Creating a DDM OS Update Policy

This topic describes how to create a DDM OS Update Policy using the BigFix WebUI to manage operating system updates for macOS, iOS, or iPadOS devices.

Prerequisites

Ensure you have access to the BigFix WebUI and appropriate permissions to create and manage policies within your organization’s BigFix environment.

Procedure

  1. Log in to the BigFix WebUI.

  2. Navigate to Apps > MCM > Policies.

  3. Click Create Policy and select OS Update Policy from the list of available policy types.

  4. In the General Settings section, provide the following details:

    • Policy Name: Enter a clear, descriptive name (e.g., macOS Sonoma Mandatory Update).
    • Description: (Optional) Add a brief note explaining the purpose of the policy.
    • Target Platform: Select macOS, iOS, or iPadOS.
    • Site: Select the BigFix site where this policy should be stored.

  5. In the Update Settings section, configure your update preferences, including optional controls such as Update Details URL, Recommended Cadence, Software Update Notifications, and Background Security Improvement/Rollback controls.

    Specific OS Update Enforcement Settings
    • Target OS Version / Target Build Version: Specifies the exact OS version (e.g., 26.7) or build version to be installed. Supports iOS/iPadOS version 17+ and macOS 14+.
    • Enforcement Date and Time (Deadline): Specifies the exact local date and time by which the target version must be installed.
    Advanced Software Settings
    • Automatic Actions: Controls whether system OS updates and security updates are allowed, automatically downloaded, or automatically installed (options: Allow, Always On, Always Off).
    • Recommended Cadence: Configures which updates to display to the device user (options: Show all updates, show only oldest updates, or show only newest updates).
    • Notifications: Option to toggle notifications on or off to inform the user about pending updates.
    • Beta Program Enrollment: Controls whether the device is allowed or forced to enroll in Apple beta testing programs (options: Allow, Always On, Always Off).
    • Deferral Period (Combined Defer Days): Specifies the number of days a newly released Apple OS update should be delayed before being offered to the user (configurable from 1 to 90 days).
    • Rapid Security Response: Enables or disables rapid security response patches and provides options to roll back applied security responses.
    Mandatory Settings & Behavioral Hierarchy
    • Mandatory Setting: If any Target OS Version is provided, the Enforcement Date and Time (deadline) is strictly mandatory. The policy will fail to save without it.
    • Setting Hierarchy (Specific vs. Deferral): If both a Specific Update Enforcement deadline and a Deferral Period (combined defer days) are defined, the Specific Enforcement takes priority. The device will forcefully install the update at the specific deadline regardless of the deferral days set. The deferral period only applies if no specific enforcement deadline is provided.
    • Target OS Version: Enter the specific numeric OS release version to enforce (e.g., 14.5).
      Note: Leaving this field blank does not automatically target or select the latest available OS.
    • Target Build Version: (Optional) Specify an exact build string if required by your organization.
    • Update Deadline: Set the date and time by which the device must complete the update.
    • Deferral Period (Days): Enter the number of days (0–90) users can delay seeing update notifications.
    • Automatic Download: Turn on to let devices download updates automatically in the background.
    • Automatic Installation: Turn on to install updates automatically when the device is idle.
    • Allow Standard User OS Updates (macOS only): Turn on to allow non-administrator users to start OS updates.
    • Rapid Security Response (RSR): Turn on to automatically apply urgent Apple security patches between major releases.

  6. Click Save to create the OS Update Policy.

Result

The OS Update Policy is now created and will be enforced on the targeted devices according to the specified settings.

Tips

  • Use descriptive policy names to easily identify the purpose and scope of each policy.
  • Review update deadlines and deferral periods to balance user flexibility with organizational security requirements.
  • Enable Rapid Security Response to ensure devices receive critical security patches promptly.