Installing Updates with Managed Software Center

When Managed Software Center launches on a Mac client, it will connect to the Multi-Tenant Munki server, determine what software is available for that computer, and download and display all available updates. The end user can then install the updates by clicking the UPDATE or UPDATE ALL button (depending on how many updates are offered). Users may re-check for available updates by clicking the CHECK AGAIN button.

Managed Software Center will automatically check for available updates in the background (by default once every 1-2 hours) but will not display anything to users unless there are available updates.

Installing Software via the Self-Service Catalog

Managed Software Center also acts as a self-service software catalog from which users can install additional software on-demand. Users are NOT required to be administrators on their computers to use the software catalog. To access the software catalog, select the Software tab from the Managed Software Center navigation sidebar. Managed Software Center will then display all of the software that has been made available for the computer by the local IT department. Please refer to our article on manifests for more information on which applications are displayed in Managed Software Center. Users also have the ability to search for specific software and they can click a software's name to view additional information about a particular piece of software.

Once the end user has identified the software they would like to install, they may click the INSTALL button located next to the software listing to trigger an install.

User Notifications

Beginning with macOS 10.13 (High Sierra), Munki and Managed Software Center have used the macOS Notification Center to notify the end user about available software updates. Modern versions of macOS require that the end user (or an MDM such as Workspace ONE) grant Notification Center access to Managed Software Center. If Notification Center access to Managed Software Center is not approved, the device may fall behind with updates.

Update Encouragement

Managed Software Center provides encouragement and cues intended to guide end users to install updates in a timely fashion. This default behavior may not be disabled.

• Any updates pending for more than two days will be flagged.
• If the user attempts to quit Managed Software Center when any update has been pending for more than 14 days, a "Pending updates" reminder is presented, and the "Quit" button is disabled for 5 seconds. Managed Software Center will quit on the second try.

In addition, Munki can step up to "aggressive update notification" mode to further discourage end users from deferring updates. In this mode, if the user attempts to quit Managed Software Center when any update has been pending for more than 14 days:

• Only the Updates tab is available
• Access to the Command-Tab task switcher and Dock is removed
• The ability to click other applications to switch to them is blocked
• Other applications appear grayed out
• Force-quit is blocked
• Several other items in the Apple menu are disabled

Aggressive update notification mode can be configured to shorten or lengthen the default interval of 14 days by using one of the following optional configurations available in the Multi-Tenant Munki service.

• Munki - 7 Days Before Aggressive Update Notification
• Munki - 21 Days Before Aggressive Update Notification
• Munki - 28 Days Before Aggressive Update Notification

Aggressive update notification mode may also be disabled with the following configuration, although Endpoint Services advises against its use in most cases in order to avoid unpatched and vulnerable systems.

• Munki - No Aggressive Update Notification

Managed Software Center and Apple Updates

Previously, Macs onboarded to Multi-Tenant Munki (MTM) were configured so that Munki checked for available Apple software updates, listed them in the Managed Software Center updates pane, and either installed them (on Intel hardware where no restart was required) or (in all other cases) redirected the logged-in user to System Settings - Software Update to install the updates.

In June 2023, Endpoint Services modified the default MTM behavior so that newly onboarded (or re-onboarded) Macs will NOT check for Apple software updates during Munki runs. None will be listed in Managed Software Center (MSC), and MSC will not direct the end user to System Settings - Software Update. Instead, end users must rely on notifications from System Settings - Software Update to stay on top of Apple software updates.

This change only affects newly-onboarded or re-onboarded clients. So that both new and existing Macs are configured identically, Munki admins may choose to add the following title to unit manifests: munkitools_config_do_not_installapplesoftwareupdates.

The following information applies whenever Munki is still configured to check for Apple Software Updates:

Managed Software Center and Apple Updates (Apple Silicon Hardware)

On Apple Silicon hardware, Munki will not attempt to install any Apple software updates.

Managed Software Center and Apple Updates (Intel Hardware)

In the following screenshot, Managed Software Center offers a typical set of updates, including an Apple update that requires a restart:

When "Update All" is selected, Munki displays a dialogue directing users to use System Preferences - Software Update to install the Apple update that requires a restart:

If the user clicks "Skip these updates", the Apple update requiring a restart is removed from the list of updates in Managed Software Center. Clicking "Update All" will install the remaining updates in the usual fashion. At the next Munki update check, any skipped Apple updates will be offered again.

However, if the user clicks the "Install Now" button, Munki will launch System Preferences - Software Update.

If the user selects the "More info" link, all pending Apple Software updates are displayed with additional information, including an "Install Now" button:

• If the user selects "Install Now", the update will proceed; after a restart, Munki will install any remaining updates. Unlike major version upgrades, Apple Software Updates can be performed by standard/non-admin accounts.
• If the user instead selects "Close" and then quits System Preferences, no updates will be installed, Apple or otherwise, and Munki will re-offer the updates at the next update check.
• Action is required to initiate the software update. Apple Software Updates will not begin automatically without user action.

Note that the major macOS upgrade offer (in this example, for Big Sur on a Catalina system) is prominent, and might mislead the user into incorrectly selecting "Upgrade Now" instead of correctly selecting the "More info" link. While Apple does provide a mechanism to suppress major OS upgrade offers, this functionality requires MDM enrollment. Standard/non-admin accounts can click the "Upgrade Now" button to download a macOS upgrade installer, but administrator credentials are required to perform the upgrade itself.