Streamlining macOS Patch Management with Update Rings via Intune DDM policies

Windows Update for Business uses update rings to test and gradually roll-out updates, supporting an automated patching process aligned with the Evergreen IT approach. Historically, patching macOS devices has been more challenging. However, with the introduction of Declarative Device Management, macOS and Microsoft Intune offer new capabilities for scheduling update installations. The goal is to segment users into "Insider/Beta", "Pilot" and "Broad" groups for a controlled roll-out.

Declarative Device Management (DDM)

DDM is a modern approach to manage devices where the desired state of a device is defined and communicated to it. Consequently, the device itself is responsible for achieving and maintaining that state. In short: This reduces the communication load between Intune and macOS via giving the device more "intelligence". Intune offers several settings via this modern way:

Software Update policies

For managing Software Updates, we will use the new DDM policies. So, old profiles/settings like the following are not needed any more:

• Intune > Devices > macOS > macOS updates

• Intune > Settings catalog > Software Update

• Intune > Templates > Software updates

The new settings are offered via Settings catalog under category "Declarative Device Management (DDM):

• Software Update Settings

  • General settings like allowing Beta program enrolment, enablement of Notifications, Deferrals and Rapid Security Response settings.

• Enforce Latest Software Update Version

  • Updates devices to the latest version with a defined installation deadline.

• Software Update

  • Pin devices to a specific OS version with a defined installation deadline.

In addition, DDM policies take precedence over legacy update configurations.

Update rings

For implementing different "rings", we will split our users into three groups:

• Insider/Beta: can opt-in and test Beta releases

• Pilot: receive the current version directly after release

• Broad: receive the current version after testing with pilot group

Update ring concept for macOS with Beta, Pilot and Broad

Intune Configuration

General update settings

Our first policy will contain general update settings like allowing standard users to install updates, activation of automatic update downloads and enablement of Rapid Security Responses:

• macOS - Default - Software Update - Settings

  • assigned to: All devices

  • Software Update Settings

    • Allow Standard User OS Updates: Allowed

    • Automatic Actions:

      • Download: AlwaysOn

      • Install OS Updates: Allowed

      • Install Security Update: Allowed

    • Rapid Security Response:

      • Enable: Enabled

      • Enable Rollback: Disabled

    • Notifications: Enabled

  • Automatically Install App Updates: True

Beta policy

For allowing our "Insider/Beta" group of users the enrolment to Beta channel, we exclude them from the following policy (while simultaneously restricting access for all other users). Since the default is "allowing" the Beta program, we are good to go:

• macOS - Default - Software Update - Beta

  • assigned to: All users, exclude: Beta users group

  • Software Update Settings

    • Beta:

      • Program Enrollment: AlwaysOff

If desired, you could also consider creating an additional policy (scoped to the Beta users group) that sets "AlwaysOn" to enforce enrollment in the Beta program. In addition, you will need a token from Apple Business/School Manager.

Pilot policy

Out pilot users group should receive the latest version released by Apple directly:

• macOS - Default - Software Update - OS Version - Latest

  • assigned to: Pilot users group

  • Software Update Enforce Latest

    • Enforce Latest Software Update Version: True

      • Delay In Days: 3

      • Install Time: e.g.: 17:00

So, once an update has been release by Apple, they will get it pushed with a installation deadline of 3 days.

Note, that "Delay In Days" is not a deferral period for the latest update (naming is misleading here). It is a "deadline for installation". Also note that the deadline is calculated based on the policy application date, not the Apple update release date. If a device remains offline for several days, the deadline will be extended.

Broad policy

You might think about using "Deferrals"... Wouldn't those settings be great for deferring updates for our broad users group?

Deferrals

The problem is that deferrals are overwritten by policies such as 'Software Update' or 'Enforce Latest Software Update Version'. As a result, the specified or latest version is offered immediately, bypassing any configured deferral period.

What about just using "Deferrals" for our broad ring? The downside is that we'd lose the ability to set an installation deadline

So, our broad users group will receive the desired OS version via this policy:

• macOS - Default - Software Update - OS Version - Broad

  • assigned to: All users, exclude: Pilot users group

  • Software Update

    • Target OS Version: e.g. 15.5

    • Target Date Time: e.g.: xx/xx/xxxx, 17:00

Since, we cannot combine "Software Update Enforce Latest" with a deferral, we have to specify and update the desired version for our broad ring manually.

Hopefully, Microsoft will introduce a deferral option for "Software Update Enforce Latest" policy in future. This would enable a fully automated process without touching the OS version manually (e.g.: pilot policy with 0 days deferral, broad policy with 5 days deferral).

If desired, the broad ring can even be divided into multiple ones to achieve a more gradual rollout: Split this policy into multiple policies with different broad groups and adjust the target OS version step-by-step.

Update release flow

Admin

• group your users into:

  • Beta users group

  • Pilot users group

  • all other users will automatically be in the broad ring

• inform Beta users to opt-in for Beta program and test those versions

• pilot users will automatically get the current version on the release day with enforcement after 3 days

  • if no issues occur: update the broad policy to the latest version after, for example, a 5-day delay

  • if issues occur: leave broad policy untouched until issues are resolved

End user experience

Users will automatically be informed via notifications. First one will appear once the update policy has been applied and an update is scheduled (displaying the deadline):

First notification: Update planned

If the update installation reaches the deadline, users will see a countdown before the enforced restart:

Second notification: Restart countdown

If the deadline has been exceeded (e.g.: device turned off), it will try again on regular basis.

Policy download

Download the described policies as JSON to easily import them into Intune:

Available on GitHub