Devices must either have declarative device management enabled or meet the following legacy command requirements:
Devices have iPadOS 13 or later, iOS 9 or later, macOS 10.11.5 or later, or tvOS 9 or later, and are enrolled via Automated Device Enrollment.
Devices are unlocked. If a device is locked, such as via a passcode or FileVault enabled, the OS update will download but remain uninstalled. Users must unlock the device, and then manually install the OS update on their device.
Devices are not in Single App Mode. If a device is in Single App Mode, it will be unable to receive OS Update commands. Deploy any OS updates before placing a device in Single App Mode. Devices already in Single App Mode will need to be taken out of this mode to receive the update.