Keeping devices updated is critical for enterprise security, performance, and compliance. Updates deliver essential patches, bug fixes, and new features. Without a consistent strategy, organizations risk exposing endpoints to vulnerabilities and compatibility issues.

With Microsoft Intune, IT admins can configure and enforce update policies for Apple devices, including the ability to:

• Target a specific OS version or enforce the latest version
• Set enforcement deadlines
• Minimize user disruption

This article shows how to configure update policies in Intune using Apple's Declarative Device Management (DDM) model—a more reliable and autonomous approach than traditional MDM-based policies, which are now deprecated.

Prerequisites

Configuration

When designing your Apple device update strategy, align with your organization's security policies, user experience expectations, and compliance mandates. Intune supports two primary policy models for managing software updates:

• Latest version policy: automatically installs the latest eligible OS version after a defined deferral period. With this model:

  • You configure a deferral period (in days) and an installation time.
  • Devices autonomously install the update within the declared deadline—no manual triggers required.

  This model is ideal for organizations that prioritize rapid patching, regulatory compliance, and minimal IT overhead.

• Targeted version policy: offers granular control over which OS version is installed and when. With this model:

  • You specify the required OS version and set a precise installation deadline.
  • A help URL can be provided for user assistance.
  • Devices enforce compliance independently, without manual enforcement.

  This model is best suited for environments with strict app compatibility requirements, phased deployment strategies, or formal change management workflows.

For more information about configuring Software Update policies and the available settings, seeSoftware Update.

Software Update Settings

When you configure software updates, you might want to manage aspects of the software update process leading up to the enforcement of an update. Using Software Update Settings policies, you can configure various settings that control how users can interact with software updates on their devices. These settings include the ability to:

• Require that an admin or standard user can perform updates on the device.
• Control how users can manually interact with software update settings like automatic download and install or the behavior of Rapid Security Responses.
• Hide updates from users for a specified time period.
• Suppress update notifications up to one hour before the enforcement deadline.
• Control whether users are allowed to update to the latest major update, latest minor update, or are offered both.

For more information about configuring Software Update Settings policies and the available settings, seeSoftware Update Settings.

Monitor policy settings deployment

Software update policy settings use the same reporting as other device configuration policies. For more information, seeMonitor device configuration policies.

A policy that reportsSuccess only means that the configuration policy successfully installed on the device. Monitor the OS version of targeted devices to ensure that they update.
After devices have updated to a later OS version than configured in the policy, the policy reports an error as the device sees this task as an attempt to downgrade. It's recommended to remove the older OS version policy from devices in this state.

To monitor the update status of your Apple devices, seeView Software Update Reports for Apple Devices.

Related articles

• View Software Update Reports for Apple Devices
• Software updates planning guide for supervised iOS/iPadOS devices in Intune
• Software updates planning guide for managed macOS devices in Intune

To learn more about the Apple declarative device management process, seeInstalling and enforcing software updates for Apple devices in the Apple documentation.