N-1 Patching Strategy for macOS with Hexnode UEM

An organization manages a fleet of Mac devices running business-critical applications that have been validated against a specific macOS version. When a newer macOS release becomes available, deploying it immediately across the fleet could introduce compatibility or stability issues before the organization’s environment has been fully tested against the new release.

Hexnode UEM addresses this requirement by allowing organizations to continue deploying applicable earlier macOS updates while holding back adoption of the newer release until it has been evaluated for their environment.

macOS Patching Strategies

A patching strategy defines how macOS updates and patches are selected for deployment on managed devices. It helps determine whether devices should receive all applicable updates or whether deployment should be limited to earlier updates that have been superseded by newer releases.

Hexnode UEM provides two patching strategies for macOS updates and patches:

• All Applicable Patches
• Superseded Only

All Applicable Patches deploys all macOS updates and patches applicable to the device, regardless of whether they are the latest available updates or older updates that are still missing.

Superseded Only deploys superseded updates—earlier updates that have been replaced by newer updates, allowing devices to remain on an earlier macOS version while providing flexibility to control the version deployed.

Understanding Superseded Only

An update is superseded when it has been replaced by a newer update. The superseded update remains available as an earlier release, while the newer update becomes the latest available release.

This strategy provides control over how far back from the latest available release the deployment can go or allows a custom version range to be defined when the available options do not meet the organization’s requirements.

Choosing Which Superseded Update to Deploy

Superseded Only provides options to control which earlier macOS version is deployed relative to the latest available version. The option can be selected based on how far behind the latest available version the deployment should be, or a custom version pattern can be defined when more specific control is required. The available options are:

1. N-1

   Restricts updates to the version immediately preceding the latest available version (N).

   For example, if macOS 15.4 is the latest available version, N-1 refers to macOS 15.3. Selecting N-1 allows devices to remain on the release immediately before the latest version while the newer release is being evaluated.

2. N-2

   Restricts updates to an older version, keeping the device two versions behind the latest available version (N).

   For example, if macOS 15.4 is the latest available version, N-2 refers to macOS 15.2.

3. Advanced Control

   Advanced Control allows a custom macOS version pattern to be defined using a regular expression (regex). This provides greater control when the required deployment criteria do not align with the standard N-1 or N-2 options.

   To configure version pattern:

   1. Under Regex Match Target, select the OS Version or Build Version against which the regex should be evaluated.
   2. Under Regex Pattern, enter a regular expression that matches the required OS version or build version.

   For example:

   When Build Version is selected,
   ^25G\d+$ matches build versions that begin with 25G, followed by one or more digits.

   When OS Version is selected, the regex
   ^15\.[0-9]+\.[0-9]+$ matches versions that begin with 15, followed by two numeric components separated by periods. For example, it matches 15.0.0, 15.1.0, 15.2.3, and 15.10.2, as well as other versions that follow the same format.

   3. Select Test your regex to verify whether the entered pattern matches the available OS or build versions.
   4. If the pattern matches multiple updates, select whether to deploy the highest or lowest matching version.

Configure Patching Strategies

To configure these patching strategies for automatic macOS patch deployment, see

Automatic deployment of Patches and Updates for Mac
.