fleet/articles/enforce-os-updates.md

Enforce OS updates

Available in Fleet Premium

In Fleet, you can enforce OS updates on your macOS, Windows, iOS, and iPadOS hosts remotely using the Fleet UI, Fleet API, or Fleet's GitOps workflow.

For Apple (macOS, iOS, and iPadOS) hosts, Apple requires that the OS version is one from the list of available OS versions. The update will only be enforced if you use a version in that list.

For Android hosts, you can enforce OS updates using a configuration profile with the systemUpdate setting. This setting is only supported on fully-managed Android hosts (not BYO). Learn how to create a configuration profile in the custom OS settings guide.

Fleet-managed OS updates vs. custom profiles

Fleet provides two approaches to enforce OS updates:

1. Fleet-managed settings — Use the Fleet UI, API, or GitOps YAML to set a minimum version and deadline. Fleet generates and deploys the appropriate enforcement profile automatically.
2. Custom profiles — Upload your own Apple DDM declaration or Windows Update CSP profile for full control over enforcement parameters (e.g., custom enforcement time).

These two approaches are mutually exclusive per platform. If Fleet-managed OS update settings are configured, you cannot upload a custom OS update profile (and vice versa). You must remove one before configuring the other.

Custom OS update profiles are a Fleet Premium feature.

Enforce (Fleet-managed)

You can enforce OS settings using the Fleet UI, Fleet API, or GitOps.

1. Head to the Controls > OS updates tab.

2. To enforce OS updates for enrolled macOS, iOS, or iPadOS hosts, select the platform and set a Minimum version and Deadline.

3. For Windows, select Windows and set a Deadline and Grace period.

4. macOS only: check "Update new hosts to latest" if you would like hosts to automatically update to the latest OS version during automatic (ADE) enrollment, regardless of the minimum version and deadline settings.

Use the modify fleet endpoint to turn on minimum OS version enforcement. The relevant payload keys in the mdm object are:

• macos_updates
• ios_updates
• ipados_updates
• windows_updates

GitOps

OS version enforcement options are declared within the controls section of a Fleet GitOps YAML file, using the following keys:

• macos_updates
• ios_updates
• ipados_updates
• windows_updates

Custom OS update profiles

Instead of using Fleet-managed settings, you can upload a custom profile for more granular control over OS update enforcement. This is useful when you want to customize parameters that Fleet doesn't expose, such as the enforcement time (Fleet defaults to noon local time for Apple).

Apple (macOS, iOS, iPadOS)

Upload a custom DDM declaration of type com.apple.configuration.softwareupdate.enforcement.specific. For example, to enforce macOS 15.4.1 with a deadline of 7 PM local time:

{
  "Type": "com.apple.configuration.softwareupdate.enforcement.specific",
  "Identifier": "com.example.my-os-update-enforcement",
  "Payload": {
    "TargetOSVersion": "15.4.1",
    "TargetLocalDateTime": "2025-07-01T19:00:00"
  }
}

See Apple's SoftwareUpdateEnforcementSpecific documentation for all available payload keys.

Windows

Upload a custom Windows XML profile targeting the Update CSP (./Device/Vendor/MSFT/Policy/Config/Update). For example, to set custom deadline and grace period values:

<Atomic>
  <Replace>
    <Item>
      <Target>
        <LocURI>./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineForFeatureUpdates</LocURI>
      </Target>
      <Meta>
        <Type xmlns="syncml:metinf">text/plain</Type>
        <Format xmlns="syncml:metinf">int</Format>
      </Meta>
      <Data>5</Data>
    </Item>
  </Replace>
  <Replace>
    <Item>
      <Target>
        <LocURI>./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineForQualityUpdates</LocURI>
      </Target>
      <Meta>
        <Type xmlns="syncml:metinf">text/plain</Type>
        <Format xmlns="syncml:metinf">int</Format>
      </Meta>
      <Data>3</Data>
    </Item>
  </Replace>
  <Replace>
    <Item>
      <Target>
        <LocURI>./Device/Vendor/MSFT/Policy/Config/Update/ConfigureDeadlineGracePeriod</LocURI>
      </Target>
      <Meta>
        <Type xmlns="syncml:metinf">text/plain</Type>
        <Format xmlns="syncml:metinf">int</Format>
      </Meta>
      <Data>2</Data>
    </Item>
  </Replace>
</Atomic>

See Microsoft's Update CSP documentation for all available settings.

Apple (macOS, iOS, and iPadOS) end user experience

On macOS hosts, when a minimum version is enforced, end users see a native macOS notification (DDM) once per day. Users can choose to update ahead of the deadline or schedule it for that night. 24 hours before the deadline, the notification appears hourly and ignores Do Not Disturb. One hour before the deadline, the notification appears every 30 minutes and then every 10 minutes.

Certain user preferences may suppress macOS update notifications. To prevent users from being surprised by a forced update or unexpected restart, consider communicating OS update deadlines through additional channels.

On iOS and iPadOS hosts, end users will see a notification in their Notification Center after the deadline. They can’t use their iPhone or iPad until the OS update is installed.

If the host was turned off when the deadline passed, the update will be scheduled an hour after it’s turned on.

If you set a past date (ex. yesterday) as the deadline, the end user will immediately be prompted to install the update. If they don't, the update will automatically install in one hour. Similarly, if you set the deadline to today, end users will experience the same behavior if it's after 12 PM (end user local time).

Update new hosts to latest

You can require hosts that automatically enroll via ADE to update to the latest version before they enroll to Fleet (during Setup Assistant).

For macOS hosts, in Fleet, head to Controls > OS updates and check the Update new hosts to latest checkbox.

If Update new hosts to latest is checked, hosts below the minimum version are updated to the latest version during Setup Assistant. If a minimum version isn’t set, all hosts get updated.

For iOS/iPadOS hosts, set a minimum version and deadline. New iOS/iPadOS hosts will always update to the latest version (not the minimum version specified). On already enrolled hosts, updates are only enforced if the host is below the minimum version.

Rarely, even without OS updates configured, macOS, iOS and iPadOS hosts enrolling via ADE may automatically update during enrollment. This happens when Apple determines the OS version the host is running has a critical bug that may impair MDM enrollment or management. This behavior cannot be controlled by Fleet.

Windows

End users are encouraged to update Windows via the native Windows dialog.

	Before deadline	Past deadline
End user can defer automatic restart	✅	❌

If an end user was on vacation when the deadline passed, the end user is given a grace period (configured) before the host automatically restarts.

Fleet enforces OS updates for quality and feature updates. Microsoft provides documentation on types of Windows updates.