Overview
The Apple Software Update Policy lets admins manage how macOS, iOS, and iPadOS devices check for, download, defer, notify users about, and install Apple software updates.
Use this policy to:
Keep Apple devices up to date
Reduce exposure to known vulnerabilities
Standardize update behavior across managed Apple devices
Control how long users can defer updates
Schedule updates during approved maintenance windows
Notify macOS users about pending updates with Nudge
This policy is useful for organizations that need to maintain device security and compliance without relying on users to manually install updates.
Supported Platforms
Platform | Minimum Supported Version |
macOS | macOS 12.0+ |
iOS | iOS 11.5+ |
iPadOS | iPadOS 11.5+ |
Some individual settings have additional Apple-specific OS requirements. If a device does not meet the minimum OS version for a setting, the device may ignore that setting.
What This Policy Controls
The Apple Software Update Policy can control:
Automatic update checks
Background update downloads
Automatic OS update installation
Install action behavior
App Store app updates
Security updates
XProtect, MRT, and Gatekeeper updates
macOS beta release installation
User deferrals
Update deferral windows
Scheduled update installation
Nudge installation for macOS update reminders
Before You Begin
Before deploying this policy:
Confirm target devices are enrolled in Swif.
Verify devices are running a supported OS version.
Test the policy on a small device group before broad deployment.
Decide whether updates should only download, notify users, install immediately, or install during a scheduled window.
For iOS and iPadOS, confirm supervision status if using deferral-related settings.
Steps
In Swif, go to Device Management.
Open Policies.
Create or edit a policy.
Select Apple Software Update Policy.
Configure the update behavior.
Assign the policy to the appropriate device group.
Save and deploy the policy.
Recommended Configuration
For most managed environments, Swif recommends the following baseline configuration:
Setting | Recommended Value |
Automatically check for updates | Enabled |
Download newly available updates in the background | Enabled |
Automatically Install Updates | Enabled |
Install Action |
|
Max User Deferrals | 0 |
Automatically install App Store app updates | Enabled |
Install XProtect, MRT, and Gatekeeper updates automatically | Enabled |
Install security updates automatically | Enabled |
Allow installation of macOS beta releases | Disabled, unless used for testing |
Enable automatic installation of Nudge for macOS updates | Enabled |
This configuration allows devices to automatically check for and download updates while preventing unexpected immediate installation or forced restarts.
DownloadOnly is recommended as the default install action because it stages updates on the device without installing them right away. Admins can then use additional policy settings, Nudge, or a planned maintenance workflow to drive installation at the right time.
Automatically Check for Updates
When enabled, the device automatically checks for available Apple software updates.
If disabled, the Check for updates option is deselected and users cannot change it.
Supported on: macOS 10.15+
Download Newly Available Updates in the Background
When enabled, the device downloads available updates in the background.
If disabled, background downloads are turned off and users cannot change the setting.
Supported on: macOS 10.15+
Automatically Install Updates
When enabled, the device can automatically process available updates based on the selected Install Action.
This setting also exposes:
Max User Deferrals
Install Action
Supported on: macOS 10.15+, iOS 11.5+, iPadOS 11.5+
Important: automatically set Install Action when empty
If set to true, it automatically installs the update when a new one is available. If no Install Action is specified, the system defaults to DownloadOnly.
Max User Deferrals
The Max User Deferrals setting controls how many times a user can defer a software update.
Example:
3
This allows the user to defer the update up to three times before the update is enforced.
Default: 0
Supported on: macOS 11.3+, iOS 11.5+, iPadOS 11.5+
Install Action
The Install Action setting defines what the device should do when a software update is available.
Install Action | Behavior |
| Downloads the update without installing it |
| Installs a downloaded update as soon as possible |
| Downloads the update and notifies the user |
| Downloads the update and installs it later |
| Performs the default install action and forces restart if required |
| Installs the update at a specific date and time |
| Installs the update on a selected day and hour |
DownloadOnly
Downloads the software update without installing it.
This is the recommended install action for most organizations because it prepares devices for updates without immediately interrupting users.
Use this when you want to:
Stage updates before enforcement
Avoid unexpected restarts
Use Nudge or internal communications to prompt users
Control installation timing separately
InstallASAP
Installs the update as soon as possible.
On macOS, this downloads the update and triggers the restart countdown notification if a restart is required.
Use this for urgent updates when faster remediation is required.
NotifyOnly
Downloads the update and notifies the user.
Use this when you want users to manually complete installation.
Supported on: macOS 10.11+
InstallLater
Downloads the update and installs it later.
Use this when you want to avoid immediate disruption but still allow macOS to install the update at a later time.
Supported on: macOS 10.11+
InstallForceRestart
Performs the default install action and forces a restart if the update requires it.
Supported on: macOS 11+
Note: On macOS 15 and later, the restart may not occur automatically. This behavior is controlled by macOS.
InstallSpecificDate
Installs the update at a specific local date and time.
Supported on: macOS 14+, iOS 17+, iPadOS 17+
Date and time format:
YYYY-MM-DDTHH:MM:SS
Example:
2026-02-15T23:00:00
InstallSpecificDayHours
Installs the update on a selected day and hour.
Supported on: macOS 14+, iOS 17+, iPadOS 17+
Available fields:
Field | Description |
Target Local Day | Day of the week, or |
Target Local Hours | Hour of the day |
Target Local Time Zone | Time zone offset used for scheduling |
Example:
Target Local Day: Wednesday
Target Local Hours: 19:00
Target Local Time Zone: +03
If the device is offline at the scheduled time, the system uses the configured time zone offset to determine when to reschedule the operation.
Example Scenario:
If you set updates for Saturday, 2 AM local time:
You can group devices located in New York updates during its local time (EST) and set a policy that updates in EST Saturday at 2 AM local time.
Similarly, you can group devices located in Tokyo to update in JST local time.
This eliminates manual calculations and ensures a smooth, automated, global software update rollout.
Effective schedule:
If you deploy on Monday, Nov 10, 2025, the effective schedule will be set for the next Monday (Nov 17, 2025).
Automatically Install App Store App Updates
When enabled, macOS automatically installs App Store app updates.
If disabled, the Install app updates from the App Store option is deselected and users cannot change it.
Supported on: macOS 10.15+
Install XProtect, MRT, and Gatekeeper Updates Automatically
When enabled, macOS automatically installs Apple security data updates, including:
XProtect updates
Malware Removal Tool updates
Gatekeeper updates
These updates help protect devices against known malware and unsafe software.
Supported on: macOS 10.15+
Install Security Updates Automatically
When enabled, macOS automatically installs critical security updates and system data files.
If disabled, automatic installation of critical security updates is turned off and users cannot change the setting.
Supported on: macOS 10.15+
Allow Installation of macOS Beta Releases
When enabled, prerelease macOS software can be installed on the device.
For production environments, this should usually be disabled unless the device is part of a test or development group.
Supported on: macOS 10.9+
Restrict Software Update Require Admin To Install
When enabled, software update installation is restricted to admin users.
Use this when your organization wants tighter control over who can initiate software update installations.
Supported on: macOS 10.7+
Deferring macOS Updates
The Defer macOS Updates setting controls whether macOS updates are delayed before they become visible or installable to users.
Available options:
Option | Behavior |
No deferral | Updates are not delayed |
Defer all macOS updates | Delays updates using the managed deferred install delay |
Defer macOS updates by type | Allows separate deferral controls for OS, non-OS, minor, and major updates |
Important: Deferring an update delays visibility or installation. It does not permanently block the update. If Automatically Install Updates is enabled, the update can still install automatically after the deferral period expires.
Defer all macOS updates
Managed Deferred Install Delay
Controls how many days to delay software updates after Apple releases them.
Allowed range:
1–90 days
Default:
30 days
Supported on: macOS 10.13.4+
Defer macOS updates by type
Force Update Delay
When enabled, the system delays user visibility of software updates.
The delay is 30 days by default unless another delay value is configured.
For iOS and iPadOS, this may require supervised devices.
Deferred Software Updates Delay
Controls how many days to delay software update visibility.
Allowed range:
1–90 days
Default:
30 days
Deferred Minor Software Updates Delay
Controls how many days to delay minor OS updates.
Allowed range:
1–90 days
Default:
30 days
Supported on: macOS 11.3+
Defer Non-OS Software Updates
When enabled, the system delays user visibility of non-OS software updates.
This applies to updates that are not full operating system updates.
Supported on: macOS 11+
Deferred Non-OS Software Updates Delay
Controls how many days to delay non-OS software updates.
Allowed range:
1–90 days
Default:
30 days
Supported on: macOS 11.3+
Defer Major OS Software Updates
When enabled, the system delays visibility of major macOS upgrades.
Use this to prevent users from upgrading to a new major macOS version before your organization has tested it.
Supported on: macOS 11+
Deferred Major Software Updates Delay
Controls how many days to delay major macOS upgrades.
Allowed range:
1–90 days
Default:
30 days
Supported on: macOS 11.3+
Enable Nudge for macOS Updates
The policy can automatically install and configure Nudge for macOS update reminders.
Nudge helps notify and remind users to install pending macOS updates until the update is completed.
Use Nudge when:
You want stronger end-user reminders
Users often defer updates
You need more visible update prompts on macOS
You want to encourage compliance before enforcement deadlines
Supported on: macOS 10.14+
Deprecated or Legacy Options
Catalog URL
The Catalog URL field is deprecated.
It was previously used to define a software update catalog URL, but this property is not supported in macOS 11 and later.
Do not configure this setting for modern macOS deployments.
Disable Extended Validation Check of TLS Certificate
This setting controls whether the system performs additional validation of the update server’s TLS certificate when downloading updates.
Only adjust this setting if your organization has a specific legacy software update server requirement.
Notes
Use
DownloadOnlyas the recommended install action unless your organization intentionally wants updates to install immediately or during a scheduled window.Always configure Install Action explicitly when Automatically Install Updates is enabled.
Update behavior may vary depending on Apple’s MDM capabilities and the OS version.
Some settings require supervised devices on iOS and iPadOS.
Deferrals delay updates but do not permanently block them.
Restart behavior is controlled by macOS and may vary across versions.
Test update policies on a small device group before broad deployment.
Avoid enabling beta releases on production devices unless required.
Troubleshooting
The Device Is Not Installing Updates
Check:
The device is online
The device is checking in with Swif
The device OS version supports the configured settings
The policy is assigned to the correct device or device group
The update is not still inside a configured deferral window
Install Action is not set to
DownloadOnlyorNotifyOnly
If DownloadOnly is selected, the update is expected to download but not install automatically.
The Device Downloaded Updates but Did Not Install Them
This is expected when Install Action is set to:
DownloadOnly
To install updates automatically, change Install Action to one of the following:
InstallASAPInstallLaterInstallForceRestartInstallSpecificDateInstallSpecificDayHours
Users Can Still Defer Updates
Check:
Max User Deferrals
Whether the update requires user interaction
Whether Nudge is enabled for macOS reminders
Whether the selected install action enforces installation
Update Is Delayed Longer Than Expected
Check:
Managed Deferred Install Delay
Deferred Minor Software Updates Delay
Deferred Major Software Updates Delay
Deferred Non-OS Software Updates Delay
Device local time and time zone
Whether the device was offline during the scheduled update window
Scheduled Update Did Not Run
Check:
Device was online at the scheduled time
Target local date/time is correctly formatted
Target local time zone is correct
Device OS supports scheduled installs
Install Action is set to
InstallSpecificDateorInstallSpecificDayHours
Security & Compliance Impact
Keeping Apple devices updated helps reduce exposure to known vulnerabilities and supports compliance requirements for endpoint patch management.
This policy helps admins:
Enforce consistent update settings
Reduce manual follow-up with users
Stage updates safely before installation
Avoid unexpected user disruption
Delay risky major upgrades while still allowing security updates
Track update posture across managed devices
Support audit readiness for frameworks such as SOC 2, ISO 27001, HIPAA, and NIST
Summary
Use the Apple Software Update Policy to centrally manage update behavior across macOS, iOS, and iPadOS devices.
For most organizations, Swif recommends enabling automatic checks, background downloads, security updates, and Nudge reminders, while setting Install Action to:
DownloadOnly
This stages updates safely and gives admins more control over installation timing and restart behavior.