Skip to main content
This guide applies to Mac computers
Deploying and enforcing a macOS version is as easy as adding the Managed OS Library Item for that release to your Library and assigning it to an Assignment Map. To configure it, follow the steps below.

​
About Managed OS for macOS

Managed OS for macOS deploys and enforces macOS updates across your fleet of Mac computers via Declarative Device Management (DDM). You can offer major macOS upgrades on-demand from Self Service or have them enforced automatically. When you configure Managed OS, Iru declares the required macOS version and deadline; macOS handles download, caching, notifications, and installation. Iru handles:

Update detection

Iru monitors for available macOS updates from Apple.

Download and caching

Updates are automatically downloaded and cached on devices.

User notification

Users are notified of pending updates with enforcement deadlines.

Automatic installation

Updates are installed according to your configured schedule.

Compliance monitoring

Iru tracks which devices have successfully updated.
For how Rolling enforcement calculates the floor, how Enforce a specific version differs from Manually enforce a minimum version, phased rollout, notifications, and first-time fleet enforcement recommendations, see Understanding Managed OS for Apple Platforms.

​
Adding Managed OS for macOS to your Library

Add the Library Item for the macOS release you want to manage, such as macOS 26 Tahoe or macOS 27 Golden Gate. To add it to your Iru Endpoint Library, follow the steps outlined in the Library Overview article. When you select Add Library Item, choose that release.

​
Adding multiple Managed OS Library Items

When using Iru Endpoint, you can add the same Managed OS version to your Library multiple times. This is helpful when configuring different settings for various Blueprints or creating distinct update settings for nodes in an Assignment Map. To differentiate between these copies, you can use labels. See Library Item Labels in Library Overview for steps.
Managed OS for macOS is not compatible with blocking the Software Update System Settings pane via any method, and doing so can produce unexpected behavior.

​
Configuring Managed OS for macOS

​
General

Use General to name this Library Item and assign it to Blueprints.
1

Add Label

Add a Label to easily identify this instance of Managed OS for macOS in your Library. While these labels won’t be visible to end users, they will appear throughout the Iru Endpoint Web App. See Library Item Labels in Library Overview for steps.
2

Assign to Blueprints

Assign to your desired Blueprints.

​
Upgrades

Use Upgrades to configure how and when devices install this major version of macOS. Devices that upgrade receive the latest minor version available for that major version.
1

Choose an upgrade method

Under Upgrades, choose one of the following:
  • Upgrade automatically forces the device to upgrade either immediately after Library Item assignment or on a specified date and time.
  • Upgrade on demand from Self Service lets users upgrade through Self Service or Software Update with no enforced deadline. You can make additional copies of the Library Item to use different settings for different Blueprints.
2

Choose when to enforce the upgrade

If you selected Upgrade automatically, in the drop-down below it, choose Immediately or On. If On is selected, schedule a date and time.
The upgrade schedule under Upgrades is separate from update enforcement under Updates. This allows the same Library Item to enforce minor updates and major upgrades on different timelines.
3

Make the upgrade available in Self Service

If you selected Upgrade automatically, optionally turn on Available in Self Service so users can upgrade before the deadline.
Managed OS for macOS Upgrades method and enforcement timing
4

Choose a Self Service category

Choose a Self Service category, and select Recommended if the upgrade should appear in the Recommended section.
Managed OS for macOS Self Service category, Recommended, and Customize
5

Customize the Self Service item

Select Customize to change how the upgrade appears in Self Service. You can override the name, add a short description and a long description, and require users to read the description before installing.
Managed OS for macOS Self Service customization

​
Updates

Use Updates to configure minor-version enforcement for devices already running this major version of macOS.
1

Choose a Version Enforcement option

Under Updates, choose one of the following from the Version enforcement drop-down menu:
  • Do not manage updates does not manage macOS updates. You cannot select it when Upgrade automatically is selected because Upgrades also controls the upgrade schedule.
  • Enforce a specific version enforces the exact macOS version and deadline you specify.
  • Rolling enforcement automatically calculates the minimum required version based on when Apple released each update.
  • Manually enforce a minimum version enforces the minimum version and deadline you specify.
Managed OS for macOS Version Enforcement options
2

Configure Rolling enforcement

If you selected Rolling enforcement, choose when to enforce updates.
  1. Select Within (1 day, 2 days, 1 week, 2 weeks, 3 weeks, 1 month, 2 months, or 3 months) of release and at a time for enforcement.
  2. Optionally, set Delay enforcement by to a number of days (up to 90). This delays when Iru sends the target-version declaration without changing the enforcement date. Use it to temporarily hold back the newest available version while still using Rolling enforcement.
  3. Optionally, to hide the new version from users for the same period, set a matching deferral in a Software Update Library Item. If Delay enforcement by is shorter than that deferral, Managed OS still overrides the deferral once its declaration is sent.
For full behavior, see Rolling enforcement in Understanding Managed OS for Apple Platforms. Optionally, select Enable phased rollout. See Configure a phased rollout for details.
Managed OS for macOS Rolling enforcement Within and at settings
3

Review the enforcement timeline

With Rolling enforcement enabled, Timeline preview shows when versions are delayed, targeted, required, and past due. See Enforcement timeline for details.
4

Configure a minimum version

If you selected Manually enforce a minimum version:
  1. Choose the Minimum version, Enforcement deadline, and Enforcement time. Updates are not enforced on a Mac already running a version later than the specified minimum.
  2. Optionally select the Enable phased rollout checkbox, then enter the number of hours in the Rollout window field (24–168). See Configure a phased rollout for details.
Managed OS for macOS Manually enforce a minimum version settings
5

Configure a specific version

If you selected Enforce a specific version:
  1. Choose the Specific version, Enforcement deadline, and Enforcement time. This option enforces the exact macOS version instead of treating it as a minimum.
  2. Optionally, select Enable phased rollout. See Configure a phased rollout for details.
  3. To enforce an Apple beta build, select This is a beta version, choose a Seed Token synced from Apple to Iru, then enter the beta version and build. Iru applies two declarations to the device in order: Software Update Settings (to enroll the device in the beta program), then Software Update Enforcement (to the specified version). For example, to test a beta upgrade to the next major macOS release, use a macOS Tahoe Managed OS Library Item, select a macOS Golden Gate seed token, and enter the target major version (such as 27.0) and the current AppleSeed beta build.
  4. If you use Managed OS for beta enrollment and version enforcement, set Beta program enrollment in any Software Update Library Item on the same Blueprint to Not configured. For opt-in beta enrollment or enrollment without a required version, see Testing Apple Beta Releases.
The Seed Token list can be long and difficult to navigate.
Managed OS for macOS Enforce a specific version settings
For how each Version Enforcement option behaves after you save, including floors, phased rollout, and user notifications, see Version Enforcement option behavior in Understanding Managed OS for Apple Platforms. The Library Item Status tab shows when each device becomes eligible under phased rollout.

​
Configure a phased rollout

Optionally select the Enable phased rollout checkbox, then enter the number of hours in the Rollout window field (24–168).
  • For Rolling enforcement, when Apple releases a new version, declaration issuance starts after any Delay enforcement by period ends, or immediately if no delay is set.
  • For Manually enforce a minimum version, declaration issuance is staggered from Library Item save when you first create the item, or when you change OS version settings or the enforcement date or time, and again when Apple releases a new version.
  • For Enforce a specific version, declaration issuance is staggered from Library Item save when you first create the item, or when you change OS version settings or the enforcement date or time.
The enforcement deadline does not change. See Phased rollout.

​
Enforcement timeline

Timeline preview shows when versions are delayed, targeted, required, and past due, based on your enforcement settings. Each version appears on its own row. Months and days run across the top, and markers show events such as a release and the target version. Hover the pointer over any item in the timeline for more details about that item. The legend includes Delayed, Target version, Minimum required version, and Update past due. Hover the pointer over the information icon next to Timeline preview to see the full legend.
  • Delayed: The version has been released by Apple, but initial declarations are withheld from devices until the delay configured in this Library Item expires.
  • Target version: The version available for install. Devices that update are taken to this version. Devices running this version or the minimum required version are in Pass status.
  • Minimum required version: The minimum version a device can be running to be in Pass status.
  • Update past due: Devices still on this version are forced to update to the new version. If a device is not updated after an extended time, check it manually. An operating system issue can prevent the update from installing.
Select View today at the top right of the timeline to move it back to today. Timeframes in Timeline preview use the device’s local time zone. Actual dates may vary by time zone. Background Security Improvements are not shown on the timeline.

​
Background Security Improvements Enforcement

1

Configure Background Security Improvements Enforcement

Under Background Security Improvements Enforcement, choose whether to automatically enforce these updates when Apple makes them available. Options:
  • None: Background Security Improvements will not be enforced.
  • Automatically enforce: Choose the enforcement timeframe and local time for enforcement.
2

Set Background Security Improvements Enforcement Timeframe

Select an Enforcement timeframe for Background Security Improvements.
3

Configure Background Security Improvements Enforcement Time

Select an Enforcement Time, the time of day Background Security Improvements are enforced in the device’s local time zone.
4

Save the configuration

Select Save in the bottom right corner.
Background Security Improvements apply only to Mac computers on the latest macOS version; users must be on the latest macOS before these updates can be enforced. Background Security Improvements use Declarative Device Management for enforcement.

Understanding Issues with Managed OS for macOS

Understand how Managed OS works with DDM and macOS when troubleshooting updates

Understanding Managed OS for Apple Platforms

Understand how Managed OS enforcement works on Apple devices

Managed OS for macOS Compatibility and Installation Mechanisms

Understand compatibility and installation mechanisms for Managed OS on macOS

Declarative Device Management and Managed OS

About Apple DDM and Managed OS in Iru Endpoint

macOS Managed OS User Experience

What to expect when using Managed OS on Mac computers

OS Update Strategies: OS Deferral Restriction and Managed OS

Compare different OS update management strategies

Delay and Enforce OS Updates

Configure OS update delays and enforcement policies

Configure the Windows Update Library Item

Manage Windows Update settings and the end-user update experience on Windows computers