Ensure "Enforce Latest Software Update Version" is set to "True"

MediumLevel 1Manual reviewintune-macos

Description

The "Enforce Latest Software Update Version" setting, mandates that device install the latest available software update. When set to "True", the update is enforced by the system rather than remaining optional for the user. Administrators may also configure an "Install Time" (e.g., 02:00) and a "Delay In Days" (0-30) to manage the rollout. Intune allows a delay of up to 30 days, this may exceed the recommended remediation window for critical vulnerabilities, organizations should set this delay as short as operationally feasible (typically 7 days) to maintain a strong security posture. ... The benchmark marks this a Manual check of an Intune macOS policy setting that cannot be read from the endpoint with a script, so TMAegis lists it as a manual review item with the audit steps (the policy must be inspected in the Intune admin center or on the managed device).

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

macOS: Intune admin center: Expand the Declarative Device Management (DDM) heading; Under the Software Update Enforce Latest subheading; Verify that Enforce Latest Software Update Version is present and set to True

How it is fixed

Fix method: Guidance or infrastructure patch

Intune admin center: Select Declarative Device Management (DDM) then Software Update Enforce Latest; Check Enforce Latest Software Update Version; On the left side of the page set Enforce Latest Software Update Version to True; Verify that Enforce Latest Software Update Version is present and set to True

Properties

Operating systems: Any
Tags: intune-macosintunemanual-review
Reference: CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 - 2.10.1.1 Ensure "Enforce Latest Software Update Version" is set to "True"