> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure Managed OS for macOS
> Configure the macOS Managed OS Library Item in Iru Endpoint with rolling enforcement, minimum version, specific version, installation method, and updates.
This guide applies to Mac computers
Deploying and enforcing a macOS version is as easy as adding Managed OS for macOS to your Library and assigning it to an Assignment Map. To configure it, follow the steps below.
### About Managed OS for macOS
Managed OS for macOS deploys and enforces macOS updates across your fleet of Mac computers via [Declarative Device Management (DDM)](/en/endpoint/library/managed-os/declarative-device-management-and-managed-os). You can offer major macOS upgrades **on-demand from Self Service** or have them enforced automatically. When you configure Managed OS, Iru declares the required macOS version and deadline; macOS handles download, caching, notifications, and installation. Iru handles:
* **Update detection**: Iru monitors for available macOS updates from Apple
* **Download and caching**: Updates are automatically downloaded and cached on devices
* **User notification**: Users are notified of pending updates with enforcement deadlines
* **Automatic installation**: Updates are installed according to your configured schedule
* **Compliance monitoring**: Iru tracks which devices have successfully updated
For how **Rolling enforcement** calculates the floor, how **Enforce a Specific Version** differs from **Manually Enforce Minimum Version**, notifications, and [first-time fleet enforcement recommendations](/en/endpoint/library/managed-os/understanding-managed-os-for-apple-platforms#recommendations), see [Understanding Managed OS for Apple Platforms](/en/endpoint/library/managed-os/understanding-managed-os-for-apple-platforms).
### Enabling Managed OS for macOS in your Library
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.
#### Enabling Multiple Managed OS Library Items
When using Iru Endpoint, you can add the same Managed OS version to your Library multiple times. This is helpful when configuring different settings for various Blueprints or creating distinct update settings for nodes in an Assignment Map. To differentiate between these copies, you can use labels. See [Library Item Labels](/en/endpoint/library/library-items-profiles/library-overview#library-item-labels) in Library Overview for steps.
### Configuring Managed OS for macOS
Managed OS for macOS is not compatible with blocking the Software Update System Settings pane via any method, and doing so can produce unexpected behavior.
Add a **Label** to easily identify this instance of Managed OS for macOS in your Library. While these labels won't be visible to end users, they will appear throughout the Iru Endpoint Web App. See [Library Item Labels](/en/endpoint/library/library-items-profiles/library-overview#library-item-labels) in Library Overview for steps.
Assign to your desired [Blueprints](/en/endpoint/getting-started/blueprints-and-library/configuring-blueprints).
Under **Upgrades**, configure the way upgrade installations of this major version of macOS should be enforced:
* **Continuously Enforce** will automatically initiate an upgrade on older versions of macOS, or users can upgrade on their own if they choose to
* **Install on-demand from Self Service**. This option can easily be differentiated between Blueprints by making additional copies of the same Managed OS for macOS
When **Continuously Enforce** is selected, set a separate **Enforcement Deadline** and **Enforcement Time** for upgrades under **Upgrades**. Update enforcement under **Updates** uses its own schedule, so the same Library Item can enforce minor updates and major upgrades on different timelines. Devices on an older major macOS version are no longer treated as out of date for updates and forced to upgrade as soon as the Library Item is scoped.
Which macOS version a Mac receives when it updates depends on your Version Enforcement option under **Updates** (see **Configure Version Enforcement** below). **Rolling enforcement** and **Manually Enforce Minimum Version** install the latest Iru-approved update for the selected major version; **Enforce a Specific Version** enforces the macOS version you select.
Under **Updates**, select an option for Version Enforcement. Available options include the following:
#### Do Not Manage
This option will not manage macOS updates. It cannot be selected if you've chosen to **Continuously Enforce** upgrades, as **Upgrades** also determines the schedule and conditions for upgrading.
#### Rolling enforcement
Select **Within** (1 day, 2 days, 1 week, 2 weeks, 3 weeks, 1 month, 2 months, or 3 months) **of release** and **at** a time for enforcement.
#### Manually Enforce Minimum Version
Specify the minimum macOS version a Mac should be running and the **Enforcement Deadline** date by which users must update. No updates will be enforced if a Mac is already running a macOS version greater than the specified minimum. You will also select an **Enforcement Time**.
#### Enforce a Specific Version
Uses the same version selection dropdown and enforcement scheduling fields as **Manually Enforce Minimum Version**—select a **Specific version**, an **Enforcement Deadline** (**on**), and an **Enforcement Time** (**at**). Unlike **Manually Enforce Minimum Version**, this option enforces that exact macOS version rather than a minimum floor.
To enforce an Apple beta build, select **This is a beta version**, choose a **Seed Token** synced from Apple to Iru, then enter the beta version and build. Iru applies two declarations to the device in order: **Software Update Settings** (to enroll the device in the beta program), then **Software Update Enforcement** (to the specified version). For example, to test a beta upgrade to the next major macOS release, use a macOS Tahoe Managed OS Library Item, select a macOS Golden Gate seed token, and enter the target major version (such as `27.0`) and the current AppleSeed beta build.
The **Seed Token** list can be long and difficult to navigate.
For how each Version Enforcement option behaves after you save—including floors and user notifications—see [Version Enforcement option behavior](/en/endpoint/library/managed-os/understanding-managed-os-for-apple-platforms#version-enforcement) in **Understanding Managed OS for Apple Platforms**.
Under **Background Security Improvements Enforcement**, choose whether to automatically enforce these updates when Apple makes them available. Options:
* **None**: Background Security Improvements will not be enforced.
* **Automatically enforce**: Choose the enforcement timeframe and local time for enforcement.
Select an **Enforcement timeframe for Background Security Improvements.**
Select an **Enforcement Time**, the time of day Background Security Improvements are enforced in the device's local time zone.
Click **Save** in the bottom right corner.
Background Security Improvements apply only to Mac computers on the latest macOS version; users must be on the latest macOS before these updates can be enforced. Background Security Improvements use [Declarative Device Management](/en/endpoint/library/managed-os/declarative-device-management-and-managed-os) for enforcement.
### Related Articles
Understand how Managed OS works with DDM and macOS when troubleshooting updates
Understand how Managed OS enforcement works on Apple devices
Understand compatibility and installation mechanisms for Managed OS on macOS
About Apple DDM and Managed OS in Iru Endpoint
What to expect when using Managed OS on Mac computers
Compare different OS update management strategies
Configure OS update delays and enforcement policies
Manage Windows Update settings and the end-user update experience on Windows devices