Apple and Android updates¶
Mobile and Mac updates work differently from Windows. You can't approve individual patches. Instead, you tell devices which OS version to reach and by when, and you hide or delay updates you haven't tested.
Apple devices¶
MDM-based software update policies are deprecated
Apple has deprecated the older MDM software update commands and restrictions. Intune still shows the legacy iOS/iPadOS update policies and macOS update policies, but Microsoft recommends moving to declarative device management (DDM) and will remove the legacy policies after Apple retires the underlying commands. Move now, while both work.
DDM software update policies¶
DDM puts the device in charge of the update: it downloads the update, prompts the user, and installs it by your deadline, reporting progress as it goes.
| Requirement | |
|---|---|
| Platforms | iOS/iPadOS 17.0 and later, macOS 14.0 and later |
| Enrollment | Device enrollment or Automated Device Enrollment |
| Where | Settings catalog > Declarative Device Management > Software Update |
Key settings in an enforcement policy:
| Setting | What it does |
|---|---|
| Target OS Version | The version the device must reach, for example 26.0.1 |
| Target Build Version | Optional. Pin to a specific build, for example a rapid security response. |
| Target Local Date Time | The deadline, in the device's local time zone. After it passes, the device installs and restarts. |
| Details URL | A link shown to users explaining the update |
There's also a Software Update Settings configuration in the same category for ongoing behavior such as automatic download and install, deferral of new versions, notifications, and rapid security responses. DDM software update settings take precedence over the older Restrictions settings that defer or hide updates.
A practical Apple update rhythm¶
- Hide new major versions until you've tested them, using DDM software update settings (or Delay default visibility of software updates for up to 90 days on older OS versions).
- Enforce minor and security updates within days, with a DDM enforcement policy per ring: IT devices on day 1, pilot within 3 days, everyone within about 7 to 14 days.
- Back it up with compliance. Set a minimum OS version in compliance policies a little behind your enforcement target, so stragglers lose access and get prompted to update.
Things that delay Apple updates
The device must be powered on, charging (for most installs), connected to the internet, and have enough free storage. On iPhone and iPad, a passcode is needed to start the install, which matters for shared and kiosk devices. If automatic updates were turned off on the device, policy can't turn them back on; the user or a reset has to.
Times and time zones¶
Legacy MDM update policy schedules use UTC. DDM deadlines use the device's local time. If you're migrating, check that your maintenance windows still make sense.
Android¶
System updates¶
Android Enterprise corporate devices (fully managed, dedicated, and corporate-owned work profile) support a system update policy in device restrictions or the settings catalog:
| Option | Behavior |
|---|---|
| Automatic | Install as soon as available |
| Postponed | Delay by up to 30 days |
| Maintenance window | Install only within a daily window, useful for kiosks and scanners |
You can also set freeze periods, for example over peak trading periods, when no system updates install.
Personally owned work profile devices are controlled by the user and the manufacturer. Use compliance policies to require a minimum OS version and minimum security patch level instead.
Firmware over-the-air (FOTA)¶
For supported rugged devices (such as Zebra devices through Zebra LifeGuard over-the-air integration), Intune can schedule firmware updates centrally under Devices > Manage updates > Android FOTA deployments. FOTA is part of Intune Plan 2, which Microsoft 365 E3 and E5 include from July 2026.
Patch level matters more than it used to¶
On Android 13 and later, Google's strong integrity verdict now depends on recent security patches. Devices that fall behind on patches can fail app protection conditional launch or compliance checks that require strong integrity. Keep patch-level requirements realistic for each device model, and use the app protection status report to find devices with outdated patches.