Managed OS: Deeper control over every Apple OS update

The Managed OS Library Item for Apple devices has received several updates recently, and they share one theme: deeper control. Admins can now be more precise about which macOS versions devices get, when they get them, and which devices are eligible.

From the start, Iru has led the way in Apple OS management. We were the only vendor to offer a “set-it-and-forget-it” approach to deploying Apple OS updates to endpoints, and we’re still focused on helping IT admins work smarter and keep their devices secure.

Over the past few months, we’ve expanded Managed OS across all Apple devices to give admins more control over OS deployment. This matters because keeping operating systems current is still one of the most important security measures an IT team has. More precision lowers deployment risk, reduces disruption for employees, and makes the move to a new OS smoother.

Delay OS releases to devices

Apple makes each public release available to everyone at once. Even if your team has been beta testing the new OS, you may want extra time to verify it before it reaches your fleet.

With the Rolling Enforcement option in Managed OS, you can now set an automatic delay of up to 90 days. During that window, Iru won’t send the new target version declaration to devices. To fully hide the new version from end users, pair this delay with native Apple software update deferrals, which you configure in a Software Update Library Item. With the delay built in, set-it-and-forget-it still works when you need to hold back new updates.

You can go further by combining delays with phased rollouts.

Enable phased rollout schedules

Most IT teams have felt the pain of pushing a new OS to every device at once. At scale, that can break applications and cause spikes in office network traffic. Instead of updating every device on each Apple release, admins can turn on phased rollout and set a rollout window of 1 to 7 days, configured in hours. Iru then sends the new declaration to devices gradually across that window, which smooths out spikes in download and caching activity.

To decide when each device becomes eligible for the new version, Iru uses an algorithm that weighs the rollout window against device-specific data. You can see each device’s timing in the Library Item status.

If you’ve also set a delay, the phased rollout starts once the delay ends.

Enforce beta OS versions

You can now beta test with a group of devices entirely inside Managed OS. Managed OS Library Items for Apple devices support enforcing beta releases using AppleSeed for IT beta tokens from Apple Business. If you have Automated Device Enrollment (ADE) integrations configured, these tokens sync to Iru automatically, so you don’t need Managed Apple Accounts.

Learn more about beta enforcement

Set separate schedules for minor updates and major upgrades

Teams usually want security (minor) updates enforced quickly and major OS upgrades rolled out more slowly. Major upgrade timing now has its own enforcement settings, separate from minor updates. That means one Library Item can handle both with different schedules, and you don’t need complex extra scoping logic.

Hardware-aware OS enforcement

When you use the specific version, minimum version, or rolling update options, Iru now checks hardware compatibility in the background. It checks against Apple’s GDMF metadata service, and if Apple’s data shows an OS update or Background Security Improvement isn’t compatible with a device, Iru won’t try to install it.

New Apple devices that ship with hardware-specific builds can stay up to date without disrupting the rest of your fleet. Self Service and status reporting reflect this too.

Built for what’s next

Giving IT admins more control over Apple OS management is still a core driver of innovation at Iru. OS management is a primary IT responsibility and also a critical security vector.

These updates extend automation that was already smart, giving you more power, control, and flexibility over every rollout.

Get started today.