--- title: Ivanti EPMM 12.6.0.0 - What's New slug: epmm/release-upgrade-guide/ivanti-epmm-12600-whats-new createdAt: 2026-10-26T16:29:02.984Z --- ## General features - **Dual Certificate Support for Sentry-Tunnel Communication**: To mitigate service disruptions caused by certificate expiration, a new **Upload Certificate 2** field is introduced. This enhancement allows administrators to upload and link two certificates, a primary and a secondary (reserve) to a Sentry profile. This ensures uninterrupted **Tunnel-to-Sentry** communication. When **Certificate 1** expires, **Certificate 2** is automatically promoted as the new **Certificate 1**, and the expired **Certificate** 1 is automatically deleted from Ivanti EPMM. This feature is available starting from the following Ivanti product versions: - Ivanti EPMM 12.6.0.0 - Ivanti Sentry 10.4.0 - Ivanti Tunnel 4.13.0 for iOS - Ivanti Tunnel 4.18.0 for Android - **Enhanced options for Network Relays**: Administrators can now include and exclude **Fully Qualified Domain Names** (FQDNs) in the Network Relays. For more information, see **Network Relay** in *Ivanti EPMM Device Management Guide*. - **Enabling Ivanti Apps\@Work for compliance**: Administrators can now enable or disable the integrated Ivanti Apps\@Work when a device falls out of compliance. For more information, see **Compliance actions policy violations** in *Ivanti EPMM Device Management Guide*. - **New setting Allow soft reboot added to system manager**: New setting added to **MICS > Maintenance > Reboot > Allow soft reboot**. This settings allows the admin to enable or disable the **CTRL+ALT+DEL** action on the system and manage reboot action. On fresh installations and upgraded instances, the **Allow Soft Reboot** setting is disabled by default. When this setting is disabled, the **Ctrl+Alt+Del** action does not trigger a system reboot. For more information, see **Reboot** in *Ivanti EPMM Device Management Guide*. - **New sub-roles added to the Device management section**: The **Add Company device** and **Add Employee device **sub-roles are added to the **Device Management > Add Device** field. This allows the admins to assign permission as per the assigned device roles. For more information, see **Add device roles** in *Ivanti EPMM Device Management Guide*. - **Enhanced automated retire action**: New option **Send Wipe to Devices** is added to the **Settings> System settings> Automated Device Cleanup** section for both Android and iOS devices. The admins can wipe an eligible device if it has not checked-in for N number of days. The following devices are supported: - **For Android**: Fully managed (Device Owner), Managed Device with Work Profile (Comp), and Android Open Source Project (AOSP). - **For Apple**: iOS, macOS, and AppleTV devices enrolled via Apple Device Enrollment Program. For more information, see **Automated Device Cleanup** in *Ivanti EPMM Device Management Guide*. ## Android features - **Support for SAML based registration in Android devices**: Administrators can now authenticate and enroll Android devices using **SAML based Authentication** using Ivanti Mobile\@Work 12.6.0.0 or later versions. - **Support to securely re-assign Android devices**: Ivanti EPMM now supports Secure Re-assignment of Android devices, and the devices will automatically enforce re-authentication and re-assignment after logout, ensuring secure access in shared environments. For more information, see **Re-assigning an Android device securely** in *Ivanti EPMM Device Management Guide for Android and Android Enterprise devices*. - **Google Play Integrity Certification is now mandatory on Android devices**: Ivanti EPMM enforces **Play Integrity Certification** (previously known as SafetyNet) on all Android Enterprise devices running on EPMM 12.6.0.0 or later, which assess the security and compatibility of Android devices using **Google’s Play Integrity** APIs. Also, under **Settings > Users\&Devices > device registration**, for **Certified**, a new option **Hardware Backed: Device is using hardware backed security features** is added. For more information, see [MEETS\_STRONG\_INTEGRITY](https://developer.android.com/google/play/integrity/verdicts#optional-device-labels) in the Google Play documentation. :::hint{type="info"} The SafetyNet API is deprecated and not supported by Google. If the device fails minimum SafetyNet attestation then the device is wiped or retired. ::: For more information, see **Registration considerations** in the *Ivanti EPMM System Manager Guide*. ## iOS and macOS features - **macOS support for Microsoft Azure Tenant**: Administrators can now grant access to Microsoft 365 apps for macOS devices. For more information, see **Azure Tenant **in the *Ivanti EPMM Device Management Guide for Apple devices*. - **Enhanced Software Update Enforcement**: Ivanti EPMM can now automatically enforce the latest version of the OS on the devices based on the existing build number and the model of the devices after a new version of the OS is released. For more information, see **Managing Apple Declarative Device Management** in the *Ivanti EPMM Device Management Guide for Apple devices.* - **Support for Ethernet configuration**: Ivanti EPMM now supports the configuration of Ethernet connectivity only through networks defined in configuration policies to enhance security by ensuring devices connect solely to trusted Ethernet environments and thereby reducing the risk of unauthorized network access or data interception. For more information, see **Ethernet Settings** in *Ivanti EPMM Device Management Guide for Apple devices*. - **Support for new skip keys added for iOS devices**: The following skip keys are added for iOS devices: - Skip Multitasking pane. - Skip OSShowcase pane - Skip Action Button setup pane - Skip Enable Lockdown Mode - **Support for new skip key added for macOS devices**: New skip key added for macOS devices: - Skip automatic software update configuration pane - Skip Enable Lockdown Mode - Skip Additional Privacy Settings pane. - **MAC Address Randomization for macOS**: On macOS 15 and later devices, the administrator can now enable or disable the MAC Address Randomization for the Wi-Fi configuration. This option is enabled by default. If the MAC Address Randomization is not selected, the randomization type is not pushed; the Wi-Fi and Inventory MAC Address are the same for a device. - **New Script tab added to the Policies & Configs section**: The admins can now add a script by uploading script file or adding the script content directly and can edit or delete the scripts, these scripts can be distributed to macOS devices through **Policies & Configs > Configurations > Apple > iOS/macOS > Scripts** **via Declarative Management** configuration. Scripts were earlier supported on EPMM through Mobile\@Work macOS script configuration and now it is supported through Declarative Management configuration. For more information, see **Managing Scripts **in the *Ivanti EPMM Device Management Guide for Apple devices*. :::hint{type="info"} Only Bash, .zsh, Python, and Swift scripts are supported. ::: :::hint{type="info"} The Scripts tab is available when **Admin> Actions> Edit Roles> Script Management> Manage Scripts** option is enabled. ::: - **Preserve Data Plan option enabled by default**: The **Preserve Data Plan (iOS 11 and later devices only)** option on the wipe device screen is now enabled by default.