Anyone who manages Apple devices in Intune knows how unpredictable iPhone, iPad and Mac updates can be. In the tenants I work with, keeping OS versions current is one of the most frequent complaints. Users either get flooded with prompts or see none at all, updates sit around for weeks, and compliance reporting is all over the place. Then Apple announced that the legacy MDM software update commands and payloads are deprecated in favour of declarative device management (DDM), and that shifted things considerably. If you manage iOS/iPadOS and macOS software updates in Intune from here on, you do it with Apple DDM, or you fall behind.

Apple DDM in Intune changes how updates actually get enforced

With declarative device management, update enforcement is finally precise. Instead of relying on the old MDM commands, which never behaved reliably, you go to the settings catalog (Declarative Device Management → Software Update) and set the required iOS, iPadOS or macOS version along with a hard deadline, meaning a specific date and time for installation. Devices pull these instructions straight from Intune, process them locally and show system notifications when an update is due. The old MDM policies are still in Intune for now, but they're clearly flagged as deprecated. If you want policy-driven update management to keep working, you'll have to migrate sooner or later.

Pro tip: Always test DDM update policies on a pilot group first. User experience and enforcement can vary between OS versions, and some older devices behave unpredictably at first.

On macOS the DDM approach is a big step up. Once you tie OS update control into modern identity and compliance, for example macOS Platform SSO with Entra ID, you quickly see how much reliable SSO and clean compliance depend on devices being updated on time and consistently.

Old update policies give way to DDM policies in the settings catalog

Plenty of organisations still hang on to the classic update policy profiles, usually out of habit or because they worry about user complaints. Apple's deprecation announcement means it's time to move on. The migration itself is simple enough. You retire the old update configuration profiles and build new DDM-based policies in the Intune settings catalog. This covers both iOS/iPadOS and macOS, provided the devices support DDM and run a sufficiently recent OS.

In practice, the migration usually follows this sequence:

flowchart TD
    OldPolicy["Old MDM update policy"] --> Remove["Remove policy"]
    Remove --> NewDDM["New DDM policy in Intune catalog"]
    NewDDM --> Assign["Assign to target groups"]
    Assign --> Delivery["Devices receive DDM update instructions"]
    Delivery --> Reporting["Status & reporting in Intune"]

Figure: Moving legacy MDM update policies over to DDM in Intune

After deployment, each policy's reporting tab lists the devices that are compliant and the ones still behind. In larger fleets this makes troubleshooting and enforcement a lot easier.

Deadlines and notifications shape what users experience

What I like most about the new approach is that you decide exactly when and how an update becomes mandatory. Users get advance notice, and the system keeps reminding them of the deadline (some would call it nagging). The OS takes care of enforcement. On some versions the user gets one last chance to snooze, while on others the update is forced at exactly the time you configured. Behaviour is consistent within a platform, but test across your device models anyway, because older hardware and unexpected iOS/macOS versions can still surprise you.

For current quirks and supported scenarios, have a look at Microsoft's documentation on managed software updates. The settings catalog itself (see the full reference) has become remarkably granular. If you want precise control over what users see, start there.

Intune reporting shows update compliance in daily operations

The policy status in the Intune portal (Intune → Devices → Update Policies → Reports) is the most dependable way to track update compliance. It shows at a glance which devices are compliant and which are still on an old OS. Pair that with device compliance policies and you can automatically block outdated devices from critical apps or data. If fleet hygiene matters to you, review your compliance and device cleanup posture on a regular basis. Apple devices that fall behind on updates keep showing up in helpdesk tickets and security issues.

I think it's time to let go of the old update policies

Apple DDM in Intune isn't an optional upgrade. For anyone who takes Apple device management in a Microsoft 365 environment seriously, it's the new baseline. With a proper pilot and clear communication to users, the migration is usually painless. Reporting and enforcement are far better than before. If you stick with the old MDM commands, you risk losing control as Apple's own deadlines get closer.

The more modern your update management, the fewer problems you'll have with SSO, compliance and productivity, and that matters more as SSO and identity become more tightly integrated. If you're still undecided, start a pilot now so the next update cycle doesn't catch you off guard.