos (Clean Up, Extend, Reframe), Safari organising tabs by topic and watching pages for changes, a Passwords app that can rotate weak credentials for you, and Shortcuts that builds a shortcut from a plain-English description. Some of it will be useful on day one.
The bit that’s important is where the processing happens. Lighter work runs on-device on Apple's own foundation models. Heavier reasoning and world-knowledge questions go to Private Cloud Compute, which is where Apple's reported Google Gemini partnership sits. Apple's position is that those requests are used only to answer the request, aren't stored, aren't readable by Apple and can't be accessed.
Whether that satisfies your Security team is a conversation you would rather have in August than the morning after someone pastes a client contract into Spotlight.
The good news is Apple has actually given you the controls this time. Building on the switches added in the 26.4 releases, you can allow or block individual Apple Intelligence and Siri features rather than flipping one master toggle. If you're in healthcare, finance, legal or government, that's the difference between adopting this properly and blocking the whole thing and hoping nobody notices.
One practical note on hardware: Apple Intelligence needs M1 or later, and the custom Siri voices and improved on-device dictation want M3 or later with at least 12GB RAM. Image generation and the other heavy features come with daily caps, with more headroom on paid iCloud+ tiers.
The Good Parts
Golden Gate is the most enterprise-serious macOS release we've seen in a while:
- Managed migration. Push a declarative configuration after enrolment and you control exactly what moves to someone's new Mac — accounts, files, security settings — with status reported back through the declarative channel. New-starter days and hardware refreshes get considerably shorter.
- Binary execution controls. Allow or deny execution based on code signing properties via the Endpoint Security framework, with managed apps allowed automatically. Handy evidence for NIST SP 800-53 SI-7 and ISO 27001 A.8.9.
- Platform SSO grows up. You can now require Touch ID as a second factor at login, unlock and FileVault unlock, and there's web-based authentication rendering right in the login window — one-time codes, push, QR sign-in. Authenticated Guest Mode works on FileVault-protected Macs too, which is a real win for shared devices.
- Declarative app configuration finally comes to the Mac, with hardware-bound keys and Managed Device Attestation.
- Cleaner package removal. Pull a declarative package configuration and macOS removes the files it installed. No more archaeology.
- Content caching is declaratively managed and reportable.
- One privacy prompt instead of four, covering everything an app needs, with your justification string attached — so users read it rather than dismissing it on reflex.
AFP is gone
Golden Gate ships with no AFP client at all, which ends a protocol that's been part of the Apple world for nearly forty years. Time Machine now needs SMBv2 or SMBv3, and macOS 27 enforces TLS 1.2 as a minimum for network connections.
Modern NAS hardware is fine. Time Capsules aren't — no model can meet that bar as it stands. If anything is still backing up to one, or mounting an AFP share, it needs somewhere else to go before the upgrade rather than after.
Get Ready for September
- Confirm your MDM supports declarative software update management, and rebuild anything still leaning on deferrals or cadence settings.
- Inventory any Intel-only apps.
- Work out which Intel Macs are still in service and plan their replacement.
- Agree an Apple Intelligence position with your security and data-protection people — then write it as a feature-level configuration, not a blanket block.
- Hunt down anything still using AFP and give it an SMB destination.
- Get a small pilot group on the public beta now if you haven’t already done so, so September becomes fun!