Protect devices · Topic 6 of 6
Apple, Android Update Policies and Update Monitoring
MD-102 other platform updates: Apple update policies with the settings catalog and DDM, Android updates with configuration profiles and FOTA, and update monitoring.
- 5 min
- Apple updates use DDM in the settings catalog (iOS/iPadOS 17 and macOS 14 or later). Legacy policies are being retired and DDM takes precedence.
- DDM options include target OS version, target date and time, delay in days and enforce latest.
- Android Enterprise system updates use device restrictions (with freeze periods) or FOTA with Samsung Knox E-FOTA and Zebra LG OTA.
What it is
Apple and Android devices get operating system updates differently from Windows. For iOS, iPadOS and macOS, Intune uses the settings catalog and Apple's declarative device management (DDM). For Android, you use device restriction profiles or manufacturer firmware over the air (FOTA) integrations. Intune reports on the result for each platform.
How it works
Apple update policies
Apple deprecated the older MDM update commands, and Intune is ending the creation of legacy software update policies. The recommended approach is a settings catalog policy that uses DDM.
| Fact | Detail |
|---|---|
| Versions | DDM software updates need iOS/iPadOS 17 or later and macOS 14 or later. macOS 13 and older still use MDM policies |
| Where | Settings catalog policy, category Declarative Device Management, Software Update (and Software Update Settings for deferrals and user experience) |
| Target version | A target OS version (for example 26.0, with an optional supplemental version) or a target build version. The OS version wins if both conflict |
| Enforcement | A target date and time sets when the update is forced. When the grace period ends, the device installs and restarts |
| Delay in days | Delays enforcement after Apple releases the update. It sets the enforcement date, not when the user is offered the update |
| Enforce latest | A setting that automatically enforces the newest update, so you do not edit the target each time |
| Precedence | DDM software update settings override older MDM update policies |
DDM works because the device manages itself and reports status back, so it does not depend on the server pushing a command at the right moment. Intune shows iOS software updates and macOS software updates reports on each device. Supervised devices have more control, and for macOS 13 and earlier, combine a software update policy with a settings catalog policy that controls how updates install.
Android updates
| Method | Use |
|---|---|
| Device restrictions profile | For Android Enterprise fully managed, dedicated and corporate owned work profile devices. Choose how over the air system updates behave (automatic, windowed, postponed up to 30 days) and set freeze periods that block updates |
| FOTA (firmware over the air) | Manufacturer integrations that let you pick exact firmware versions. Needs an Intune Plan 2 or Intune Suite license |
| Compliance policy | Personally owned work profile devices have no system update setting, so require a minimum OS version or security patch level |
Samsung Knox E-FOTA: connect the tenant under Tenant administration, Connectors and tokens, Firmware over-the-air update, and sign in with a Knox administrator account. Devices need the Knox E-FOTA and Knox Service Plugin apps, and you deploy an OEMConfig profile that turns on the firmware controls. Register device groups, then create FOTA deployments (Devices, Android, Manage updates, Android FOTA deployments) by model, sales code and firmware version.
Zebra LifeGuard Over-the-Air (LG OTA): create an app configuration policy for each of the two Zebra apps, then build FOTA deployments in the same place. Zebra does not support firmware downgrades through LG OTA, because a downgrade causes an enterprise reset that wipes user data. Android 11 devices need an extra Zebra package enabled as a system app.
Monitoring updates
| Platform | Where |
|---|---|
| Windows | Reports, Windows updates: update ring status, feature update and quality update reports |
| iOS/iPadOS and macOS | Device overview software update reports, plus the update policy status |
| Android | FOTA deployment status and the compliance report for minimum OS |
You can also use Windows Update for Business reports (Log Analytics), the Device compliance report for OS version rules, and Endpoint analytics for update and restart insight. Check per setting status for errors and conflicts.
Choosing the approach
| Need | Choice |
|---|---|
| Force all iPhones to the latest iOS by a date | DDM enforce latest or a target version and date |
| Block Android updates for a holiday week on kiosks | A freeze period in the device restrictions profile |
| Control Samsung firmware versions exactly | Knox E-FOTA |
| Require recent security patches on BYOD Android | A compliance policy with a minimum patch level |
A worked scenario
A school gives out iPads and Android tablets. The admin builds a settings catalog DDM policy that sets the target iPadOS version and a Friday evening enforcement time, so tablets update over the weekend. For the Android tablets that run Zebra's firmware, she creates two app configuration policies and a FOTA deployment. During exams, a freeze period blocks Android system updates for two weeks. She checks the software update reports on Monday morning.
What to remember for the exam
- Apple updates use DDM in the settings catalog (iOS/iPadOS 17 and macOS 14 or later). Legacy policies are being retired and DDM takes precedence.
- DDM options include target OS version, target date and time, delay in days and enforce latest.
- Android Enterprise system updates use device restrictions (with freeze periods) or FOTA with Samsung Knox E-FOTA and Zebra LG OTA.
- FOTA needs an Intune Plan 2 or Intune Suite license. Zebra LG OTA does not downgrade.
- Personal Android devices use compliance policies for minimum patch levels.
Downgrading Zebra firmware through LG OTA wipes the device.
How the exam asks about this
- "Force iPads to a specific iPadOS version by a deadline." A DDM software update policy in the settings catalog.
- "Block system updates during a freeze period on dedicated Android devices." A device restrictions profile freeze period.
- "Pick exact firmware versions for Samsung devices." Knox E-FOTA with FOTA deployments.
- "Require BYOD Android devices to keep a minimum security patch." A compliance policy.
Common mistakes
Creating legacy Apple update policies. They are being retired.
Expecting DDM on iOS 16. It needs iOS 17 or later.
Forgetting the Intune Plan 2 license for FOTA.
Downgrading Zebra firmware. It triggers a reset.
Check yourself
Which technology do Apple update policies now use?
Declarative device management in the settings catalog.
Which Android profile feature blocks updates for a period?
A freeze period in a device restrictions profile.
Which license do Android FOTA updates need?
Intune Plan 2 or the Intune Suite.
Topic 6 of 6 in Protect devices
Test yourself on Protect devices
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.