{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/", "slug": "dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies", "url": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/" }, "title": "Choose declarative update management before rebuilding macOS update policies", "summary": "Should a new macOS 14-or-later update design reuse the older MDM software-update policy?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:21+00:00", "modified_at": "2026-09-10T02:01:57+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 206, "potentially_affected": "Review the management mechanism before rebuilding update controls for Intune-managed Macs. Identify the actual OS population and separate any older systems that need their own current support and servicing assessment.", "dse_recommendation": "Have the Mac administrator map the intended target update and deadline to the documented DDM settings.", "primary_source": { "name": "Admin guide and checklist for macOS software updates - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-updates/apple/planning-guide-macos", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For macOS 14 and later, Microsoft recommends declarative device management for installing a specified update by an enforced deadline. The source explicitly advises against MDM-based software-update settings on those devices because Apple deprecated that policy mechanism. The DDM settings are available through Intune’s settings catalog, with the device handling notification, download, preparation, and installation. Microsoft Learn.

\n

Applicability

\n

Review the management mechanism before rebuilding update controls for Intune-managed Macs. Identify the actual OS population and separate any older systems that need their own current support and servicing assessment.

\n

DSE recommendation

\n

Have the Mac administrator map the intended target update and deadline to the documented DDM settings. Inventory existing update assignments before introducing the replacement, and decide how their transition will be tested. Do not reproduce the source’s older MDM configuration examples as the new design for macOS 14 or later.

\n

Verification

\n

Use representative supported Macs to observe the update offer, user notifications, deadline behavior, and installed result under the approved DDM configuration. Record which old settings remain and why, rather than assuming a new profile silently retires every previous assignment. Validate required applications after updating and retain any unresolved servicing exceptions before extending the design.

\n

Official references

\n

Microsoft Learn: Admin guide and checklist for macOS software updates.

", "content_text": "Source facts\nFor macOS 14 and later, Microsoft recommends declarative device management for installing a specified update by an enforced deadline. The source explicitly advises against MDM-based software-update settings on those devices because Apple deprecated that policy mechanism. The DDM settings are available through Intune’s settings catalog, with the device handling notification, download, preparation, and installation. Microsoft Learn.\nApplicability\nReview the management mechanism before rebuilding update controls for Intune-managed Macs. Identify the actual OS population and separate any older systems that need their own current support and servicing assessment.\nDSE recommendation\nHave the Mac administrator map the intended target update and deadline to the documented DDM settings. Inventory existing update assignments before introducing the replacement, and decide how their transition will be tested. Do not reproduce the source’s older MDM configuration examples as the new design for macOS 14 or later.\nVerification\nUse representative supported Macs to observe the update offer, user notifications, deadline behavior, and installed result under the approved DDM configuration. Record which old settings remain and why, rather than assuming a new profile silently retires every previous assignment. Validate required applications after updating and retain any unresolved servicing exceptions before extending the design.\nOfficial references\nMicrosoft Learn: Admin guide and checklist for macOS software updates.", "content_markdown": "## Source facts\n\nFor macOS 14 and later, Microsoft recommends declarative device management for installing a specified update by an enforced deadline. The source explicitly advises against MDM-based software-update settings on those devices because Apple deprecated that policy mechanism. The DDM settings are available through Intune’s settings catalog, with the device handling notification, download, preparation, and installation. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/device-updates/apple/planning-guide-macos).\n\n## Applicability\n\nReview the management mechanism before rebuilding update controls for Intune-managed Macs. Identify the actual OS population and separate any older systems that need their own current support and servicing assessment.\n\n## DSE recommendation\n\nHave the Mac administrator map the intended target update and deadline to the documented DDM settings. Inventory existing update assignments before introducing the replacement, and decide how their transition will be tested. Do not reproduce the source’s older MDM configuration examples as the new design for macOS 14 or later.\n\n## Verification\n\nUse representative supported Macs to observe the update offer, user notifications, deadline behavior, and installed result under the approved DDM configuration. Record which old settings remain and why, rather than assuming a new profile silently retires every previous assignment. Validate required applications after updating and retain any unresolved servicing exceptions before extending the design.\n\n## Official references\n\n[Microsoft Learn: Admin guide and checklist for macOS software updates](https://learn.microsoft.com/en-us/intune/device-updates/apple/planning-guide-macos)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/", "url": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose declarative update management before rebuilding macOS update policies", "item": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/", "url": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/", "headline": "Choose declarative update management before rebuilding macOS update policies", "description": "Should a new macOS 14-or-later update design reuse the older MDM software-update policy?", "abstract": "Should a new macOS 14-or-later update design reuse the older MDM software-update policy?", "articleBody": "Source facts\nFor macOS 14 and later, Microsoft recommends declarative device management for installing a specified update by an enforced deadline. The source explicitly advises against MDM-based software-update settings on those devices because Apple deprecated that policy mechanism. The DDM settings are available through Intune’s settings catalog, with the device handling notification, download, preparation, and installation. Microsoft Learn.\nApplicability\nReview the management mechanism before rebuilding update controls for Intune-managed Macs. Identify the actual OS population and separate any older systems that need their own current support and servicing assessment.\nDSE recommendation\nHave the Mac administrator map the intended target update and deadline to the documented DDM settings. Inventory existing update assignments before introducing the replacement, and decide how their transition will be tested. Do not reproduce the source’s older MDM configuration examples as the new design for macOS 14 or later.\nVerification\nUse representative supported Macs to observe the update offer, user notifications, deadline behavior, and installed result under the approved DDM configuration. Record which old settings remain and why, rather than assuming a new profile silently retires every previous assignment. Validate required applications after updating and retain any unresolved servicing exceptions before extending the design.\nOfficial references\nMicrosoft Learn: Admin guide and checklist for macOS software updates.", "datePublished": "2026-09-10T00:25:21+00:00", "dateModified": "2026-09-10T02:01:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-395-choose-declarative-update-management-before-rebuilding-macos-update-policies/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose declarative update management before rebuilding macOS update policies" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 206, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Admin guide and checklist for macOS software updates - Microsoft Intune | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/intune/device-updates/apple/planning-guide-macos" } } ] } }