Software updates play an important role in maintaining iOS and macOS device security, accessing new features, and ensuring compatibility with business applications. However, managing software updates across an organization can be challenging when IT teams need to balance security requirements, employee productivity, and installation timelines.
Previously, Apple software update management capabilities were spread across different settings and payloads. With Declarative Device Management (DDM), these capabilities are brought together for more comprehensive update management. SureMDM supports software update management through DDM, helping IT admins simplify iOS and macOS updates with centralized policies, flexible update controls, and improved visibility.
Challenges With Traditional Software Update Management
Traditional code-based software update workflows rely on device check-ins to process update commands, which can delay deployments when devices are offline or slow to check in. Also, update settings and controls are spread across different configurations rather than managed through a unified approach, making it harder for IT teams to coordinate deployments, manage deferrals, and balance timely updates with employee productivity.
A New Approach to Software Update Management With DDM
Declarative Device Management (DDM) introduces a different approach to manage iOS and macOS software updates. Rather than relying solely on individual commands, admins define the desired device state or behavior. The device then works toward that state and reports relevant changes back to the management service.
For software updates, admins can configure update settings, while devices process the declared configurations and report relevant status changes to the management service.
Introducing Software Update Management Using DDM in SureMDM
SureMDM now supports Software Update Management using DDM for compatible iOS and macOS devices. IT admins can configure update behavior through a centralized management profile and apply consistent policies across managed devices.
The capability includes update deferrals, automatic downloads and installations, Rapid Security Response settings, beta program management, and software update access controls.
1. Configure Software Update Deferrals
Not every software update needs to be available immediately. IT teams may need time to test major upgrades, verify application compatibility, or prepare users before making updates available.
With SureMDM, administrators can configure separate deferral periods for macOS devices:
- Major OS updates
- Minor OS updates
- Non-OS updates
For iOS devices, admins can only choose to defer all updates.
This allows organizations to determine when different categories of updates become available to users.
For example, IT teams can defer a major macOS upgrade while allowing routine updates to become available earlier. This supports a more controlled rollout while helping organizations align update availability with their testing and deployment requirements.
2. Manage Automatic Downloads and Installations
SureMDM lets administrators define how automatic software downloads and installations should behave on managed iOS and macOS devices.
Available settings include:
- Automatic Download of Available Updates: Allow users to control automatic downloads, always enable them, or always disable them.
- Automatic Installation of OS Updates: Allow users to control automatic installation, always enable it, or always disable it.
- Automatic Installation of Security Updates: Define whether users can control automatic security update installation or whether it should always be enabled or disabled.
These settings help IT teams establish consistent update policies while determining how much flexibility users should have.
For example, organizations can enable automatic downloads and installations to reduce the need for users to manually initiate updates. Alternatively, administrators can retain control over these actions when business requirements call for a more restrictive approach.
3. Manage Rapid Security Responses
Security improvements often need to be addressed without waiting for a broader operating system upgrade.
SureMDM supports configuration of Rapid Security Response settings through the DDM software update management profile.
Administrators can:
- Enable or disable Rapid Security Responses being offered for user installation.
- Allow or prevent users from rolling back Rapid Security Responses.
This helps organizations define how these security updates are presented and whether rollback options are available, based on their requirements.
4. Manage iOS and macOS Beta Program Enrollment
Organizations that test upcoming iOS and macOS releases may need a controlled way to manage beta program access.
SureMDM allows admins to configure which beta programs are available to users or specify a required beta program. Admins can retrieve beta OS update tokens through the ADE server configured in SureMDM. To enable beta updates, the ADE server must be added to SureMDM and enrolled in the Apple Beta Software Program through Apple Business Manager (ABM).
This helps IT teams manage beta enrollment according to their testing requirements rather than leaving program access entirely to individual users.
5. Control Software Update Access for Standard Users
Organizations may have different requirements for who can install macOS updates. SureMDM allows administrators to enable standard users to install major and minor software updates, reducing dependence on administrator privileges.
For iOS and iPadOS, SureMDM's OS Update Cadence controls which update versions are displayed on devices. Administrators can choose to show all available versions, older versions only, or the newest versions only.
This helps organizations maintain control over update installation permissions on managed Macs, particularly in environments where updates must follow an established approval process.
Let's look at how DDM-based software update management can address common IT challenges.
Real-World Scenarios With DDM-Based Software Update Management
| Scenario | Traditional MDM Approach | SureMDM DDM Approach |
|---|---|---|
| Software Update Availability and Status Reporting | Command-Based Updates: Update availability depends on configured settings and command-based workflows. | Declarative Update Controls: Admins control update availability through download rules and deferrals, while devices report status changes asynchronously. |
| Major Upgrades vs. Routine Security | All-or-Nothing Blocking: Global deferral rules often block all updates, delaying critical minor security patches while waiting on major OS compatibility verification. | Granular Category Deferrals: IT configures a 60-day deferral for Major OS upgrades while keeping a 0-day deferral for Minor and Non-OS security patches, maintaining security without software breakage. |
| Standard User Privilege Control | Installation Failures or Over-Privilege: Standard users cannot install updates, resulting in failed attempts, or IT must temporarily elevate user privileges, creating security risks. | Targeted Update Authorization: Admins can allow standard users to install major and minor macOS updates, reducing dependence on administrator privileges. |
| Automated Testing Fleet with Beta Releases | Manual Beta Enrollment: IT has to manually enroll developers' devices into Apple Beta programs via individual developer profiles or direct device interactions. | Centralized Beta Configurations: Admins configure beta program settings through SureMDM, using the required ADE server and beta tokens. |
Benefits of DDM-Based Software Update Management
Software Update Management using DDM helps IT teams simplify update administration while maintaining control over how updates are handled.
- Simplified update management: Configure update policies centrally across managed devices.
- Reduced manual intervention: Let supported devices manage updates according to declared settings.
- Flexible deployment planning: Align update availability and installation behavior with business requirements.
- Improved visibility: Use asynchronous status reporting to monitor device update state.
- Greater administrative control: Manage security response settings, beta enrollment, and update access.
Simplify Software Update Management With SureMDM
Managing software updates across devices involves balancing security, compatibility, and employee productivity. With Software Update Management using DDM, SureMDM helps organizations establish consistent update policies while taking advantage of Apple's declarative management approach.
Administrators can configure update deferrals, define automatic download and installation behavior, manage Rapid Security Responses, and control beta program enrollment from a centralized console.
