Skip to main content
This guide applies to iOS devices, iPadOS devices, and Apple TV
This Library Item requires supervision.
Keeping the operating systems of a fleet of Apple devices up to date can be a lot of work if done interactively. Managed OS allows you to automate this work on your supervised devices without the need to send multiple MDM commands and prompts to users manually. Add Managed OS for iOS, iPadOS, and tvOS, and Iru Endpoint will take care of the rest.

​
About Managed OS for iOS, iPadOS, and tvOS

Managed OS for iOS, iPadOS, and tvOS deploys and enforces OS updates across your fleet of supervised Apple mobile and TV devices. Updates are delivered through Declarative Device Management (DDM). Iru handles:

Update detection

Iru monitors for available OS updates from Apple.

Download and caching

Updates are automatically downloaded and cached on devices.

User notification

Users are notified of pending updates with enforcement deadlines.

Automatic installation

Updates are installed according to your configured schedule.

Compliance monitoring

Iru tracks which devices have successfully updated.
For how Rolling enforcement calculates the floor, how Enforce a specific version differs from Manually enforce a minimum version, phased rollout, notifications, and first-time fleet enforcement recommendations, see Understanding Managed OS for Apple Platforms.

​
Adding Managed OS to your Library

Add the Library Item for the release you want to manage, such as iOS 26 or iOS 27, iPadOS 26 or iPadOS 27, or tvOS 26 or tvOS 27. To add it to your Iru Endpoint Library, follow the steps outlined in the Library Overview article. When you select Add Library Item, choose that release.

​
Adding multiple Managed OS Library Items

Iru Endpoint supports adding the same Managed OS version to your Library multiple times. This is useful when you want different settings for different Blueprints. For example, you can have Managed OS update devices automatically 1 week after Apple releases an update in one Blueprint, and up to 3 months after the release in another. To differentiate between these copies, you can use labels. See Library Item Labels in Library Overview for steps.

​
Configuring Managed OS for iOS, iPadOS, and tvOS

​
General

Use General to name this Library Item and assign it to Blueprints.
1

Enter a Label

Enter a Label to help differentiate this instance of Managed OS from others in your Library. These labels are not visible to end users, but are displayed throughout the Iru Endpoint Web App. See Library Item Labels in Library Overview for steps.
2

Assign to Blueprints

Assign to your desired Blueprints.

​
Updates

Use Updates to configure version enforcement for iOS, iPadOS, and tvOS.
1

Choose a Version Enforcement option

Under Updates, choose one of the following from the Version enforcement drop-down menu:
  • Do not manage updates does not manage OS updates.
  • Enforce a specific version enforces the exact OS version and deadline you specify.
  • Rolling enforcement automatically calculates the minimum required version based on when Apple released each update.
  • Manually enforce a minimum version enforces the minimum version and deadline you specify.
Managed OS Version Enforcement options
2

Configure Rolling enforcement

If you selected Rolling enforcement, choose when to enforce updates.
  1. Select Within (1 day, 2 days, 1 week, 2 weeks, 3 weeks, 1 month, 2 months, or 3 months) of release and at a time for enforcement.
  2. Optionally, set Delay enforcement by to a number of days (up to 90). This delays when Iru sends the target-version declaration without changing the enforcement date. Use it to temporarily hold back the newest available version while still using Rolling enforcement.
  3. Optionally, to hide the new version from users for the same period, set a matching deferral in a Software Update Library Item. If Delay enforcement by is shorter than that deferral, Managed OS still overrides the deferral once its declaration is sent.
For full behavior, see Rolling enforcement in Understanding Managed OS for Apple Platforms. Optionally, select Enable phased rollout. See Configure a phased rollout for details.
Managed OS for iOS, iPadOS, and tvOS Rolling enforcement Within and at settings
3

Review the enforcement timeline

With Rolling enforcement enabled, Timeline preview shows when versions are delayed, targeted, required, and past due. See Enforcement timeline for details.
4

Configure a minimum version

If you selected Manually enforce a minimum version:
  1. Specify the Minimum Version a device should be running, the Enforcement Deadline by which users must update, and an Enforcement Time. No updates are enforced if a device is already running an OS version later than the specified minimum.
  2. Optionally select the Enable phased rollout checkbox, then enter the number of hours in the Rollout window field (24–168). See Configure a phased rollout for details.
Managed OS for iOS, iPadOS, and tvOS Manually enforce a minimum version settings
5

Configure a specific version

If you selected Enforce a specific version:
  1. Select a Specific version, an Enforcement Deadline (on), and an Enforcement Time (at). This option enforces that exact OS version rather than a minimum.
  2. Optionally, select Enable phased rollout. See Configure a phased rollout for details.
  3. To enforce an Apple beta build, select This is a beta version, choose a Seed Token synced from Apple to Iru, then enter the beta version and build. Iru applies Software Update Settings (beta enrollment) and then Software Update Enforcement (to the specified version) as separate declarations.
  4. If you use Managed OS for beta enrollment and version enforcement, set Beta program enrollment in any Software Update Library Item on the same Blueprint to Not configured. For opt-in beta enrollment or enrollment without a required version, see Testing Apple Beta Releases.
The Seed Token list can be long and difficult to navigate.
Managed OS for iOS, iPadOS, and tvOS Enforce a specific version settings
For how each Version Enforcement option behaves after you save, including floors, phased rollout, and user notifications, see Version Enforcement option behavior in Understanding Managed OS for Apple Platforms. The Library Item Status tab shows when each device becomes eligible under phased rollout.

​
Configure a phased rollout

Optionally select the Enable phased rollout checkbox, then enter the number of hours in the Rollout window field (24–168).
  • For Rolling enforcement, after any Delay enforcement by period ends, or immediately if no delay is set, declaration issuance for a new Apple release is spread across that window.
  • For Manually enforce a minimum version, declaration issuance is staggered from Library Item save (on first create, or when OS version settings or the date and time change) and again when Apple releases a new version.
  • For Enforce a specific version, when you save after creating the item, or after changing OS version settings or the enforcement date or time, declaration issuance is spread across that window from Library Item save.
The enforcement deadline does not change. See Phased rollout.

​
Enforcement timeline

Timeline preview shows when versions are delayed, targeted, required, and past due, based on your enforcement settings. Each version appears on its own row. Months and days run across the top, and markers show a release, the target version, the minimum required version, when a version is required, and when an update is past due. Hover the pointer over any item in the timeline for more details about that item. The legend includes Delayed, Target version, Minimum required version, and Update past due. Hover the pointer over the information icon next to Timeline preview to see the full legend.
  • Delayed: The version has been released by Apple, but initial declarations are withheld from devices until the delay configured in this Library Item expires.
  • Target version: The version available for install. Devices that update are taken to this version. Devices running this version or the minimum required version are in Pass status.
  • Minimum required version: The minimum version a device can be running to be in Pass status.
  • Update past due: Devices still on this version are forced to update to the new version. If a device is not updated after an extended time, check it manually. An operating system issue can prevent the update from installing.
Select View today at the top right of the timeline to move it back to today. Timeframes in Timeline preview use the device’s local time zone. Actual dates may vary by time zone. Background Security Improvements are not shown on the timeline.

​
Background Security Improvements Enforcement

1

Configure Background Security Improvements Enforcement

Under Background Security Improvements Enforcement, choose whether to automatically enforce these updates when Apple makes them available. Options:
  • None: Background Security Improvements will not be enforced.
  • Automatically enforce: Choose the enforcement timeframe and local time for enforcement.
2

Set Background Security Improvements Enforcement Timeframe

Select an Enforcement timeframe for Background Security Improvements.
3

Configure Background Security Improvements Enforcement Time

Select an Enforcement Time, the time of day Background Security Improvements are enforced in the device’s local time zone.
4

Save the configuration

Select Save in the bottom right corner.
Background Security Improvements apply only to devices on the latest OS version; users must be on the latest OS before these updates can be enforced. Background Security Improvements use Declarative Device Management for enforcement. Automatically enforce under Background Security Improvements is separate from Rolling enforcement under Updates → Version Enforcement.

​
Passcode Considerations

At the enforcement deadline, on iOS and iPadOS devices with a passcode, the security architecture of iOS and iPadOS requires users to be prompted for the update and to enter their passcodes. On tvOS, and on iOS and iPadOS devices without passcodes, updates will be cached by Iru Endpoint and the update will be applied without user intervention at the enforcement deadline. For more details, see User Experience with Managed OS for iOS, iPadOS, and tvOS.

Understanding Managed OS for Apple Platforms

Understand how Managed OS enforcement works on Apple devices

User Experience with Managed OS for iOS, iPadOS and tvOS

What to expect when Managed OS updates run on your device

Declarative Device Management and Managed OS

About Apple DDM and Managed OS in Iru Endpoint

OS Update Strategies: OS Deferral Restriction and Managed OS

Compare different OS update management strategies

Delay and Enforce OS Updates

Configure OS update delays and enforcement policies