Configuring the Software Update Settings Component - Jamf Pro Blueprints Configuration Guide

Use the Software Update Settings component in a blueprint to control how software updates behave on Apple devices using declarative device management. This component sets update behavior such as automatic install actions, deferral periods, beta program enrollment, and Background Security Improvement handling. It does not start or enforce an update.

Settings configured in this component will override equivalent settings in existing configuration profiles rather than merging with them. For example:

The Allow standard users to install software updates setting overrides the existing setting in the Software update payload.
The Recommended cadence setting overrides any existing settings that were previously defined by the Recommend Software Update Version MDM command.
All install actions override any update deferral setting in the Software Update payload.
All deferrals override any update deferral setting in the Restrictions payload.
Background Security Improvements setting (previously the Rapid Security Response setting) overrides the existing settings in the Restrictions payload. Additionally, specifying an OS version in the Software Update Settings component automatically installs any Background Security Improvements for that version.
The Beta updates setting overrides the existing settings in the Software Update payload.
Note:
To configure beta updates, you need the beta enrollment tokens that are available for your organization from Apple Business or Apple School Manager. For more information on retrieving a token from Apple, see Testing software updates with the AppleSeed for IT beta program in Apple Platform Deployment.

Requirements

Target devices that meet the minimum OS version required. Devices that do not meet the minimum will not receive declarations, will not appear as failed in deployment status reports, and will be silently skipped.
A beta enrollment token from Apple Business or Apple School Manager, if you configure beta updates

Create a blueprint with a Software Update Settings component.
For instructions, see Blueprint Builder.
Configure the settings that match your organization's update policy.
Configure only the settings you need. Not every setting is available for every OS.
- Allow standard users to install software updates —Set whether a standard user can install updates without local administrator authentication. Available on macOS only.
- Notification preference for updates scheduled by declarations —Set whether users receive update notifications. If you select Disable, users see a notification only 60 minutes before an installation is required.
- Recommended cadence —Set how updates appear for user-initiated updates when both a minor and a major update are available.
- Install actions —
  Set whether the device automatically downloads and installs updates, and whether the user can control each action. Set each action to Allowed, Always, or Never:
  - Automatic installs of available updates —Controls automatic installation of available OS updates.
  - Automatic downloads of available OS updates —Controls automatic download of available OS updates.
  - Automatic installs of available security updates —Controls automatic installation of available security updates.
- Beta updates —Enroll devices in an Apple beta program. Set Program enrollment to Allowed, Always, or Never, and use Offer programs to add the programs to offer. This setting requires a beta enrollment token from Apple Business or Apple School Manager.
- Deferrals —Delay when an update becomes visible to users, from 1 to 90 days after Apple releases it. Set a combined deferral period for iOS, iPadOS, and tvOS, and set separate periods for major macOS updates, minor macOS updates, and non-OS updates delivered through macOS software update mechanisms. Deferrals delay visibility only; they do not enforce installation.
  Note:
  The Software Updates component overrides these deferral settings. If a device receives both, the update becomes visible as soon as Apple releases it, and the enforcement deadline applies.
- Background Security Improvements —Set whether the system offers Background Security Improvement installation and removal to users.
Click Save.
Click Deploy to deploy the blueprint to the configured device groups.
After deploying your blueprint, use the Jamf Pro API to review deployment status of the declarations contained within the blueprint. For instructions, see Viewing the Status of a Blueprint (Jamf Pro API).