If you have spent any time managing macOS or iOS devices in Microsoft Intune, you know how agonizing traditional MDM updates can be. You push an update policy, and then you just wait. You wait for the Intune sync cycle, wait for the device to check in over APNs, and wait to see if the user ignored the prompt for the fifth time today.
That old “imperative” management model—where Intune constantly pings the Mac asking “are you updated yet?”—is finally getting replaced. Apple’s Declarative Device Management (DDM) turns that workflow on its head. Instead of Intune micro-managing the install, Intune simply hands the device a baseline rule (for example: “Reach macOS 15.3 by Friday at 5:00 PM local time”). From there, the Mac handles its own countdowns, manages the download, and reports back to Intune real-time when the status changes.
Here is what you actually need to know to get DDM software update enforcement running in Intune without breaking user workflows or causing reporting errors.
The Real Difference: Traditional MDM vs. DDM
Why is everyone shifting to DDM? It comes down to where the processing logic lives:
- Legacy MDM Policies: Intune fires a command over APNs → The device receives it → The user defers it → Intune has to poll the device later to figure out what happened. Result: delayed compliance reports and missed patch windows.
- Declarative (DDM) Policies: Intune sends a single configuration manifest → The local Apple OS autonomously manages notifications, deferrals, and deadline enforcement → The device proactively pushes status changes back to Intune via the DDM status channel.
Because the enforcement runs locally on the OS, the update triggers on time—even if the Mac temporarily drops off Wi-Fi right before the deadline.
Step-by-Step: Setting Up DDM Forced Updates in Intune
Microsoft has moved DDM controls out of legacy update profiles and straight into the Settings Catalog.
1. Create the Settings Catalog Profile
- In the Microsoft Intune Admin Center, head to Devices → macOS (or iOS/iPadOS) → Configuration profiles → Create → New policy.
- Pick Settings catalog as your profile type and hit Create.
- Give it a clear name like
macOS - DDM Required Update Enforcement.
2. Configure the DDM Update Keys
Inside the settings picker, search for Declarative Device Management and open the Software Update category. You will want to toggle and set these core values:
- Target OS Version: The exact release version you want installed (e.g.,
15.3.1). - Target Build Version (Optional): Useful if you need to lock down a specific build number (like
24D81). - Target Date Time: The hard deadline for enforcement (e.g.,
2026-11-15T18:00:00). Note that this evaluates in the device’s local time zone. - Details URL: Put a link here to your internal IT help desk page or Apple’s patch notes. When the native update prompt pops up on the Mac, users can click this to see why their reboot is scheduled.
Pro Tip on Automatic Enforcements: If you prefer to target the newest release automatically rather than hardcoding exact version strings every month, choose Software Update Enforce Latest instead. You can configure a Delay In Days (to give your team time to validate zero-day patches) and set an Install Time (using 24-hour format like 18:00) to control when the forced restart window hits.
Troubleshooting DDM from the macOS Terminal
Don’t rely solely on Intune reporting when validating DDM deployments on test hardware. You can query the local Apple declarativemanagement engine directly from the Mac.
To check if the Mac has received and parsed your DDM declaration, pop open Terminal and run:
# Check local DDM sync status and registered configuration payloads
sudo profiles status -type declarative
If an update isn’t firing as expected, stream the native DDM system log to see real-time status transitions:
# Watch live DDM policy evaluations and Apple APNs events
log stream --predicate 'subsystem == "com.apple.declarativemanagement"' --level debug
Admin Gotchas to Avoid in Production
- Watch Out for “Downgrade” Errors in Intune Reports: If a user manually updates their Mac to
15.4before your DDM policy (which is still targeting15.3) runs, Intune will log a policy error. The device interprets the incoming lower version target as an invalid OS downgrade. Always update or retire your fixed-version DDM profiles once a rollout finishes. - Supervision Requirements Matter: On macOS, DDM update configurations work on most enrolled devices, but fully enforced deadline reboots (where the OS forces a restart regardless of logged-in state) require supervised Macs with a valid Bootstrap Token. On iOS, DDM updates strictly require Supervised mode.
- Don’t Stack Legacy and DDM Update Profiles: If you assign both an old legacy Intune update policy and a new DDM Settings Catalog policy to the same Mac, the DDM declaration takes priority—but reporting inside the Intune portal can get messy. Clean up your legacy update policies as you migrate your groups over.