macOS 27, three weeks in: what broke and what to do about it

macOS 27 Golden Gate came out on 14 September 2026, and the first update, 27.0.1, followed on 28 September. Three weeks in, the picture for business Macs is clearer than it was in August. Most security and management tools were ready on day one. Most of Adobe Creative Cloud is now cleared.

The problems are concentrated: Avid doesn't support macOS 27 yet, a few Adobe apps are still in testing, OneDrive's App Store build is losing its sync folder for some people, and Time Capsule backups are finished. Meanwhile macOS 26 Tahoe is still being patched, so waiting is a safe choice for any team that hits one of those.

That's the short version. Below is what broke, who said what, and how we'd roll it out.

We wrote the pre-launch checklist in August, when most vendors hadn't said anything. This is the follow-up, now that they have.

Where macOS 27 stands

Apple released macOS 27 on 14 September, alongside Tahoe 26.7 and Sequoia 15.8 for Macs staying behind. On 28 September it shipped 27.0.1, 26.7.1 and 15.8.1 (opens in a new tab) together.

27.0.1 has no published security fixes. Its one enterprise fix, per Apple's enterprise notes (opens in a new tab), is for Platform SSO: on 27.0, the username and password fields didn't show at the Lock Screen after a Mac woke from sleep. If you use Platform SSO with Okta or Microsoft Entra, that alone makes 27.0.1 your minimum. Don't deploy 27.0.

Nothing changes on hardware since our checklist. macOS 27 runs on Apple silicon only, so Intel Macs stay on Tahoe.

Why waiting is safe

The 28 September updates for Tahoe and Sequoia fixed CVE-2026-86950 (opens in a new tab), a CoreGraphics bug where opening a malicious file could run code. Apple says it "may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27".

Two things follow from that.

Tahoe is still being patched. Apple fixed an exploited bug on 26 and 15 the same day it shipped 27.0.1. A fleet on a patched Tahoe isn't behind on security.

The 14-day clock is running. Under Cyber Essentials v3.3, high and critical security updates have to be installed within 14 days of release, and missing that is an automatic fail. 26.7.1 came out on 28 September, so any Mac on Tahoe needs it by 12 October. Same for Sequoia and 15.8.1.

So you don't have to choose between upgrading early and staying compliant. Staying on 26 and patching it is compliant. Upgrading is a separate decision, made app by app.

What broke, app by app

Post-production: Avid isn't supported yet

This is the clearest stop sign. Avid's macOS Golden Gate support page (opens in a new tab), updated 1 October, lists Media Composer, Pro Tools, NEXIS, EUCON and DADman as not yet supported. Only Sibelius (2026.9) is cleared. Avid warns that an unsupported OS "may result in unexpected behavior".

If you run an edit suite or a NEXIS share, hold those Macs on Tahoe. In MDM terms that means a deferral or a version cap on that group, not a polite email asking people not to click Update.

Adobe Creative Cloud: most of it is cleared

Adobe's macOS compatibility page (opens in a new tab), last updated 1 October, now confirms a decent list for macOS 27:

• Premiere, After Effects, Audition and Media Encoder from 26.5
• Photoshop 27.x
• InDesign, InCopy and InDesign Server from 20.0
• Bridge 16.0.7, Character Animator 26.0, Dreamweaver 21.8
• Acrobat DC and Acrobat Classic, plus the Creative Cloud desktop app from 6.8

Two things aren't on it yet: Illustrator and Lightroom. Adobe says it's still testing the rest and will update the page. Until they appear, treat designers and photographers who live in those apps as a wait group.

One small known issue Adobe lists itself: in Acrobat DC, the buttons in the Check for Updates dialog may not respond to clicks. Use Tab and Return instead.

Vectorworks: we hit this one ourselves

Vectorworks 2025 quits at launch on macOS 27 with "Failure loading Support library", because macOS 27 dropped a database library it was built against. We wrote up why it happens and a free, reversible fix that architecture practices can roll out through Jamf. Vectorworks itself still recommends production users wait.

OneDrive: the App Store build loses its sync folder

On Microsoft's own Q&A forum, a thread from 19 September (opens in a new tab) reports OneDrive complaining after the macOS 27 upgrade that it "couldn't find your 'OneDrive (2026-09-13 …)' folder". The replies point at the Mac App Store version: users say installing the version downloaded directly from Microsoft fixed it.

Be clear on what this is: a handful of users on a Microsoft-hosted forum, with no Microsoft acknowledgement as of today. It isn't a confirmed bug yet. But it's specific, and the fix is cheap. If you deploy OneDrive through MDM, use Microsoft's standalone package rather than the App Store app. And if a user does hit it, don't let anyone delete OneDrive folders to tidy up until you've checked where the files are.

Time Capsule and old AFP shares: finished

Apple's own Time Machine disk guidance (opens in a new tab) now says Time Capsule and AirPort Extreme aren't recommended, because they back up over AFP, which "isn't supported in macOS 27 or later". For small offices still using a Time Capsule in a cupboard, backups stop the day that Mac upgrades. The same applies to any older NAS share still served over AFP. Move to SMB first. If you're on Synology, our Synology guide for Mac businesses covers setting up Time Machine over SMB properly.

Security and VPN agents: ready, if you're current

This part went better than the beta suggested. The vendors we checked are clear, as long as you're on a recent build:

The risk is the Mac that's three agent versions behind. Before a Mac upgrades, check its security agent and VPN client are on the supported builds. An old sensor on a new OS is how you end up with a Mac that looks protected and isn't. If you're choosing a Mac EDR in the first place, our EDR comparison covers the main four.

What changed for whoever runs your MDM

None of this is new if you read the checklist, but it's now live, so it bites.

The old update commands are dead on 27. Apple's enterprise notes are blunt: "Legacy software update management no longer functions in all 27.0 operating systems." That covers the update commands, queries, deferrals and recommended cadence. On a mixed fleet you now need two paths. Tahoe Macs still follow the old settings. macOS 27 Macs only follow Declarative Device Management. If your deferral was set the old way, it isn't holding back your 27 Macs from anything, and it isn't enforcing their updates either.

Scripts that read the privacy database will break. Apps can no longer read the local TCC database directly. Apple's replacement is a new tccutil list command for reporting privacy permissions on managed Macs. If you have compliance or inventory scripts that read TCC.db, rewrite them.

Accessibility grants are no longer silent. If you still push Accessibility access through the old PPPC profile, Apple says the user now sees a notification for each app, and can switch the permission off in System Settings. For remote support and automation agents, that means rebuilding on the new Privacy key, which we covered when it was announced.

Rosetta doesn't come back on its own. If a Mac had Rosetta before the upgrade, macOS 27 doesn't restore it. An Intel-only app will ask to install it on first launch, and that can need an admin. If you still have Intel-only tools, push Rosetta through MDM.

Not macOS 27, but the same week

Microsoft retired Exchange Web Services on 1 October 2026 (opens in a new tab), and legacy Outlook for Mac now stops working with Exchange Online mailboxes. That's unrelated to the macOS upgrade, but the timing means it'll get blamed on it. If someone's Outlook stopped syncing this week, check they're on the new Outlook before you look at macOS.

So, should your Macs upgrade now?

Here's how we'd roll it out:

1. Patch Tahoe first. Every Mac staying on 26 gets 26.7.1 by 12 October. That's the compliance deadline, and it's the one thing on this list with a date attached.
2. Pilot on 27.0.1, never 27.0. A few Macs per team, with their real apps, on current agent and VPN builds.
3. Upgrade office Macs team by team. Anyone whose apps are all on a vendor's supported list can go. Check the long tail too: when we looked, Zoom, Slack, Dropbox and Google Drive hadn't published macOS 27 statements, so they belong in the pilot rather than on trust.
4. Hold the exceptions. Avid suites, Illustrator and Lightroom users, and anyone on Vectorworks 2025 without the fix stay on Tahoe until their vendor says otherwise.
5. Fix the plumbing. Retire any Time Capsule, move AFP shares to SMB, switch OneDrive to Microsoft's own installer, and make sure your update policy is declarative.

None of that needs to happen this week, apart from step 1. That's the nice thing about Apple still patching Tahoe: the deadline is the patch, not the upgrade.