Global trading company: 98% of Macs up to date in 4 weeks

The client

The client is a global financial trading company. It manages its Macs with Jamf. Security updates must be installed quickly and reliably, and the business must be able to prove it.

The challenge

Older update methods rely on reminders and scripts. People can postpone updates, and it is hard to see which devices are behind.

Apple now recommends declarative device management (DDM) for software updates. With DDM, the device itself enforces an update by a set deadline and reports its status back to Jamf.

What we did

Update enforcement with DDM

We configured Apple software update enforcement using DDM in Jamf. Each update has a target version and a deadline. Devices install the update by that deadline and report progress. Staff get 7 days’ notice before an update is forced. Around 1,000 Macs now update this way, with no manual chasing.

Fleet-wide remediation after a failed update

A macOS update failed on part of the fleet. We identified the affected Macs and planned a fix for the whole fleet. 250 Macs were affected. All of them were back on the target version within 7 days.

The impact

• Apple software updates enforced by deadline, with status reported from each device
• Update compliance rose from 65% to 98% within 4 weeks
• Around 1,000 Macs update by a set deadline, with no manual chasing
• 250 affected Macs back on the target version within 7 days of the failed update
• The security team can show auditors the update status of every Mac on request

Why deadlines work better than reminders

Reminders and scripts depend on people choosing to install an update, and on IT chasing the ones who do not. With declarative device management, the Mac is given a target version and a deadline, and it reports its own progress. Staff still get notice, but the update happens by the deadline, and the status of every Mac can be shown on request.

Apple now goes further. It says legacy software update management no longer functions in its 27.0 operating systems, and that IT teams should use declarative software update management instead. Our guide to macOS 27 software updates, DDM and Jamf Blueprints explains what to change.

For other regulated organisations

Financial services organisations are often asked to prove that security updates are installed promptly. Enforced deadlines, with status reported by each device, turn that into evidence rather than a promise. See how we support financial services organisations, and our Mac IT support for businesses that run Mac and Windows.