In the next few days those using M1 Macs will be updating to Big Sur 11.5, blissfully ignorant of how, as an admin user, their Mac could refuse to update. Because now, in addition to regular users, admin users and root, there’s another class of admin user: the Owner. Let me explain.

According to the small print in Apple’s Platform Security Guide, when you set up a new M1 Mac, or set one up after restoring it in DFU mode, the primary admin account created is special: it’s the Owner account of that Mac. During that inital setup, the Mac sends a request to Apple for that Mac’s signed Owner Identity Certificate (OIC). This is based on a private key generated in the Secure Enclave known as the Owner Identity Key (OIK).

Each M1 Mac has just a single OIK, and access to that is confined to that primary admin user of the internal SSD, who is thus its Owner. If your M1 is configured with a single macOS boot volume group on its internal SSD, never boots from an external disk, and has no other admin users – a vanilla system – then that’s all transparent.

If you install a second operating system, on internal or external storage, the Owner needs to agree to hand over Ownership to users of that second system. And that’s where problems can occur, with a combination of puzzlement and frustration. Last week, when trying to perform a macOS update on a second operating system on my M1 Mac mini, I only succeeded at the third attempt, after a total of five hours.

On an Intel Mac, there’s little to the installation and use of second operating systems: format the disk, run the installer, and by the end of the process you can switch readily between the two, logging in as an appropriate user on the system of your choice. For the M1’s Secure Boot, each bootable volume group needs a signed LocalPolicy which defines security policy for that system, and an Install User authorised by the Owner. When you run a macOS installer from the Owner account on internal storage, you’re normally invited to copy that Owner account to the second system, to become its primary admin user. If you agree to that, you’re prompted to enter the Owner’s password so their OIK can be accessed from the Secure Enclave.

When this works properly, it’s almost transparent to the Owner, and Ownership is handed over securely to the primary admin user of the second system. What happens, though, when a second admin user is created on that second system?

Because that second admin user has full admin rights, you’d expect them to be able to download and install macOS updates. What should happen before they’re installed is that macOS should ask for the primary admin user’s password, and installation should proceed. But it doesn’t always work that way. Depending on the version of iBoot installed, and which way the wind’s blowing, one of two failures can occur:

• macOS may be unable to identify the Owner or primary admin user for that second system, and display an error alert reporting that the system has no Owner, so refusing to even download the update.
• macOS may proceed to download and install the update, apparently as normal, but at the final stage it gets cold feet and reverts to the previous version of macOS installed. In other words, the update proceeds right up to the last moments, then aborts.

Having experienced both of these several times now, I’ve been unable to find any information provided by Apple (or anyone else) which explains what’s going on, what the errors mean, or how to address them. It’s only by wading through Apple’s Platform Security Guide, guesswork and experiment that I think I’ve realised what’s going on, and even then I stand by to be corrected by someone who really does know what they’re doing.

If you want to try duplicating these problems, here’s what I suggest:

1. Take a standard M1 Mac with macOS 11.4 installed in vanilla form on its internal SSD.
2. Install Monterey Public Beta 3 on an external SSD, to update the Mac’s firmware to something more recent than that accompanying 11.4.
3. Connect (or create) an external SSD with macOS 11.3.1 installed on it, with just the primary admin user configured.
4. Boot from 11.3.1, create a second admin user, and restart, logging into 11.3.1 using the second admin account.
5. Try installing the waiting macOS update to 11.4 (or 11.5 when available).

These may seem elaborate and esoteric, but in the next few months we’re all expecting Apple to release more Apple Silicon Macs aimed well above the lower end of the market, where users often live more adventurous lives and have Macs which are far from vanilla. Yet as far as I can see, none of these subtleties are documented for those more advanced users. That’s something I’ll be trying to put right in the coming week.