Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/Mobile/help/en-us/index.html?contextId=ios-declarative-policy-enforced-supplemental-update

Enforced Background Security Improvement

This feature might not be available for all customers yet.

Restrictions

This feature is only available for devices that meet all of the following requirements:

  • iOS 17, iPadOS 17, or later
  • Apple Device Enrollment management mode

The Enforced Background Security Improvement configuration of an iOS or iPadOS declarative policy lets you enforce a specific Background Security Improvement on the device.

A Background Security Improvement is a targeted security patch that Apple releases between regular OS updates. Unlike a full OS update, a Background Security Improvement doesn't change the OS version. For example, iOS 26.3.1(a) is a Background Security Improvement for iOS 26.3.1.

Use this configuration when you need to enforce a specific security patch on top of a specific OS version.

This configuration isn't available if you have an Enforced software update configuration and there's no Background Security Improvement for the enforced OS version.

Note

Enforcing an operating system update may fail if the device doesn't meet the minimum battery and storage requirements. For details, see About software updates for Apple devices.

You can only enforce a Background Security Improvement on devices that already have the related base OS version installed. For example, to enforce the iOS 26.3.1(a) Background Security Improvement, the device must have iOS 26.3.1 installed. Therefore, your policy should also contain an Enforced software update configuration. See Enforced software update.

Settings

Setting Description
Enforced OS version

Select the OS version that the device must have.

If you also have an Enforced software update configuration, select the same OS version as you did there.
Enforced build version

Select the Background Security Improvement that the device must have.

The list only includes Background Security Improvements for the selected OS version.
Enforcement date and time

Select the latest date and time to install the update. The device enforces the update if the user doesn't install it by then.

The date and time are in the device's local time zone.
Information URL The URL of a web page with information that your organization provides about the enforced update. Users can view this page when the operating system notifies them about the update.

Example

Suppose you want to enforce the iOS 26.3.1(a) Background Security Improvement. The tables below show how to configure the Enforced software update and Enforced Background Security Improvement configurations.

Enforced software update

Setting Value
Enforced OS version 26.3.1
Enforced build version None
Enforcement date and time Any date

Enforced Background Security Improvement

Setting Value
Enforced OS version 26.3.1
Enforced build version 26.3.1(a)
Enforcement date and time Later than in Enforced software update