AppleCare token lets admins pull macOS logs for faster fixes

Apple is quietly adding a tool in macOS 27 that could shave hours off technical support for companies with large fleets of Macs and iPads. The new remote AppleCare log collection feature lets an IT administrator trigger log collection on a device and have the results uploaded directly to Apple, attached to the support ticket. It’s designed to work with AppleCare cases and is accessed via device management tools that enroll the tokens provided by AppleCare.

The feature is built around two commands. The first is TriggerEnhancedLogCollection, which starts the log-gathering process, and the second is a cancel command to stop it if needed. When an AppleCare case is opened, AppleCare issues a token to the IT admin, who then passes that token through their device management system to trigger the collection on the user’s device. The logs are uploaded to Apple and attached to the ticket automatically, so support teams don’t have to chase down the user for diagnostics data.

Apple also added visibility into the process. The device reports its status in real time, showing whether log collection has started, finished, is waiting for user consent, or is currently uploading. This helps IT teams coordinate with users and keep tickets moving, even when workers are remote or traveling.

There are two modes for how this works, and the mode you use depends on the device and setup. On iOS, iPadOS, macOS, and tvOS, there is a non-interactive mode and an interactive mode for macOS. In non-interactive mode, the device collects and uploads logs in the background without user involvement. This is useful for kiosk setups or devices with no user present. On macOS, interactive mode is required, so a user sees a prompt to consent to both log collection and the upload. The user can decline, but the system is designed to be simpler and more transparent than older, manual methods.

In practice, the feature could make it easier for IT teams to diagnose intermittent issues across a dispersed workforce. Remote or hybrid work makes manual log collection painful, and this approach gives AppleCare a direct, secure channel to get the data they need without relying on the user to share files or walk through steps.

What this means for everyday users is mostly about smoother support. If your employer uses Apple’s device-management tools and macOS 27, a support ticket could be resolved faster because your logs are sent automatically (with consent where required). If you’re just experimenting with a personal Mac, you won’t see any change unless your organization uses AppleCare in a business setting.

Apple hasn’t shared timing details beyond describing the feature as part of the macOS 27 ecosystem, and it’s not yet described as a feature that will any time soon be needed by individual consumers. It’s primarily aimed at IT teams managing large fleets and wanting a tighter loop between device data and support desks.