Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/Mobile/help/en-us/index.html?contextId=ios-declarative-policy-software-update-settings

Software update settings

This feature might not be available for all customers yet.

Restrictions

This feature is only available for devices that meet all of the following requirements:

  • iOS 18, iPadOS 18, or later
  • Apple Device Enrollment management mode
  • Supervised

The Software update settings configuration of an iOS or iPadOS declarative policy lets you manage the operating system's behavior related to software updates.

For general information about updating Apple devices using a declarative policy, see Install and enforce software updates for Apple devices.

General

Setting Description
Show all enforcement notifications

The device shows all software update enforcement notifications.

If you turn this setting off, the device only shows a notification one hour before the enforcement deadline and the restart countdown notification.

Reducing the number of update notifications can be useful for devices that aren't assigned to a user, such as kiosk devices.

For an overview of the notifications the device shows, see section "User experience of enforced software updates" in Install and enforce software updates for Apple devices.
Update strategy

Select which updates the device offers to the user when more than one update is available.

  • Current version: Offer the lowest numbered version.
  • Latest version: Offer the highest numbered version.
  • All versions: Offer all available OS updates.

Example

Suppose the device has iOS 17.7.1 installed and there are updates available for versions 17.7.2 and 18. Current version will offer iOS 17.7.2, Latest version offers iOS 18, and All versions offers both versions 17.7.2 and 18 and lets the user choose.

Automatic updates

Setting Description
Download updates automatically
  • User-defined: The user can turn automatic downloads of OS updates on or off.
  • Always on: OS updates are automatically downloaded.
  • Always off: OS updates aren't automatically downloaded.
Install updates automatically
  • User-defined: The user can turn the automatic installation of OS updates on or off.
  • Always on: OS updates are automatically installed.
  • Always off: OS updates aren't automatically installed.
Install security updates automatically
  • User-defined: The user can turn the automatic installation of Background Security Improvements on or off.
  • Always on: Background Security Improvements are automatically installed.
  • Always off: Background Security Improvements aren't automatically installed.

Time-based deferral

Setting Description
Major and minor updates (days)

The number of days the device defers an OS update before the user can install it, calculated from its release date.

This setting doesn't affect Background Security Improvements.

Enter a number from 1 to 90, or 0 to offer available updates immediately.

Background Security Improvements

Setting Description
Install automatically If you turn this setting off, the device doesn't offer Background Security Improvements to the user.
Allow rollback If you turn this setting off, the device doesn't offer Background Security Improvement rollbacks to the user.