Testing software updates with the AppleSeed for IT beta program
AppleSeed for IT is a program specifically designed for enterprise and education customers committed to testing each new version of Apple beta software in their organizations. This program provides IT professionals and technology managers with an opportunity to evaluate the latest prerelease software versions in their unique work environments, offer feedback directly to Apple engineering teams through a dedicated feedback submission process, and participate in detailed testing plans and forum discussions with other participants.
iOS 17.5, iPadOS 17.5, macOS 14.5, or later, make it easier than ever to manage beta program participation in an organization. Users can be offered to enroll into beta programs even without an Apple Account in Settings or System Settings. MDM solutions can also automatically enroll devices during Setup Assistant when using Automated Device Enrollment or remotely at a later time if the device is supervised and runs iOS 18, iPadOS 18, macOS 15, or later. If necessary, an MDM solution has the option to remove a supervised device from beta programs and restrict a user from manually enrolling. This removes the need for manual steps performed by the user and allows for a streamlined process throughout the beta testing lifecycle.
To offer AppleSeed for IT beta versions without the need for an Apple Account, a user with the role of administrator in Apple School Manager or Apple Business Manager must sign in to the AppleSeed for IT portal and accept the terms and conditions on behalf of their organization for the current beta period.
Although beta enrollment can be managed without the need for an Apple Account, organizations may want to consider providing participating users a Managed Apple Account so they can submit feedback directly to Apple. This also ensures submitted feedback is tied to their organization. If users select to submit their feedback for the team rather than as personal feedback, other users like the IT team can engage in submitted tickets and stay informed. For more information on team feedback, see Manage team feedback in Feedback Assistant on Mac in the Feedback Assistant User Guide.
Similar to software updates and upgrades, beta releases provided by those programs can be deferred on supervised devices and a declarative status report provides increased visibility and allows organizations to track beta program enrollments on managed devices.
Using the available configuration options, an organization can remotely enroll different devices into different beta programs and—combined with the option to defer beta and production releases—can be used to implement a phased testing and rollout approach starting right with the first beta release.
Note: The beta configuration and status report isn’t supported on devices using User Enrollment.
Enrolling a device in a beta program
To enroll a device in the Apple Beta Software Program or AppleSeed for IT, an MDM solution must retrieve a token from Apple and provide it to devices during Automated Device Enrollment or using the com.apple.configuration.softwareupdate.settings declaration.
The first step is for a user with the role of administrator in Apple School Manager or Apple Business Manager to enroll at https://beta.apple.com/for-it. After enrollment, an MDM solution can request available beta program tokens using the https://mdmenrollment.apple.com/os-beta-enrollment/tokens endpoint. Similar to other service endpoints available at mdmenrollment.apple.com, MDM solutions must authenticate using OAuth.
The HTTP GET request must include the following header fields (all required):
HTTP header field | Description | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| The OAuth token to authenticate the request. For more information about the authentication process, see Authenticating with a Device Enrollment Program (DEP) Server on the Apple Developer website. | ||||||||||
| Must be set to value: 1 | ||||||||||
The service endpoint returns a JSON object with the following structure:
{ "betaEnrollmentTokens": [ { "token": "p3ySHD3CiWtpsH1DKS8sVdv9BgmFbRDh31xJH2584wJ5AngrYoReFB4MVY53rucW", "title": "macOS AppleSeed Beta", "os": "OSX" }, { "token": "35b68K477rAsry6dxiDJBnE7AvjRTueUXFa9jZ3ZhQSFpJZ3Jxz9M8mCt9UXK4Sg", "title": "iOS 18 AppleSeed Beta", "os": "iOS" } ]}To enroll a device into a beta program, the RequireBetaProgram dictionary must contain the keys shown below (all required strings).
Key | Description | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| A human-readable description of the beta program. | ||||||||||
| The seeding service token for the organization that the MDM server is part of. This token is used to enroll the device in the corresponding beta program. | ||||||||||
The following is an example response making use of the described keys:
{ "code": "com.apple.softwareupdate.required", "description": "AppleSeed enrollment required", "message": "This device needs to be enrolled into the AppleSeed Beta program", "details": { "OSVersion": "18.2", "RequireBetaProgram": { "code": "iOS 18 AppleSeed Beta", "token": "35b68K477rAsry6dxiDJBnE7AvjRTueUXFa9jZ3ZhQSFpJZ3Jxz9M8mCt9UXK4Sg"," } }}The token is unique for each organization and can’t be reused across different Apple School Manager and Apple Business Manager organizations. The token is also specific to a certain operating system upgrade seeding period. The title is a human-readable description of the beta release and os can contain the following values: iOS (includes iPadOS), OSX (macOS), tvOS, watchOS, or xrOS (visionOS).
After an iPhone or iPad is enrolled into device management, an MDM solution can enroll or unenroll supervised iPhone or iPad devices from beta programs using the Beta dictionary in the com.apple.configuration.softwareupdate.settings declaration.
macOS software update or upgrade process
The OTA update method is now the preferred method for updates to macOS (however Universal Mac Assistant (UMA) updates are still available). Upgrades are now incremental patches that result in smaller downloads and faster installation. Only the components required to complete an update are downloaded, improving network efficiency by not downloading the entire operating system. The default is to have incremental upgrades and updates, but if incremental upgrades or updates aren’t available, a full replacement is installed. They require a signed system volume (SSV) and can be performed by any local user.
Mac computers receive update and upgrade notifications by the following methods:
A notification in Notification Center
In System Settings (macOS 13 or later)
In System Preferences (macOS 12.0.1 or earlier)
Important: On a Mac, any user can perform software updates. Prior to macOS 12.3, local administrators are required to perform software upgrades. With macOS 12.3 or later, any user can perform a software upgrade. On Apple silicon, users must be a volume owner to perform software updates and upgrades.
They can be downloaded, installed, or deferred—all remotely with an MDM solution—or they can be installed locally.
Remotely: MDM administrators can control how software updates and upgrades appear and automatically install and authorize them on Mac computers as long as the Mac is supervised. In macOS 11 or later, all Mac computers enrolled using either Device Enrollment or Automated Device Enrollment are supervised. For a supervised Mac with Apple silicon, there’s no need to reduce the security setting from Full Security in recoveryOS. In certain testing scenarios, however, an administrator may need to change the security policy manually from Full Security to Reduced Security. For more information, see Use macOS Recovery on a Mac with Apple silicon in the Mac User Guide.
Locally: A local administrator or standard user can also download a full installer by using the softwareupdate --fetch-full-installer command in Terminal.
For a Mac with Apple silicon, authentication requires one or both of the following:
An MDM bootstrap token for automated, non-interactive updates and upgrades
This feature requires macOS 11.2 or later, and the update being installed must be signed by Apple.
A user password for local, user-initiated, interactive updates and upgrades
Note: The user’s data volume is never mounted during a software update or upgrade. This practice helps prevent anything being read from or written to that volume during the process. For more information on the security of Apple software updates and upgrades, see Secure software updates in Apple Platform Security.