Plan macOS updates and check they're installed
A macOS update can stop a VPN client or a printer driver from working. It can also sit unfinished on a Mac that never gets restarted. To avoid both, test the apps people rely on, set a deadline everyone knows about, and check afterwards which Macs installed the update. Use the current Apple update controls your MDM supports.
In short
- Test on Macs that cover your critical apps and hardware before everyone gets the update.
- Warn people about the forced restart before the deadline, so they save their work first.
- After the deadline, check which Macs installed the update and follow up on the rest.
Treat updates and upgrades differently
A major macOS upgrade can change how apps behave and how people work, so give it time for testing. A security update may need to go out faster. Before you set a deadline, read Apple's security notes for the release and check which versions your app vendors support.
Deferral and enforcement are separate controls. A deferral holds an update back for a set number of days. Enforcement tells Macs to install a specific version by a date and time you choose.
Choose test groups that cover your setup
Build your test group from Macs that run your critical apps. Include each hardware model you use, and each way your staff sign in and connect to the network. On those Macs, check the VPN, the endpoint protection, the printers and the work people have to be able to finish. Before the update goes to more Macs, agree what happens when something fails. That way a problem stays in the test group.
Size each group by what it covers and by how many support calls your team can handle at once. A fixed percentage of the fleet can miss the setup that breaks.
Set a clear deadline
Use declarative software update enforcement where your OS versions and your MDM support it. Apple applies the deadline in each device's local time zone. Tell people in advance that their Mac will restart, and how to get help.
On a Mac, enforcement can quit open apps and restart the device. Test what people see when that happens, and ask them to save their work first. Check power, free disk space and update authorisation too. A Mac that's missing any of them may not finish in time.
Handle Background Security Improvements separately
Apple's current guidance covers Background Security Improvements and the settings that decide whether they install automatically. Older articles may still talk about Rapid Security Responses. Use the settings that match the OS versions you run.
Background Security Improvements only apply to the latest minor OS version. A Mac that hasn't installed that version doesn't get them, so deferring the version can also delay the improvement. Keep that in mind when you set deferrals.
Check the results and track exceptions
After the deadline, look at the macOS version and install status each Mac reports. Look into every Mac that is still waiting for a download, more free space or power, or for someone to enter their password. Check when a Mac last contacted the MDM before you trust its status.
Record every exception with an owner and an end date. Without them, it's hard to work out later why a Mac was left behind. Before you rely on a rollback, test how you would recover a Mac. Going back to the previous macOS version may not be possible as a simple downgrade.
Our first questions are how your Macs get updated today and which apps your people can't work without. From there, we can help you test the update policy and keep it working.
Get new articles by email
Related articles
A practical security baseline for Apple devices
A security baseline starts with the data and the accounts you need to protect. It holds up only when you've checked each control on the devices themselves and know what to do when one fails.
Operating a large Mac fleet
A large Mac fleet needs work that runs the same way every time, and failures that show up where someone will see them. Start from the setup you have today, then test how enrolment, updates and support hold up with many more devices.
How to compare Apple MDM platforms
Vendor websites help you draw up a shortlist. To choose from it, run the same everyday tasks on a test device on every platform and see how much work each one leaves for your team.
