Since an OS update can contain new feature enhancements orcritical bug fixes OS update management becomes essential in every organization. Just as ensuring all devices are running on the updated OS versions, in some cases it's necessary to restrict OS updates on iOS devices. Some of the resons to restrict OS update on iOS devices include:
Follow the steps given below to block iOS updates
Block iOS updates is only supported for Supervised devices. The device must be Supervised for restricting OS update, preferably using Apple Configurator for devices below 11.3. Know more about Supervising iOS devices here.
Mobile Device Manager Plus allows admins to create a policy to automate the OS updates on mobile devices. Once this policy is configured and applied to devices, the users cannot update the current OS on the devices based on configured policy and will be shown the message Your iPhone is running the latest software update allowed by your administrator. Follow these steps to create the OS update policy:
NOTE: You can block iOS updates only upto 90 days, after which the users can manually update the OS on the devices. For more information on automating OS updates, refer this document.
The domain mesu.apple.com is used by Apple devices for updating the OS. If the devices cannot contact this domain, the OS update is restricted . The most optimal way to prevent the domain from being accessed by the device, configure a proxy through which all internet communications are routed. In this proxy, Blocklist the domain as explained below:
To restrict OS updates across all networks,
To restrict OS updates only in enterprise networks, ensuring the enterprise network is not affected,
Blocklist the domain mesu.apple.com in the organization firewall/proxy or any third-party filters being used.
Once both the policies are configured, save and publish the profile. To distribute the profiles,
You can update the OS for few devices by connecting them to the specific machine, which was used for Supervising the devices through Apple Configurator.
NOTE: If you cannot restrict OS updates as explained above, contact our Support team for alternate solutions.