Apple has moved software update management to declarative device management (DDM), and with the 27 releases the old MDM update commands stopped working altogether. If your Macs, iPhones or iPads aren't updating on time, the cause is usually a legacy policy that no longer does anything, a DDM setting that doesn't behave the way its name suggests, or a device that can't finish the install. In this post I'll explain how the DDM update settings work in Intune, why updates don't install, and how to prove a device really updated.
Errors this guide fixes
No new software available.Terminal (softwareupdate --list)
Status (October 2026): Apple's "What's new for enterprise" notes for the 27 releases state that legacy software update management no longer functions in all 27.0 operating systems. That covers software update commands, queries, recommended cadence settings and restrictions such as deferrals and Background Security Improvements. Microsoft's Intune documentation calls the MDM-based update policies deprecated and points to DDM settings in the settings catalog. Re-check both official pages, because the status can change.
Symptoms#
- Devices on iOS/iPadOS 27 or macOS 27 ignore your older Intune update policies or deferral restrictions: the deadline passes and nothing happens.
- A DDM update policy reports success, but the device is still on the old version.
- The policy shows
Erroron devices that are already on a newer version than the target. - On a Mac,
softwareupdate --listreturns the following even though Apple has released a newer version:
No new software available.Why it happens#
Legacy policies have nothing left to talk to#
On the 27.0 releases, the old update commands and restrictions are simply ignored. A device with only legacy policies has no managed update control.
The device isn't eligible#
Intune's DDM software updates need iOS/iPadOS 17.0 or later or macOS 14.0 or later, enrolled through Device Enrollment or Automated Device Enrollment. User Enrollment isn't on that list.
Success means the declaration arrived, not the update#
Microsoft is explicit that a policy reporting success only means the configuration installed on the device. Whether the OS changed is a separate question, answered by the Apple updates reports and the device's OS version.
The deadline works differently from what you expect#
Intune offers two models in the settings catalog under Declarative Device Management › Software Update:
| Model | Settings | Watch out for |
|---|---|---|
| Latest version | Enforce Latest Delay in Days and Enforce Latest Install Time | The delay counts from Apple's posting date or when the policy is configured, and sets only the enforcement date, not when users are offered the update. Install Time is local 24-hour time with a leading zero, such as 03:00 |
| Targeted version | Target OS Version and Target Date Time, optionally Target Build Version and Details URL | The target must be a version Apple has released for that hardware. Once a device passes it, the policy reports an error because it now looks like a downgrade |
A device can also install before the deadline if it's idle.
Software Update Settings shape what users see#
A separate DDM configuration, Software Update Settings, controls whether standard users can update, how automatic downloads and Rapid Security Responses behave, whether updates are hidden for a period, whether notifications are suppressed until an hour before the deadline, and whether users are offered the latest major update, minor update or both. A deferral that hides updates can explain an empty softwareupdate --list. Once an enforcement is assigned, the device ignores these settings, including automatic actions.
The device can't finish#
Offline devices, full disks, laptops and iPads left on low battery, and hardware that can't run the target release all stall. On Apple silicon Macs, the bootstrap token escrowed with Intune is what lets MDM-managed updates be authorized without the user's credentials, so check it on Macs that never finish.
How to fix it#
- Replace legacy policies. List your old iOS/iPadOS and macOS update policies and any restriction profiles that defer updates. Build DDM replacements in Devices › By platform › macOS (or iOS/iPadOS) › Manage devices › Configuration › Create › New policy, profile type Settings catalog, then retire the old policies once the new ones report.
- Use one enforcement per device. For example, a targeted-version policy for a pilot group and a latest-version policy with a delay for everyone else, with groups that don't overlap.
- Add Software Update Settings for the user experience: notifications, who can update, how long new updates stay hidden, and the major/minor offer. Test the combination on pilot devices, because a device with an assigned enforcement ignores these settings, including automatic actions.
- Check eligibility. On the device's page in Intune, confirm the OS version and enrollment type. Devices below iOS/iPadOS 17 or macOS 14 need a manual update first.
- Check the bootstrap token on Macs.
profiles status -type bootstraptokenshould report that the token is supported on the server and escrowed. If it isn't, sign in once with a secure-token account, or escrow it withsudo profiles install -type bootstraptoken. - Clear device blockers. Free up storage, keep laptops and iPads on power before the deadline, and make sure the device can reach Apple's update servers and is checking in (see Macs unexpectedly unenrolled if it isn't).
- Clean up old targets. Remove targeted-version policies from devices that are already past that version to clear the error.
Verify the fix#
Intune builds its Apple software update reports from Apple's declarative status reporting, so they need iOS/iPadOS 17 or macOS 14 and later:
- Summary (Reports › Device management › Apple updates › Summary): update status across macOS, iOS and iPadOS, with the newest available version and its release date (Intune checks with Apple once a day).
- Organizational report (Reports › Device management › Apple updates › Reports, tile Apple software update report, then Generate): pending and current update details for every device.
- Failures report (Devices › Monitor › Apple software update failures): failed updates with the failure reason and time. Start here for stuck devices.
- Per-device report (the device's page, Monitor › iOS software updates or macOS software updates): the update status of a single device, including its install state and when it last reported.
On a Mac, confirm the version and watch the update daemon:
sw_vers
softwareupdate --list
log show --last 2h --predicate 'process == "softwareupdated"' | tail -n 50On iPhone and iPad, Settings › General › About shows the installed version and Settings › General › Software Update shows anything pending. Good looks like this: the per-device report shows the target version installed, and the device's OS version in Intune matches.
Prevent it next time#
- Move every device group to DDM, and keep legacy policies only until their replacements report.
- Run a pilot ring with a targeted version and a broad ring with a latest-version delay.
- Use Details URL to point users to your own update instructions.
- Check the Failures report weekly, and remove targeted policies once a release is fully deployed.
- Keep supervised-only restrictions and other profiles healthy too; see iOS/iPadOS configuration profile errors.
