Help, there’s a Mac on my network (12): there is no Patch Tuesday

Episode 12 of the series Help, there’s a Mac on my network.

What happened

A Tuesday evening in September. Ruud was on the sofa at home when his phone lit up. Marieke, in the team chat: “New macOS! It’s called Golden Gate. Looks gorgeous. Took a while, but it works.”

Ruud read it twice. Then he checked the calendar. It was not the second Tuesday of the month. There was no Patch Tuesday. There was no test group, no approval in WSUS, no change request. There was just a managing director with a MacBook Air and a button that said “Upgrade”.

The next morning Marieke was already at his desk. “The accounting app shows a message about something with Intel. And the VPN won’t connect anymore. But apart from that it’s really lovely.”

Ruud took a sip from his mug (“Have you tried turning it off and on again?”) and sighed. “With Windows I knew exactly when it was coming. Second Tuesday, evening our time. You could set your watch by it. Here it just shows up… whenever it feels like it?”

Sam swivelled his chair round. “Can I just? It’s actually quite predictable. Just on a different rhythm. And we could have held it back.”

“Held it back,” Ruud repeated slowly. “That’s possible?”

“Ninety days,” said Sam. “If you set it up.”

Ruud put his mug down. That was, he admitted later, the moment he decided this would be the last upgrade that ever took him by surprise.

What’s really going on

Windows admins grew up with a fixed beat: security updates on the second Tuesday of the month, and once a year a feature update that you schedule yourself with rings and deferrals. Apple works differently. There is no fixed patch day. There is a rhythm, though, and you can learn to read it.

• One major macOS a year. Apple shows the new version at WWDC in June, three months of betas follow, and the release lands in September. This year that’s macOS 27 Golden Gate. Apple calls this an upgrade.
• Point releases. Then come 27.1, 27.2 and so on, roughly every month or two, with bug fixes, security fixes and sometimes new features. Apple calls this an update.
• Security updates outside the rhythm. If a flaw is being actively exploited, the fix ships when it’s ready. That might be a Tuesday. Or a Saturday.
• Background Security Improvements. Since macOS 26.1, Apple can ship small security fixes, mostly for Safari, WebKit and system libraries, without a full update. You spot them by a letter after the version number, like 27.1 (a). They ignore the normal deferral period, but they only apply to the latest point release. Hold that back and you hold these fixes back too. They used to be called Rapid Security Response.
• Older versions. In practice the two previous major versions keep getting security updates for a while. But Apple itself says that not all known issues are fixed in older versions. Only the latest version is fully patched. Staying behind is a choice with a price tag, not a safe harbour.

And the cherry on top: Golden Gate is the last macOS where Intel apps simply run through Rosetta 2. Hence the message in the accounting app. It still works, but it’s a warning that next year it won’t. VPN clients are a different story: they hook deep into the system with network extensions, and after a major upgrade the vendor often needs to ship a new version. At Bolderman it arrived two days later.

How to fix it

The translation table

The update plan for next year

1. Turn on deferral for major upgrades. On a supervised Mac, Apple lets you defer upgrades, updates and other system updates by up to 90 days each. In Intune you’ll find this in the settings catalog, under Restrictions, in the Enforced Software Update Delay settings and their Major OS and Minor OS variants. Advice for a small business: major upgrades 60 to 90 days, point releases short or not at all. Security is something you want fast.
2. Set deadlines with DDM. Intune manages Mac updates through Apple’s declarative device management (DDM). Under Declarative Device Management, use Software Update Enforce Latest with a number of days and an install time, or Software Update with a fixed target version and date for a controlled rollout. The Mac handles the rest itself: notify, download, prepare, install. Apple has deprecated the old MDM update policies, so don’t start there.
3. Build rings, even if they’re called something else. Ring 0 is IT, ring 1 is a handful of willing colleagues, ring 2 is everyone else. Each ring gets its own policy with a later deadline. And yes, the managing director is in ring 2. However good her feeling about it.
4. Test from June, not from September. AppleSeed for IT gives you betas and a way to send feedback to Apple. You sign up with a Managed Apple Account from Apple Business. Put the beta on a test Mac, not on Karin’s, and check your critical apps over the summer.
5. Make an app checklist. Accounting software, VPN client, security agent, printer drivers, Office. Ask every vendor when they’ll support the new macOS. Use System Information, under Software and Applications, to see which apps are still Intel. After Golden Gate, Rosetta goes away for regular apps, so you want that list now.
6. Leave Background Security Improvements on. With DDM you can enforce them, turn them off or block their removal. Advice: automatic install on, removal off. Fast fixes are exactly what you want.
7. Tell your users. One email in September saves ten phone calls: “There’s a new macOS. You can’t see it yet, that’s right. We’re testing first. Around December you’ll get a notification with a date.” Add a link to a short explainer page in your DDM policy, so people click that instead of Upgrade.

Ruud’s lesson

Patch Tuesday was never the real safety net. The real work was always testing, planning and telling people what’s coming. That work is exactly the same on the Mac. Only the calendar is different, and you get to fill it in yourself.

Later that week, at the coffee machine next to the server cupboard (where the mop now has its own hook), Ruud said something Sam would never forget. “You know, that Mac. It’s actually pretty fine.” He glanced at his mug. “Don’t tell Marieke. And Sam, thanks. Without you I’d still be looking for the right mouse button.”

Sam grinned. Marieke walked in with an iPad under her arm. “Ruud, I bought an iPad. Everyone had one.”

To be continued. Maybe.

Further reading: End of Rosetta: what happens to Intel apps on the Mac, EWS and Apple Mail and Apple Business, Entra ID and Intune for small businesses.

This is episode 12 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.