Remote AppleCare log collection in macOS 27 and iOS 27 lets IT send Apple a sysdiagnose without touching the deviceRemote AppleCare log collection in macOS 27 and iOS 27 lets IT send Apple a sysdiagnose without touching the device

Apple's 27 releases let organisations collect diagnostic logs for an AppleCare case remotely, through their device management service.

The feature works on iOS 27, iPadOS 27, macOS 27 and tvOS 27, on supervised devices only, according to Apple's Platform Deployment guide. An administrator opens a case with AppleCare, receives a token tied to that case, and sends it to the device with a new management command. The device gathers the logs and uploads them straight to Apple, where they are attached to the ticket automatically. Apple's guide adds a condition the coverage so far has left out: an AppleCare Professional Support agreement is required.

How does remote log collection work?

There are two commands, TriggerEnhancedLogCollection and CancelEnhancedLogCollection, Fleet's documentation shows. The token AppleCare issues comes in two kinds, and which one applies depends on the device:

• Mac: always interactive. The user is asked to consent and can upload at once, review what was collected first, or cancel.
• iPhone and iPad: interactive if a passcode is set or any account, such as iCloud or Mail, is signed in. Otherwise non-interactive.
• Apple TV and Shared iPad: always non-interactive. The device shows a notification and collects and uploads in the background.

While a session runs, the management service can subscribe to status items that report its progress. 9to5Mac's Bradley Chambers, an Apple IT administrator since 2009, lists the states as started, finished, waiting for consent and uploading. Fleet notes that Apple provides test tokens that exercise the flow without opening a case, and that its own product supports iPhone and iPad so far, with Mac and Apple TV to follow. That is a statement about Fleet, not about Apple's platforms.

What did log collection look like before?

AppleCare usually asks for a sysdiagnose, a bundle of system logs. Until now that meant having the device in hand, or talking a user through a key combination and a file upload they had never done. Chambers describes the result: by the time logs arrived, the device had often restarted and the fault was gone.

Our take

This is a small feature with an unusually clear beneficiary. Intermittent faults on a remote employee's laptop are the hardest support case an IT team has, because the evidence disappears while everyone arranges a call. Moving the request into the management console means the logs can be captured on the day AppleCare asks for them, not the day the user is free.

The limits matter as much as the feature. Supervision rules out most personally owned devices enrolled in a work programme, and the support contract rules out smaller organisations that rely on standard AppleCare. On a Mac the user still has to agree, which is the right call for a machine full of someone's work. It also fits how Apple is handling management in this cycle: Apple Intelligence on macOS 27 can only be restricted feature by feature through MDM, and here too the controls are precise and narrowly scoped rather than a single switch.

APPDOOK's reading is that the iPhone rule is the most telling detail. A phone with no passcode and no accounts can upload silently, and that describes a shop till or a kiosk rather than anyone's personal phone. Apple has built the hands-off path for devices with no private data on them, and kept a person in the loop everywhere else. For the IT teams who qualify, the honest summary is that the slowest step in an AppleCare case just became a command.