SoftwareUpdateEnforcementSpecific

A software update enforcement policy for a specific OS release.

Declaration

object SoftwareUpdateEnforcementSpecific

Properties

Name	Type	Description
`DetailsURL`	string	The URL of a web page that shows details that the organization provides about the enforced software update.
`TargetBuildVersion`	string	The target build version to update the device to by the appropriate time, for example, `20A242`. Use the build version for testing during seeding periods. The build version can include a supplemental version identifier, for example, `20A242a`.
`TargetLocalDateTime` Required	string	The local date time value that specifies when to force install the software update. Use the format `yyyy-mm-ddThh:mm:ss`, which is derived from RFC3339 but doesn’t include a time zone offset. If the user doesn’t trigger the software update before this time, the device force installs it.
`TargetOSVersion` Required	string	The target OS version to update the device to by the appropriate time. This is the OS version number, for example, `16.1`.

Discussion

Specify com.apple.configuration.softwareupdate.enforcement.specific as the declaration type.

If the TargetOSVersion and optional TargetBuildVersion values don’t match an available software update, the device keeps the configuration active, but won’t be able to update. If a software update that matches these keys becomes available later, the device will process the update.

To determine available software updates to show to an admin, a device management service uses the Apple GDMF service via https://gdmf.apple.com/v2/pmv. Configurations only enforce a software update if GDMF has the corresponding OS version or build available. So device management services need to regularly check available versions, and adjust the list shown to admins, and also remove any deployed configurations that use OS versions or builds that are no longer available. Device management services should check GDMF no more than once a day.

If the TargetOSVersion is an OS version that includes both a minor and patch version, the system installs that specific version, for example, 16.1.1. If the minor version doesn’t include a patch version, the system installs the latest available patch version. For example, if the TargetOSVersion is 16.1 and a .1 patch is available, the system installs 16.1.1.

The system can only install a supplemental software update on a device that already has the base OS version installed. For example, the system can only install a 16.1(a) update on a device that currently has 16.1 installed, but it can’t install that update on a device that has only 16.0 installed. To update to a supplemental version from an older base version, use two configurations. Use the first configuration to update to the new base version, and the second configuration to update the new base version to its supplemental version.

If the device isn’t running at the target date-time, the system enforces the software update 1 hour after restarting, or when the device meets all required conditions, such as minimum battery level.

Configuration availability


Allowed in supervised enrollment	iOS, macOS, Shared iPad, tvOS, visionOS
Allowed in device enrollment	iOS, Shared iPad, tvOS, visionOS
Allowed in user enrollment	NA
Allowed in local enrollment	NA
Allowed in system scope	iOS, macOS, Shared iPad, tvOS, visionOS
Allowed in user scope	NA

Configuration example

This configuration enforces a software update to a specific OS version and build at a specified time.

{
    "Type": "com.apple.configuration.softwareupdate.enforcement.specific",
    "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",
    "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",
    "Payload": {
        "TargetOSVersion": "26.0",
        "TargetBuildVersion": "23A309",
        "TargetLocalDateTime": "2025-09-21T01:00:00"
    }
}