Updating OS Versions on Apple devices

Last updated
Save as PDF

Overview

Managing software updates and upgrades involves testing prerelease updates and upgrades, deploying them to user’s devices, and enforcing policies that mandate users keep their devices up to date. The purpose of this article is to provide some additional information about the Update OS action in Silverback and its device-specific requirements and behavior using an iPhone as an example. The process for macOS or tvOS devices is almost the same and differs only in nuances. Please note that this article is about pushing OS updates. If you wish the contrary and want to postpone OS updates, please use the following policy settings:

Available OS Updates

First of all, it is important to understand that through Enterprise Mobility solutions you can get information available OS updates on the device. The server requests the Available OS Update command and the device sends the requested information. In Silverback, this AvailableOSUpdate request is included in the Device Information command.

After the Device Information command is successfully executed, the information transmitted by the device is stored in the database and displayed in the Silverback Management Console in the corresponding Available OS Update section.

OS Update Action

If a supervised device reports one or more available OS updates, you will see Update is available icon in Silverback indicating that you can execute an OS update. If there is no icon in the OS Update column, your device is either not supervised or has not yet reported an available OS update.

When you click the OS Update action, you will see a confirmation popup that displays the current installed OS version and the version you are updating to:

If there are multiple available OS updates for the device, which is mainly the case with macOS, as XProtect and Gatekeeper are also displayed there, and for example MacOS 13.4 and 13.4.1 separately, you can use the drop-down list to choose to update only a specific available OS update or all of them.

At this step it is important to understand what command and property is being sent to the device. In the background Silverback will send the the ScheduleOSUpdate command with the Install Action Default, which is explained as "Download or install the update, depending on the current state". In a nutshell, this means that depending on the current state of the device, you may have to run the action twice, because in the first step, the available OS update is downloaded by running the action the first time. The best way to follow the process is to unlock your device and open Settings > General > Software Update on the device. Before running the Update OS action, the available update will be displayed on the Software Update screen of your device as follows:

Apple offers two alternative installation actions for iOS and iPadOS, shown below, and since we do not consider them to be particularly useful compared to the default, you will not find these options in Silverback. This may change in the future.

InstallASAP: Install a previously downloaded software update.
DownloadOnly: Download the software update without installing it.

Action Verification

Now navigate to Silverback and run the Update OS action and navigate back to Pending Commands and notice that the ScheduleOSUpdate command is set to Acknowledged, which means that the command is being sent and acknowledged by the device. This is proof that, from a technical standpoint, everything is executed as intended.

When the device acknowledges the command, you will see a change in the Software Update screen on your device and the update process will start and continue.

Note at this point that the Automatic Updates option can only be controlled by MDM solutions on macOS devices with the Software Updates profile.

Device Response

After executing the ScheduleOSCommand, Silverback will query the status of the Schedule OS Update Response information from the device and will reflect the response in the Last Schedule Update Response area, starting with Silverback 23.0 Update 1.

The Update Result response from device is directly related to the execution of the ScheduleOSUpdate command , so it is important to understand that only a re-execution of the Update OS action will result in a possible new state. The Update Result response from the device may consist of the following response, from which some requirements for downloading or installing the update can be derived:

Idle: The update is idle.
Downloading: The software update is downloading.
Download Failed: The download failed.
Download Requires Computer: Tether the device to download this update. This value is only available in iOS.
Download Insufficient Space: There isn’t enough space to download the update.
Download Insufficient Power: There isn’t enough power to download the update.
Download Insufficient Network: The network capacity is insufficient to download the update.
Installing: The software update is installing.
Install Insufficient Space: There isn’t enough space to install the update.
Install Insufficient Power: There isn’t enough power to install the update.
Install Phone Call In Progress: Installation couldn’t occur because a phone call is in progress.
Install Failed: Installation failed due to an unspecified reason.

Install now

After you run the Update OS action for the first time, the update is first downloaded and prepared. We recommend that you wait and observe the device behavior. When the preparation is finished, the status in the Software Update screen will change to Downloaded. Also note that the Install Now button is inactive because the update requires at least 20% on charging devices or 50% on battery power.

Now it is time to run the Update OS action the second time to initiate the installation of the operating system remotely. Please note the following important information:

If there is no passcode on the device, you can complete the installation remotely using Silverback.
If the device has a passcode, after Silverback sends the update or upgrade to the device, the device queues the update or upgrade and the user is prompted to enter their passcode in order to start the installation immediately or defer for an overnight installation.
When you send an install software update command the device prompts the user with the update or upgrade and describes it as required by your organization. All updates or upgrades sent by Silverback are treated as required and can be delayed up to three times only by the user.
After the third time the user delays, the device requires the user to schedule the update or upgrade for that evening in order to continue to use the device (with the exception of emergency calling).

For demonstration purposes, we will run the Update OS action from Silverback with the current battery level less than 50%. Again, we check the pending commands and see that the ScheduleOSUpdate command is acknowledged:

On the device, we now get the Unable to Install Update screen and when we run the ScheduleOSUpdate command again, the error message has changed:

If we take a look at the Last Schedule Update Response, the device reports Installing instead of the expected Install Insufficient Power: There isn’t enough power to install the update response, so we want to emphasize that the reported status may be incorrect or not supported by the operating system or version.

To demonstrate the installation process, we will run the command again while the device is plugged in with at least 20% battery power or with 50% percent without charging. The demonstration device is charging and doesn't have a PIN code set, and as shown in the screenshot, the Install Now button is active and we now expect that the installation to start after the ScheduleOS command is executing. As you can see in the second screenshot, the update process will start as desired and the device will start the installation process indicated by the Verifying Update notification. After a few minutes, the update process will be finished and the device will be up to date. For completeness, you will also find a screenshot of a device locked with a PIN code and the information that the user should unlock the device to perform the update.

After the update process, the next time the Device Information command is processed, the device reports the new OS version and the Update OS icon disappears because the device is running the latest version.

Multiple Action

If you want to perform the Update OS action on multiple devices at once, follow these steps Navigate to the Managed Devices overview, click the search button and select OS Update is available. Then select the desired devices, press Multiple Actions and Install Updates and confirm with OK. If multiple available OS updates are available for devices, the All option is used when performing OS updates through Multiple Actions.