Managing OS Updates & Patch Management of macOS Devices

IT Admins can get a view of macOS updates installed on Scalefusion-managed macOS devices, as per devices as well as updates, publish the updates and take more actions on them all from one place.

This document covers details of the features provided on Scalefusion Dashboard for managing macOS OS updates.

Pre-requisites

1. Configure OS Update Patch Management Settings for macOS
2. Enroll macOS devices with Scalefusion
3. Devices should have a minimum of 50% charging to install an update.

Description

1. On the Scalefusion Dashboard, navigate to Update & Patch Management > macOS OS Updates
2. Based on the configuration settings, once the backend syncs the available updates, they will start appearing on the Dashboard.
   It will take about 4-6 hours for the backend to sync the updates available on devices and display them on the Dashboard.
3. Summary View: A quick view shows the following information on the status of updates
   1. Device Summary
      1. Updated: Total no. of devices updated with no pending updates
      2. Pending: No. of devices on which updates are pending (not yet installed)
      3. OS Updates: Total number of devices that have an OS update pending
      4. Critical: No. of devices that have critical updates pending.
   2. Install Summary
      1. Approved: No. of updates that have been Approved and in progress state
      2. Installed: No. of updates that were approved and installed successfully.
      3. Failed: No. of updates that were approved but failed to install. Failed count will be based on Failure handling settings configured under OS Update Management settings.
4. The following details are fetched and displayed with respect to OS updates. There are two ways in which you can view the updates:
   1. Devices View: Provides the details based on devices and the updates on the devices.
   2. Updates View: Provides the details based on updates reported

Devices View

Following are the components in the device view

Filters

You can filter and view the devices accordingly. The devices can be filtered over the following:

Device Details

The device view displays the following details with respect to updates:

1. Name: Device Name and model
2. Group/Profile: Group and Profile applied on the devices.
3. Installed Updates: No. of updates installed on the device
4. Available Updates: No. of updates which are pending (not yet installed) on the device
5. Critical Updates: No. of critical updates pending on the device.

Device Level Actions

The following actions can be performed on devices.

1. View Details: Clicking on the eye icon opens a Dialog that displays the available updates on the device along with their version, update type and other related information. Here, you can also filter the updates by their update type.
2. Show Obsolete Updates: Obsolete updates are the updates that were previously available on the device or are no longer required on the device. On checking this setting, you will get a list of obsolete updates on the device.

Bulk Actions on Devices

You can also perform actions on all or selected devices in bulk. To access these actions, click on the Actions button at the right of the filters. The following actions can be performed:

1. Schedule Scan: This will schedule the scanning of updates on the selected devices
2. Download Compliance Report: A report of all the macOS devices, their make and model, OS version, pending updates and more details get downloaded in CSV format.

Updates View

Following are the components in the updated view

Filters

You can filter and view the updates accordingly. The updates can be filtered over the following:

Update Details

The updates view displays the following details with respect to each update:

1. Title: The info of the update to be applied, including the update name, product key and download size
2. Version: The version of the update.
3. Type: The type of the update.
4. Available On: Number of devices the update is available on.
5. Downloaded On: Number of devices the update is downloaded on.
6. Installed On: Number of devices the update is installed on.
7. Failed On: Number of devices on which the update failed to install.
   

Publishing an Update

An update can be published on macOS devices from the Dashboard. To do so,

1. Click on the three dots (under Actions) in front of the update and click on Publish
2. This will open the Publish dialog box. This contains the following:
   1. Details of the update, whether it requires a reboot, version, download size etc.
      
      
   2. Select Device: All the devices on which this particular update is available will be listed. You can select the device(s) on which you want to publish the update. The device details like OS version, Status, Group/Profile, managed/unmanaged etc. will also be displayed. After selecting device(s), click on Next to go to next tab.
      
      
      
   3. Publish Settings: Under this, choose how the installation should work by selecting any one of the following options:
      1. Install Immediately: Installs the update immediately on the selected device(s)
         1. Force Restart the system: If this flag is enabled, it will force restart the system on installing the update. Please note this can cause data loss if there is unsaved work. In general this flag is active when Require Reboot is Yes, else not.
            Force restart does not work if the update is a Major OS Update
            
            
      2. Make available in Self-service app: The update is available in the Scalefusion MDM client (agent app for macOS) for the end users to decide and install the update from their end.
      3. Enforce Update at Schedule: By enabling this option, you can schedule major and minor OS updates to be installed at a specific date and time (in device's local timezone). This ensures timely updates without disrupting user workflows. DDM(Declarative Device Management) will be used to enforce the update at the designated time.
         1. Display in Self Service app: On enabling this, the update is available in the Scalefusion MDM client (agent app for macOS)
            
3. Click on the Publish button after making selections.
   

Important Notes on Enforce Update at Schedule

1. Enforce Scheduled Updates can be applied on macOS 14 and above.
2. Silicon devices may require user authentication (password) to install updates.
3. If the device's battery is below 50%, a notification will be displayed on the device, and the update will be scheduled for the next hour.
4. Devices will be forced to update at the specified time, with periodic reminders sent to the user 24 hours and 60 minutes prior to the update.
5. The scheduled update details are also displayed at the following places:
   1. Device Details page and Full Device Info on Scalefusion Dashboard
      
      
      
   2. Updates section in Scalefusion MDM Client (agent app for macOS)
      
      
   3. Security & Privacy > Profiles > Organization Details > Device Declarations.
      

Bulk Actions on Updates

You can also perform actions on all the updates in bulk. To access these actions, click on the Actions drop-down at the right of the filters. The following actions can be performed:

1. Download Compliance Report: A report of all the macOS devices, their make and model, OS version, pending updates and more details get downloaded in CSV format.
   

Known Behaviors

1. On OS 10 and below, updates will not install, but they will be visible as an available update
2. On some OS 11 versions, even if the device is on an updated version, it is still displayed as an available update.
3. To install config data updates, it is recommended to enable the setting Install configuration data in macOS device Profile > Software Update Policy.
4. On OS 11 devices, the Safari upgrades will not take place.
5. On Intel chipset devices, installation or downloading fails a few times when the device is in sleep/lock/shut down mode.