Comprehensive Guide: Creating and Managing iOS and macOS Update Policies with Intune
Keeping Apple devices up to date is essential for security, compliance, and user productivity. Microsoft Intune lets you create granular update policies for iOS, iPadOS, and macOS—whether you use classic MDM-based controls or modern Declarative Device Management (DDM). This guide covers every step, setting, and best practice you need.
Understanding Update Policies in Intune
Update policies define how and when software updates are delivered and installed on enrolled devices. Intune supports:
- iOS/iPadOS 10.3+ (supervised)
- macOS 12+ (supervised)
- macOS 14+ (DDM-based)
You can create:
- MDM-based policies under the Update policies node.
- DDM-based policies using the Settings Catalog (for iOS/iPadOS 17+ and macOS 14+).
MDM-based policies offer straightforward update controls; DDM-based policies give you deeper configuration options in a unified settings catalog.
Key Configuration Areas
iOS and iPadOS Update Settings
- Update Types
- Critical Updates: Security fixes.
- Firmware Updates: Low-level device firmware.
- Configuration Updates: Changes to device settings.
- OS Updates: Major operating system releases.
- Install Behavior
- Download and Install: Automatically download and apply updates.
- Download Only: Fetch update files; wait for a manual or scheduled install.
- Install Immediately: Force-install when the download completes.
- Notify Only: Prompt users that updates are available.
- Install Later: Let users defer installation, up to a configured limit.
- Deferral and Deadlines
- Set maximum deferral counts or days to prevent indefinite postponement.
- Define enforcement deadlines to ensure critical updates install by a certain date.
macOS Update Settings
- Visibility and Action
- Show available updates to users.
- Configure automatic download and install options.
- DDM-Based Controls (macOS 14+)
- Use the Settings Catalog to pick individual update settings.
- Enforce deadlines and deferral limits.
- Specify custom help URLs so users know where to get troubleshooting guidance.
- Maintenance Windows
- Restrict installations to off-peak hours to reduce disruption.
- Combine with deferral settings to balance user choice and compliance.
Step-by-Step: Creating an Apple Update Policy
1. Sign In and Navigate
- Go to Devices in the Intune Admin Center.
- For MDM: Update policies for iOS/iPadOS or Update policies for macOS.
- For DDM: macOS → Configuration profiles → Create profile → Settings Catalog.
2. Define Policy Basics
- Platform: Choose iOS/iPadOS or macOS.
- Policy Type: Select MDM-based or DDM-based.
- Name & Description: Use clear, descriptive titles (e.g., “iOS 18 Auto-Update Policy”).
3. Configure Update Settings
- Select Update Types you want to control.
- Choose Install Behaviors and notification preferences.
- Set Deferral Limits: Maximum days or count.
- Enforcement Deadlines: Date by which updates must install.
4. Scope and Assign
- Target policies to specific Azure AD device groups (departments, geographies, or pilot groups).
- Use dynamic groups to automatically include devices that match criteria like OS version or enrollment type.
5. Review and Create
- Validate your settings in the summary pane.
- Click Create to deploy the policy.
Monitoring and Reporting
- Device Check-In: Apple devices sync every 8 hours.
- Intune Reports: View policy compliance, deferral counts, and enforcement status.
- Device Status View: Confirm which devices applied the policy and troubleshoot failures.
- User Feedback: Encourage users to install updates promptly; help URLs guide them if issues arise.
Best Practices and Tips
- Use Pilot Groups: Test policies on a small set of devices before full rollout.
- Combine MDM and DDM: Leverage DDM’s granular controls where supported, and fallback to MDM for older OS versions.
- Balance Deferrals: Allow short deferral windows to reduce user impact without compromising security.
- Custom Help URLs: Point users to in-house support pages or vendor help guides.
- Supervision Requirement: Ensure iOS/iPadOS devices are in supervised mode to access all update settings.
Exam Essentials
- Know where to find and how to use MDM-based vs. DDM-based policies.
- Be familiar with all install behaviors, deferral options, and enforcement deadlines.
- Understand supervised enrollment and OS version requirements for policy features.
- Recognize that macOS DDM policies use the Settings Catalog for fine-grained controls.
Additional Resources
- Microsoft Learn: Manage macOS software updates
- Microsoft Learn: Configure DDM software updates for Apple
- Apple Deployment Guide: Intune Settings Catalog
With these tools, you can enforce timely updates on iPhone, iPad, and Mac fleets—keeping devices secure, compliant, and running the latest features without user confusion or downtime.
