Apple macOS Patching Policy Setup

Topic

This article explains how to configure Apple macOS patch management policies in NinjaOne.

Environment

NinjaOne Endpoint Management
Apple macOS

Description

NinjaOne Patch Management allows you to create patching policies that automatically scan for and apply new operating system (OS) patches for your Apple macOS endpoints.

Select a topic to continue:

System Requirements

NinjaOne supports OS patching on macOS Catalina and above.

Important Considerations

Consider the following notes before proceeding:

Apple macOS patches are not applied until you reboot the machine.
Patches will remain pending until you reboot the machine.
If a reboot is required, you will be unable to install additional patches until you restart the machine.

Before you begin: Agent-based app patching on macOS requires a local administrator account with a secure token on each managed device. Create and record this account before continuing, then follow NinjaOne Endpoint Management: Secure Token Automation Scripts to grant it a secure token. You will reference this account in the Configure the Default Credential step below.

Patching Credential Requirements

Due to enhanced Apple security, a local account with volume owner (secure token) permissions is required to apply patches for macOS. You can add secure token permissions to either a standard user or an administrator account. Refer to Apple's Use secure token, bootstrap token, and volume ownership in deployments article (external link) to learn more.

Configure the Default Credential

Follow these steps to configure your local account with volume owner permissions as the default credential:

Note: The credential you add in this step must be the local administrator account with secure token permissions you created using the NinjaOne Endpoint Management: Secure Token Automation Scripts. If you have not yet set up this account, complete that step before continuing.

In NinjaOne, navigate to Administration → Organizations. Select an organization.
Open the Credentials section and click Add Credential.

organization_add credential.png — **Figure 1**: Add a credential for a NinjaOne organization (click to enlarge)

In the New Credential dialog, select the credential type. The option you select from this drop-down menu will affect what type of data you are required to provide in the next steps.

new credential_select type.png — **Figure 2**: Select credential type (click to enlarge)

Enter the username and password for the local administrator account with secure token (volume owner) permissions you set up for this purpose, then click Add.
Open the Defaults tab in the Credentials section. Click the Mac Script drop-down menu and select your new credential. When finished, click Save.

credentials_defaults_mac script.png — **Figure 3**: Select credential default for macOS scripts (click to enlarge)

Activate and Configure macOS Patch Management

To activateOS patching for a macOS endpoint policy, perform the following steps:

Navigate to Administration → Policies → Agent policies. Select a policy.
Open the OS patching section and activate the Status toggle.

**Figure 4:** OS patching → Enable OS patching (click to enlarge)

Scroll to configure patching settings for the policy.

OS Patching Configuration Options Explained

You can configure the following software patch management parameters. When finished, click Save.

Setting	Description
Scan and Update schedules	These parameter sets determine when the device will scan for available new patches, and when it will apply those updates. Schedule: Choose the scan or update frequency. Depending on your selected interval, choose the days, weeks, or months on which NinjaOne performs the action. If you select a frequency: NinjaOne only patches devices on the days chosen. If you select no days, NinjaOne will display an error message. If you select None for the scan schedule: NinjaOne will not automatically scan for new patches. Technicians can still run manual scans at any time. If an active update schedule is running, NinjaOne will run a pre-patch scan automatically when the update cycle begins, but patches will not be found or presented for approval between update cycles. If you select None for the update schedule: NinjaOne will not automatically apply patches. Patches will still be found and presented for approval if a scan schedule is active. Time and Time Zone: Select the time of day and the appropriate time zone to perform the action. By default, scans start at 8 A.M. local device time, and updates start at 5 P.M. local device time. These defaults only apply to new policies. Stagger over: Set a stagger interval to distribute patch installation times across your devices and avoid simultaneous updates. For more information, refer to NinjaOne Patch Management: Load Balancing Patch Installations With the Stagger Feature. Duration: Set the maximum amount of time for the agent to run an action before stopping. This setting applies to both scheduled and manually initiated actions. Run scan immediately, if missed: Select this checkbox to run a scan immediately upon saving your settings. (Scan schedule only) Apply immediately: Select this checkbox to have the system apply patches immediately when it finds them in a scan. (Scan schedule only) Run update immediately, if missed: Select this checkbox to run an update immediately. (Update schedule only) Maintenance Mode: Suppress Emails/SMS/Push notifications: Select this checkbox to prevent NinjaOne from sending alerts caused by actions occurring during the update (such as device reboots). You can refine this setting by selecting the Suppress condition alerts and Suppress notification channels checkboxes. Refer to NinjaOne Platform: Maintenance Mode for more information. (Update schedule only)
Reboot options	These settings let you specify reboot behavior after NinjaOne patches a device. You can configure settings for both logged-in and logged-out users. If an end user interacts with a reboot prompt, NinjaOne will display an activity in the device's Activity feed. Refer to Device and System Activity Notification Feed for more information. Reboot options: Logged-in user: You can configure the following settings: Prompt to reboot until reboot accepted: NinjaOne will display an on-screen prompt instructing the user to reboot and allow the update to complete. Use the scheduling options to determine the prompt frequency. Select the Force reboot after checkbox to set the number of prompts before NinjaOne automatically reboots the device. Select the Custom reboot dialog checkbox to replace the default prompt with your own text. Notify the user, then reboot: Choose this option to send the user a notification, then automatically reboot the machine and complete the update. Refer to NinjaOne Platform: Notification Channels for more information. Use the scheduling options to determine how long NinjaOne should wait before sending the notification and triggering the reboot. NinjaOne will display your chosen prompt schedule in this section. Automatically reboot: This option tells NinjaOne to reboot the device after the update installation is complete. Use the scheduling options to determine how long NinjaOne should wait before rebooting the device. Time Period and Unit: If you selected Prompt the user to reboot until reboot accepted, use these fields to specify the prompt frequency. Select the checkbox to force a reboot after a specific number of prompts. Custom Reboot Dialog: Select this checkbox to add custom text to the reboot prompt. Reboot options: Not logged in user: You can configure the following settings: Attempt to reboot until successful: NinjaOne will keep trying to reboot the device, even if reboots fail, until it completes the action. Use the scheduling options to determine the reboot attempt frequency. Reboot immediately: NinjaOne will reboot the device as soon as the update is ready. Schedule: Use the drop-down menu to choose the prompt frequency. Time and Time Zone: Select the time of day and appropriate time zone to perform the reboot.
General approvals	Configure automatic patch approval settings. You can choose to Approve,Reject, or require Manual approval for patches in two categories: Critical: Patches associated with a known CVE Unassigned: All other patches
Approval overrides	Set NinjaOne to override your patching policy for specific patches. Click the link to open the Overrides list, then search for the patch name. Use the second drop-down menu to select whether to approve or reject the patch. Examples of scenarios in which patches would appear in the Overrides section: If the category approval is set to Manual, and you then approve or reject the patch for the policy. If the category approval is set to Approve, and you then manually reject the patch for the policy. If the category approval is set to Reject, and you then manually approve the patch for the policy.

**Figure 5**: OS patching configuration settings (*click to enlarge*)

Run a macOS Patch Cycle on Demand

You can run a patch scan and installation cycle on a macOS device with patch management activated at the policy level at any time by following these steps:

From Administration → Policies, click the number hyperlink in the Devices column.
Click the device name to navigate to the device dashboard.
Move your mouse cursor over the Run icon, then use the drop-down menus to select OS Update → Scan or OS Update → Apply. You can also perform this action from the Devices search page or the global search tool.

**Figure 6:** Action → Patching → OS scan (click to enlarge)

Additional Resources

Refer to the following articles to learn more about macOS patching in NinjaOne:

NinjaOne Patching: Apple macOS Patching Policy Setup

Topic

Environment