macOS 27 lets IT send Mac logs straight to AppleCare, with user consent
A new MDM command in the 27 releases uploads diagnostic logs to an open AppleCare case without a manual sysdiagnose.
Workspace · Macfolio · 11 October 2026
One of the quieter IT changes in Apple's 27 releases is remote AppleCare log collection. On supervised devices running iOS 27, iPadOS 27, macOS 27, or tvOS 27, an IT team can now start log collection for an AppleCare case from its device management service. 9to5Mac highlighted it on October 10; Apple documented it in September.
How remote log collection works
Apple's Platform Deployment guide describes two new commands, TriggerEnhancedLogCollection and CancelEnhancedLogCollection. The trigger command needs a token issued by AppleCare for a specific case. Once the logs are created, the device uploads them to Apple, and they are attached to the AppleCare ticket automatically.
- Supported: supervised iPhone, iPad, Mac, and Apple TV on the 27 releases
- Requirement: an AppleCare Professional Support agreement
- Mac: always interactive, so the user must consent and can review or cancel
- iPhone and iPad: interactive if a passcode or any account is set up
- Apple TV and Shared iPad: always non-interactive, with a notification
- Status: new declarative status items report started, waiting for consent, uploading, finished, or canceled
Until now, an AppleCare sysdiagnose usually meant physical access or walking a user through unfamiliar steps. For a remote employee with an intermittent problem, the logs often arrived after a restart had wiped out the useful state.
This does not mean IT can quietly pull logs from employee Macs. On a Mac the user always sees a prompt and can decline. It also does nothing for unsupervised or personally owned devices, or for Macs still on macOS 26.
Who should set it up
Organizations with an AppleCare Professional Support agreement and supervised Macs should check whether their device management vendor exposes the command yet. Apple's command list now includes "Start and cancel AppleCare log collection," but vendors decide when to support it.
Our take: this is a small feature with real time savings for help desks that escalate to Apple. Add a short note to your support runbook explaining the consent prompt, so employees know it is legitimate and do not dismiss it as phishing.
Availability depends on your MDM vendor and support contract.