Question

Your organization manages a fleet of macOS devices enrolled in Intune via Apple automated device enrollment. Security requires that all Macs install the latest available minor OS update within 3 days of release, with a forced restart if users do not act. You want to enforce this using the Settings Catalog without relying on any third-party tools. Which configuration approach should you use?

Accepted Answer

Create a Settings Catalog profile using the Declarative Device Management (DDM) software update settings to specify a target OS version and an enforcement deadline.

Answer

Create a Windows Update ring and assign it to a dynamic group containing the macOS devices.

Answer

Deploy a compliance policy that marks devices non-compliant if the OS is outdated, and let Conditional Access block them until users update manually.

Answer

Use an Intune update ring for macOS with quality and feature update deferral settings similar to Windows Autopatch.