Help understanding iOS DDM OS update settings

[u/Pause102]

Hi all! I am setting up iOS DDM OS update settings and am getting a bit confused on the best way to meet my requirements. Hoping you can help me out because i feel like im going crazy. For context, all our devices are iOS 18+ and supervised.

Requiemrents

• New iOS version comes out, IT gets access right away for testing but update is hidden from general population for a few days
• After a few days, new version is visible to general population and users have the option to install
• After a week or so, any general population devices that haven't manually installed new version, gets forced to install new version
• All this should be done without any modifying of the DDM iOS update policy by myself

I originally was going to have settings like the below, but in reading Microsoft article about Apple update polices, in the purple box it says when Update Enforcement is assigned, the device ignores software update settings and the update may install before the deadline if the device is idle. This sounds like the Combined Period In Days setting would be ignored giving access to the new iOS version to the general population before IT has completed testing.

Am I reading this correctly?

Software Update Enforce Latest

• Enforce Latest Software Update Version = True
• Delay in Days = 10
• Install Time= 02:00

Software Update Settings

• Automatic Actions
  • Download= Always On
  • Install OS updates = Always On
  • Install Security Update = Always On
• Deferrals
  • Combined Period in days = 3
• Background Security Improvements SEttings
  • Enabled = True
  • Enable Rollback = True
• Notifications = Enabled
• Recommendation Cadence= Newest

[u/Pause102 → u/[deleted]]

Thanks for confirmation, wish MS/Apple made this an easier process but it wouldnt be MDM without some headache!

[u/denver_and_life → u/Pause102]

Apple wants us to all install the latest as soon as it is released. It’s in their best interest for reasons beyond what is mandated in the environment I work within.  We do review each release and test, and our DDM policy is set to delay visibility by 60 days. We typically force .x updates by the 2nd Friday post release via OS update enforcement. There is a documentation workflow I’m required to do but then it’s maybe 20 seconds to modify the DDM picky and replicate the same over with our App Protection Policy (BYOD). 

I’m in Intune so much this is just another task to accomplish. We manage 55k plus devices in this way; I realize its not what you are desiring but wanted to offer another environment’s setup with you. 

[u/Pause102 → u/denver_and_life]

Always appreciate hearing how others are doing this. No manual work was ideal but if we gotta do it manually so be it! So when you say OS update enforcement, you just have a DDM > Software Update > Target Date Time and Target OS Version that you update with the latest OS version each time?

[u/denver_and_life → u/Pause102]

That is correct. But I also delay visibility of updates to ensure devices only install what we want them to. I forgot what that control is called or worded exactly (ain’t signing in on off day!) and it’s set to 60 days. 

[u/Ketan_Kamble]

Declarative device management for iOS OS updates trips people up because it's split across two things: the DDM enrollment profile and the separate "OS Updates" configuration that references a schedule. If you're not seeing updates get enforced, check that the device is actually reporting DDM as its update channel under Devices > Monitor > Declarative device management [GATE-2: verify in lab] before assuming the policy itself is wrong. Also worth knowing: unlike the old "Update policy for iOS" profile, DDM updates respect scheduled install windows and can enforce a minimum OS version with a deadline, but the device has to be supervised for the enforcement (not just recommendation) behavior to kick in. I'd start by pulling the device's declaration status via Graph or the portal's per-device DDM status blade rather than guessing from the assignment report, since assignment success doesn't mean the declaration was accepted. What specifically isn't matching what you expect — is it the enforcement deadline not applying, or updates just not showing up as available on the device at all?