Use the Software Update Settings component in a blueprint to control how software updates behave on Apple devices using declarative device management. This component sets update behavior such as automatic install actions, deferral periods, beta program enrollment, and Background Security Improvement handling. It does not start or enforce an update.
Settings configured in this component will override equivalent settings in existing configuration profiles rather than merging with them. For example:
The Allow standard users to install software updates setting overrides the existing setting in the Software update payload.
All install actions override any update deferral setting in the Software Update payload.
All deferrals override any update deferral setting in the Restrictions payload.
Background Security Improvements setting (previously the Rapid Security Response setting) overrides the existing settings in the Restrictions payload. Additionally, specifying an OS version in the Software Update Settings component automatically installs any Background Security Improvements for that version.
The
Beta updates setting overrides the existing settings in the
Software Update payload.
- Create a blueprint with a Software Update Settings component.
- Configure the settings that match your organization's update policy.
Configure only the settings you need. Not every setting is available for every OS.
- Allow standard users to install software updates —Set whether a standard user can install updates without local administrator authentication. Available on macOS only.
- Notification preference for updates scheduled by declarations —Set whether users receive update notifications. If you select Disable, users see a notification only 60 minutes before an installation is required.
- Recommended cadence —Set how updates appear for user-initiated updates when both a minor and a major update are available.
- Install actions —
Set whether the device automatically downloads and installs updates, and whether the user can control each action. Set each action to Allowed, Always, or Never:
- Automatic installs of available updates —Controls automatic installation of available OS updates.
- Automatic downloads of available OS updates —Controls automatic download of available OS updates.
- Automatic installs of available security updates —Controls automatic installation of available security updates.
- Beta updates —Enroll devices in an Apple beta program. Set Program enrollment to Allowed, Always, or Never, and use Offer programs to add the programs to offer. This setting requires a beta enrollment token from Apple Business or Apple School Manager.
- Deferrals —Delay when an update becomes visible to users, from 1 to 90 days after Apple releases it. Set a combined deferral period for iOS, iPadOS, and tvOS, and set separate periods for major macOS updates, minor macOS updates, and non-OS updates delivered through macOS software update mechanisms. Deferrals delay visibility only; they do not enforce installation.
Note:The Software Updates component overrides these deferral settings. If a device receives both, the update becomes visible as soon as Apple releases it, and the enforcement deadline applies.
- Background Security Improvements —Set whether the system offers Background Security Improvement installation and removal to users.
- Click Save.
- Click Deploy to deploy the blueprint to the configured device groups.