iOS 12 Updates on Managed Enterprise Devices

This article explores how Apple's iOS 12 manages automatic software updates across enterprise environments utilizing Mobile Device Management (MDM). It details how iOS 12 balances the user-facing automatic update feature with centralized administrative controls, focusing on update deferrals, supervised device restrictions, and remote deployment commands.

The Role of Supervised Mode

In iOS 12, robust control over system software updates requires devices to be in Supervised mode, typically achieved through Apple Business Manager or Apple School Manager via automated device enrollment. Unsupervised devices function largely like standard consumer devices, allowing users to toggle automatic updates on or off via Settings > General > Software Update > Automatic Updates, with limited direct control available to the enterprise.

Software Update Deferrals

To prevent day-one updates from introducing compatibility issues with enterprise applications, iOS 12 allows administrators to delay over-the-air (OTA) updates using MDM configuration profiles.

  • The Deferral Window: Administrators can enforce a delay ranging from 1 to 90 days using the enforcedSoftwareUpdateDelay restriction.
  • Impact on the Device: While this restriction is active, the device is blocked from seeing or installing the specified update until the deferral window expires, even if the user has enabled automatic updates on the device.

Remote MDM Commands vs. Device-Driven Updates

When iOS 12 introduced the consumer toggle for automatic updates, it automated the background download and overnight installation of software updates for regular users. For managed devices, administrators can supersede this behavior through the ScheduleOSUpdate MDM command.

Administrators have several options when pushing OS updates to managed hardware:

  • DownloadOnly: The device downloads the update file over Wi-Fi without automatically installing it.
  • InstallASAP: The update installs immediately, restarting the device if necessary. If the device has a passcode enabled, the user must input their passcode to complete the installation.
  • NotifyOnly: The update is downloaded in the background, and a notification alerts the user that an installation is ready.

Passcode and Hardware Requirements

For an automatic or MDM-driven update to install successfully in iOS 12, specific device states must be met:

  1. Passcodes: If a device is secured with a personal passcode, iOS 12 cannot bypass the passcode to apply an update automatically. The system will prompt the user to accept the update and enter their passcode before the installation can proceed.
  2. Power and Connectivity: The device must be connected to power (or have at least 50% battery life) and be connected to an active Wi-Fi network.

By combining supervised update delays with scheduled MDM deployment commands, enterprises running iOS 12 can prevent uncontrolled operating system changes, test critical business workflows, and enforce updates on a managed schedule.