Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/Mobile/help/en-us/index.html?contextId=ios-declarative-policy-enforced-software-update

Enforced software update

This feature might not be available for all customers yet.

Restrictions

This feature is only available for devices that meet all of the following requirements:

  • iOS 17, iPadOS 17, or later
  • Apple Device Enrollment management mode

The Enforced software update configuration of an iOS or iPadOS declarative policy lets you enforce a specific operating system version on the device.

Use this configuration if you have a strictly regulated environment where devices must update to a specific OS version by a specific date. To enforce a general update strategy and other update-related settings, use the Software update settings configuration instead. See Software update settings.

To enforce a specific Background Security Improvement, for example, iOS 26.3.1(a), you must also configure an Enforced Background Security Improvement configuration. See Enforced Background Security Improvement.

For general information about updating Apple devices using a declarative policy, see Install and enforce software updates for Apple devices.

Note

Enforcing an operating system update may fail if the device doesn't meet the minimum battery and storage requirements. For details, see About software updates for Apple devices.

Setting Description
Enforced OS version

Select the OS version that the device must have.

If the version doesn't include a patch version, the system installs the latest available patch version. For example, if you select the OS version 26.3 and a patch version 26.3.1 is available, the system installs version 26.3.1.
Enforced build version

Select the OS build version that the device must have. Use this setting, for example, when testing an OS update.

The list only includes build versions for the selected OS version.
Enforcement date and time

Select the latest date and time to install the update. The device enforces the update if the user doesn't install it by then.

The date and time are in the device's local time zone.
Information URL The URL of a web page with information that your organization provides about the enforced update. Users can view this page when the operating system notifies them about the update.