Manage Software Update Policies on macOS with Scalefusion

The Software update policy lets IT Admins control the settings for installing system software and updates on managed macOS devices. This gives IT admins more flexibility in selecting and applying the software updates.

This document describes the Software update policy settings IT admins can configure from Scalefusion Dashboard, and enforce on Scalefusion managed macOS devices.

Before You Begin

1. macOS Device Profile should be created.

Description

1. On Scalefusion Dashboard, navigate to Device Profiles & Policies > Device Profiles

2. Create a new macOS device profile or edit an existing one.

3. Navigate to OS Update Settings > Software Update Policy.
   

   

   
   

   1. Enforce Software Update Policy: If this setting is enabled, then whatever update policy is configured by the admin from Dashboard (the below settings), shall apply. The users will not be able to modify or configure the software update settings on the device. Below are the settings configurable by Admin preventing the end users from changing them:

      1. Automatic Update Settings

         1. Prerelease Software(!): Allows installation of prerelease software

         2. Check for Updates(!): Controls the "Check for updates" option and prevents the user from changing the option.

         3. Download new updates when available: Controls the "Download new updates when available" option and prevents the user from changing the option.

         4. Install macOS updates: Controls the "Install macOS updates" option and prevents the user from changing the option.

         5. Install app updates from the App Store(!): Controls "Install app updates from the App Store" option and prevent the user from changing the option.

         6. Install system data files and security updates: Controls the automatic installation of critical updates and prevents the user from changing the "Install system data files and security updates" option.

         7. Install configuration data(!): Controls the automatic installation of configuration data.

         8. Restrict to Admin Users only: If this setting is enabled, the app installations and software updates will be allowed to be done by admin users only. 

         9. Allow All Notifications: This setting controls how many update enforcement notifications the user sees during a software update or system update process. If enabled, the system shows all update-related notifications and if disabled, the user sees only the most critical notifications, such as a one-hour warning before the update deadline or final restart countdown.

      2. Rapid Security Response Updates (Applicable on macOS 13 and above)

         1. Allow Rapid Security Response Installation: This setting controls whether Rapid Security Responses (RSRs), critical security patches delivered outside of regular system updates are automatically installed on the device. If enabled, Rapid Security Responses are automatically downloaded and installed else will not be installed automatically.

         2. Allow Rapid Security Response Rollback: This setting controls whether users are allowed to remove (roll back) a previously installed Rapid Security Response (RSR) update.

            
            

4. Click on Save after giving configurations.

Deprecated features

Following settings have been deprecated and and cannot be controlled via MDM policies. As a result, they are denoted with a red icon in front of them:

How Software Update Policy is implemented on Device

1. Open Software Update settings by navigating to System Settings > General > Software Update
   

   

   
   

2. Any updates (if available) for your Mac, will be displayed on the screen
   

   

3. If Software Update Policy is: 

   1. Enforced on Dashboard
      

      

      On the device, the settings will be shown as disabled because they have already been enforced by the Admin from Scalefusion Dashboard and hence cannot be changed by the end user on the device.
      

   2. Not enforced on Dashboard
      

      

      On the device, the settings will be shown as enabled and configurable by the end user.