Citrix Endpoint Management

Software Update Enforcement device policy (Technical Preview)

May 7, 2025

Contributed by:

C S

Note:

Features in the Technical Preview are available to use in non-production or limited production environments, and to give customers an opportunity to share feedback. Citrix does not accept support cases for features in technical preview but welcomes feedback for improving them. You can provide feedback on this feature by clicking Send us your feedback. Citrix might act on feedback based on its severity, criticality, and importance.

The software update enforcement device policy for a specific OS release enables IT administrators to manage iOS device updates, allowing them to control which updates are applied and set deadlines for completing all updates. These settings configure the declarations used by Apple’s declarative device management feature. These settings are separate from older MDM settings and only apply to a device enabled for declarative management. It takes precedence over the Control OS Update policy for the same setting.

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Prerequisites

CEM version is equal to or greater than 25.5.0.
The feature flag ios.mdm.declarative.management is activated. Contact your admin to enable this feature if needed.
Available for iOS 17.0 or later and iPadOS 17.0 or later.

iOS settings

Software Update Enforcement device policy

Target OS Version Type: Specify how to configure the target OS version. The default is Available iOS Version.
- Available iOS Version: If On, list the available target OS versions in Target OS Version.
- Specified Version: If On, manually input the OS version with suggested format.
Target OS Version: (Required) Select or type the target OS version to update the device to by the appropriate time. This is the OS version number, for example, 17.7. It may also include a supplemental version identifier, for example, 17.7.2.
Target Build Version: Type the target build version to update the device to by the appropriate time, for example, 20A242. The system uses the build version for testing during seeding periods. The build version can include a supplemental version identifier, for example, 20A242a. If the build version isn’t consistent with the target OS version specified in the TargetOSVersion key, the target OS version takes precedence.
Target Local Date Time: (Required) Type the local date time value that specifies when to force install the software update. Use the format yyyy-mm-ddThh:mm:ss, which is derived from RFC3339 but doesn’t include a time zone offset. If the user doesn’t trigger the software update before this time, the device force installs it.
Detail URL: Type the URL of a web page that shows details that the organization provides about the enforced update.

Note:

Both Software Update Enforcement policy and Control OS Update policy can manage the OS updates on devices. However, the Software Update Enforcement policy takes precedence over the Control OS Update policy. If both policies are deployed with the same setting, the configuration in the Control OS Update policy will be overridden and will not take effect. For more information, see the Transition to declarative device management.

Besides, there are some differences between Software Update Enforcement policy and Control OS Update policy.

Policy Type	Software Update Enforcement	Control OS Update
Device Type	Supervised or Unsupervised device	Supervised device
Enforce an update deadline	✅	❌
Enter a help URL	✅	❌
Specify the build version number	✅	❌
Auto deploy latest update	❌	✅
Minimum supported version	iOS 17.0	iOS 10.3 (supervised)

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Software Update Enforcement device policy (Technical Preview)

May 7, 2025

Contributed by:

C S

May 7, 2025

Contributed by:

C S

Software Update Enforcement device policy (Technical Preview)

Prerequisites

iOS settings

In this article