When a macOS device is not receiving an update you expect, the cause is almost always one of a handful of macOS-specific conditions rather than a problem with the policy itself. Automox depends on Apple's native update mechanism for operating system updates and on each application's own updater for third-party apps, so start by identifying which type of update is missing, then work through the checks for that type.
Applies to
- macOS devices that are not installing an expected operating system or third-party update.
- Administrators troubleshooting why a Mac shows no available update, or shows one that never applies.
Step 1: Identify which type of update is missing
-
macOS operating system updates are detected and applied through Apple's native
softwareupdatemechanism. These fail for reasons tied to Apple, Secure Token, and reboots. - Third-party application updates are applied through each app's own installer or updater. These fail for reasons tied to permissions and whether the app is in use.
Confirm the device has completed a recent scan first: open the device page and check Details → Software, comparing Installed Version to Available Version. If the device has not scanned recently, or shows a stuck inventory, resolve that before going further.
macOS operating system updates not applying
1. The service account is missing a Secure Token or Volume Ownership (Apple Silicon and FileVault). On Apple Silicon and FileVault-enabled Macs, the Automox service account must hold a Secure Token and Volume Ownership to install operating system updates. Without it, updates are detected but do not install. See Automox Service Account: Secure Token Troubleshooting Guide and Why Am I Being Asked for _automoxserviceaccount's Password?
2. Apple's softwareupdate is not offering the update. Automox can only apply what Apple's softwareupdate reports as available on that specific device. A device may be offered only a minor update and not a major upgrade, or an MDM software-update deferral profile may be hiding newer releases. If the update does not appear in Apple's own Software Update on the device, Automox will not see it either. See Why an update or patch does not appear in Automox.
3. The agent version is behind. Support for newer macOS releases is added in newer agent versions, so an outdated agent may not detect or surface the newest operating system upgrade. Confirm the agent version on the device page (or with amagent --version), update it if it is behind, and rescan.
4. The update downloaded but has not been finalized by a reboot. For macOS operating system updates, an activity log entry of "Installed" often means the update was downloaded and staged, not fully applied. The device continues to report its old OS version until it reboots, and on Apple Silicon a major upgrade is deliberately deferred to install during the reboot. Confirm the device actually rebooted, and check the Requires Reboot field on the device page.
5. The device could not reach Apple's Software Update server. If the install fails with a message such as "Didn't get a response from the Apple Software Update server," the device could not reach Apple's update service at run time. Confirm outbound access to Apple's software update endpoints and retry.
Third-party application updates not applying
1. The agent is missing Full Disk Access. A common third-party failure on macOS returns rc=100 because the helper lacks Full Disk Access. See Third-Party Patch Fails on macOS with "Requires Full Disk Access (rc=100)".
2. The application is open or in use. Some applications can only update when they are closed. Schedule the policy for a window when the app is likely closed, or plan for it to be closed during the run.
3. The title is not being surfaced. Confirm the title is not set to Ignored, and that a scan has run since the newer version became available. See Why an update or patch does not appear in Automox.
Other things to rule out
- The device shows "Not Compatible." The device or target update may not be compatible. See Device is Showing as "Not Compatible".
- The tray shows "All Up to Date" while patches are pending. See Why the Automox Tray Shows "All Up to Date" When Patches Are Pending.
When to contact Support
If the update still does not apply after the checks above, contact Automox Support with the device name or ID, the policy involved, and the logs. For macOS update logging, see How to Retrieve macOS Install.log to View Software Update Logging, and include the agent log from /var/log/amagent.log.