Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/Mobile/help/en-us/index.html?contextId=mac-declarative-policy-software-update-settings

Software update settings

This feature might not be available for all customers yet.

This feature is only available for macOS 15 and later.

The Software update settings configuration of a macOS declarative policy lets you manage the operating system's behavior related to software updates.

For general information about updating Apple devices using a declarative policy, see Install and enforce software updates for Apple devices.

General

Setting Description
Allow users to install OS updates If you turn this setting off, only administrators can install OS updates.
Show all enforcement notifications

The device shows all software update enforcement notifications.

If you turn this setting off, the device only shows a notification one hour before the enforcement deadline and the restart countdown notification.

Reducing the number of update notifications can be useful for devices that aren't assigned to a user, such as kiosk devices.

For an overview of the notifications the device shows, see section "User experience of enforced software updates" in Install and enforce software updates for Apple devices.

Automatic updates

Setting Description
Download minor updates automatically
  • User-defined: The user can turn automatic downloads of OS updates on or off.
  • Always on: OS updates are automatically downloaded.
  • Always off: OS updates aren't automatically downloaded.
Install minor updates automatically
  • User-defined: The user can turn the automatic installation of OS updates on or off.
  • Always on: OS updates are automatically installed.
  • Always off: OS updates aren't automatically installed.
Install security updates automatically
  • User-defined: The user can turn the automatic installation of Background Security Improvements on or off.
  • Always on: Background Security Improvements are automatically installed.
  • Always off: Background Security Improvements aren't automatically installed.

Time-based deferral

Setting Description
Major updates (days)

The number of days the device defers a major OS update before the user can install it, calculated from its release date.

Enter a number from 1 to 90, or 0 to offer available updates immediately.
Minor updates (days)

The number of days the device defers a minor OS update before the user can install it, calculated from its release date.

Enter a number from 1 to 90, or 0 to offer available updates immediately.
Non-operating system updates (days)

The number of days the device defers a non-OS update before the user can install it, calculated from its release date.

Enter a number from 1 to 90, or 0 to offer available updates immediately.

Background Security Improvements

Setting Description
Install automatically If you turn this setting off, the device doesn't offer Background Security Improvements to the user.
Allow rollback If you turn this setting off, the device doesn't offer Background Security Improvement rollbacks to the user.