> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Delay and Enforce OS Updates

> Configure OS update delays and enforcement deadlines for managed Apple devices in Iru Endpoint. Defer updates and set mandatory installation windows.

<Callout icon="apple" color="#B84A7A" iconType="regular">This guide applies to Apple devices</Callout>

### About OS Update Delay and Enforcement

To maintain a consistent software update schema across your organization, you can defer software updates and choose when they'll automatically be installed. There are two places you'll want to configure this: Software Update profile and Apple Restrictions profile from within your Library.

### How It Works

Iru Endpoint provides flexible options for managing OS updates:

* **Delay periods** - Configure how long to wait before enforcing updates
* **Enforcement policies** - Set automatic or manual enforcement rules
* **User notifications** - Keep users informed about pending updates
* **Compliance tracking** - Monitor which devices have successfully updated

### Software Update Library Item

You can use the Software Update Library Item to manage downloading, installing, and deferring updates. This is a great way to make sure that, at minimum, security updates are being automatically installed on all of your devices.

<Note>
  The Software Update Library Item is supported on macOS, iOS 18.0+, iPadOS 18.0+, tvOS 18.4+, and visionOS 26+.
</Note>

### Create a Software Update Library Item

To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.

### Configure the Software Update Library Item

<Steps>
  <Step title="Name the profile">
    Give your software update profile a **Name**.
  </Step>

  <Step title="Assign to Blueprints">
    Assign to your desired [Blueprints](/en/endpoint/getting-started/blueprints-and-library/configuring-blueprints).
  </Step>

  <Step title="Configure automatic updates">
    Select your desired settings for **Automatic Updates**.
  </Step>

  <Step title="Configure Software Update Deferrals">
    Under **Software Update Deferrals**, in the **iPhone, iPad, Apple TV, Vision only settings** section, check **Defer updates**.
  </Step>

  <Step title="Set deferral period">
    Set **Defer for** to the number of days (1–90).
  </Step>

  <Step title="Set recommended cadence">
    Set **Recommended cadence** to **All**, **Oldest**, or **Newest** to specify how software updates are shown to the user.
  </Step>

  <Step title="Configure macOS deferrals">
    Under **Mac only settings**, select **Defer macOS updates by type** from the dropdown.
  </Step>

  <Step title="Set deferrals for each macOS update type">
    For each option you enable, set **Defer for** to the number of days (1–90):

    * **Defer major macOS upgrades**: Delays software upgrades on the device; upgrades appear only after the specified delay following release.
    * **Defer minor macOS upgrades**: Delays software updates only (not upgrades or Rapid Security Response); updates appear only after the specified delay following release.
    * **Defer other system updates**: Delays non-operating system updates; they appear only after the specified delay following release.
  </Step>

  <Step title="Configure beta program enrollment (Optional)">
    Under **Other**, in **iPhone, iPad, Mac only settings**, set **Beta program enrollment**:

    * **Not configured**: Do not manage beta enrollment from this Library Item. Use this when [Managed OS](/en/endpoint/library/managed-os/understanding-managed-os-for-apple-platforms#enforce-a-specific-version) or [ADE](/en/endpoint/enrollment/apple/configuring-apple-enrollment#require-minimum-os-version) handles beta enrollment and version enforcement.
    * **Disallow**: Prevent users from enrolling in beta programs from Software Update settings. See [Restrict Access to Beta OS Releases](/en/endpoint/devices/device-configurations/apple/restrict-access-to-beta-os-releases).
    * **Offer**: Present one or more beta programs so users can opt in on the device.
    * **Enforce**: Enroll the device in a selected beta program without requiring a specific beta OS version. To enforce a specific beta *version*, keep this setting as **Not configured** and use Managed OS.

    **Offer** and **Enforce** are supported on **macOS 15.4+** and **iOS/iPadOS 18.0+**. When you choose **Offer** or **Enforce**, select the **Beta programs** to apply. See [Testing Apple Beta Releases](/en/endpoint/devices/device-configurations/apple/testing-apple-beta-releases#ways-to-manage-apple-beta-program-enrollment) for which option to use.
  </Step>

  <Step title="Save the configuration">
    Click **Save** in the bottom right corner.
  </Step>
</Steps>

### Apple Restrictions Library Item

<Note>
  The **Defer software updates** section in the **Apple Restrictions Library Item** is deprecated as of iOS 27, iPadOS 27, tvOS 27, and macOS 27. Use the Software Update Library Item instead.
</Note>

Under **OS Updates** in the Apple Restrictions Library Item, the **Defer software updates** option delays user visibility of software updates for a specified number of days (up to 90). iPhone and iPad devices require Supervision.

For Mac computers, Iru Endpoint recommends using a Software Update Library Item and deferring updates by specific types. For step-by-step configuration, see the [Configure the Software Update Library Item](#configure-the-software-update-library-item) section above.

### Block Beta & Standard Upgrades

The native options for blocking beta updates are also enabled using the **Software Update** Library Item in your Blueprints. Set **Beta program enrollment** to **Disallow**, or see [Restrict Access to Beta OS Releases](/en/endpoint/devices/device-configurations/apple/restrict-access-to-beta-os-releases).

Due to this change, the [App Blocking Library Item](/en/endpoint/library/library-items-profiles/configure-the-app-blocking-library-item) can't block these upgrades. The only circumstance when the App Blocking Library Item will block the update is when it's downloaded from the Mac App Store. Learn more about [Restricting Access to Beta OS Releases](/en/endpoint/devices/device-configurations/apple/restrict-access-to-beta-os-releases).

The following examples are specific to macOS Sonoma, macOS Sequoia, and macOS Tahoe. For each release, you'll need to update each setting with the relevant info specific to that release. This will only block the installer if it's downloaded from the App Store and won't block the update in Software Update.

**Tahoe - Public Release**

* **Process name**: Install macOS Tahoe
  * **Match Type**: Contains
* **Path**: /Applications/Install macOS Tahoe.app
  * **Match Type**: Contains
* **Bundle ID**: com.apple.InstallAssistant.macOSTahoe
  * **Match Type**: Exact

**Sequoia - Public Release**

* **Process name**: Install macOS Sequoia
  * **Match Type**: Contains
* **Path**: /Applications/Install macOS Sequoia.app
  * **Match Type**: Contains
* **Bundle ID**: com.apple.InstallAssistant.macOSSequoia
  * **Match Type**: Exact

**Sonoma - Public Release**

* **Process name**: Install macOS Sonoma
  * **Match Type**: Contains
* **Path**: /Applications/Install macOS Sonoma.app
  * **Match Type**: Contains
* **Bundle ID**: com.apple.InstallAssistant.macOSSonoma
  * **Match Type**: Exact

### Related Articles

<CardGroup cols={2}>
  <Card title="Testing Apple Beta Releases" icon="flask" href="/en/endpoint/devices/device-configurations/apple/testing-apple-beta-releases">
    Choose ADE, Managed OS, or Software Update for Apple beta enrollment
  </Card>

  <Card title="OS Update Strategies: OS Deferral Restriction and Managed OS" icon="clock" href="/en/endpoint/devices/device-configurations/apple/os-update-strategies-os-deferral-restriction-and-managed-os">
    Compare different OS update management strategies
  </Card>

  <Card title="Restrict Access to Beta OS Releases" icon="lock" href="/en/endpoint/devices/device-configurations/apple/restrict-access-to-beta-os-releases">
    Prevent users from installing beta OS releases
  </Card>

  <Card title="Configure Managed OS for macOS" icon="apple" href="/en/endpoint/library/managed-os/configure-managed-os-for-macos">
    Configure managed OS updates for Mac computers
  </Card>

  <Card title="Configure Managed OS for iOS, iPadOS and tvOS" icon="mobile" href="/en/endpoint/library/managed-os/configure-managed-os-for-ios-ipados-and-tvos">
    Configure managed OS updates for iOS, iPadOS, and tvOS devices
  </Card>
</CardGroup>