Control OS policy 

The Control OS Updates device policy lets you deploy the latest OS updates to supervised iOS devices. You can specify how frequently XenMobile checks the device OS and deploys updates.
​There are two options-:

1. Download Only

   This option will just download OS update and customer can install the update themselves by going into Upgrade section.

2. Download and/or install 

This option is for download and install both. The update will be downloaded to device on the first OS update period (defined by OS update frequency), and the user will be prompted to install this update on the next OS update period, provided they have a passcode set, otherwise the install will proceed automatically. 

​OS update frequency:

This Determines how frequently XenMobile checks and updates the device OS. The default is 7 days(value can be between 1 to 365 days). 

The device prompts users to install updates, if it has a passcode set. The prompt is visible only after the user unlocks the device. 
 

User Experience  

The user will receive an install prompt to “Install Now” or “Later”. Pressing “Install Now” will start the update process immediately. Pressing “Later” and entering the passcode will schedule the update to install overnight without further prompts. Initially there is also a 3rd option, after pressing "Later", at the bottom of the screen to defer installing. The user can only defer a limited number of times after which this option will disappear, and they will only get the "Install Now" or "Later" options.

Frequently asked question

Question: Does Control OS update policy install the updates automatically on the supervised devices?

Answer:

If the device does not have a passcode set, yes. Otherwise the user will be prompted at least once for which action they would like to take (see User Experience).

Question: Does this behavior only apply to DEP enrolled devices?

Answer:

As per :  https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/3-MDM_Protocol/MDM_Protocol.html#//apple_ref/doc/uid/TP40017387-CH3-SW302
Only Supervised DEP-enrolled iOS devices and DEP-managed Mac computers are eligible for software update management. However, the AvailableOSUpdates query is available to non-DEP managed devices. You can check the following
 
The use case for this policy is Supervised vs Non-Supervised, in the sense that a Supervised Corporate DEP device should be controlled and why Apple does not allow the ability to delay the update too much. Non-Supervised devices use a different policy, because you cannot force the user to update on a non-Supervised device only download and install at their acceptance. Any timer is purely OS behavior and nothing MDM can control.
 

Question: Where can I find the most up to date and accurate information from Citrix about the Control OS Update Device Policy?

Answer:
Citrix Endpoint Management:
https://docs.citrix.com/en-us/citrix-endpoint-management/policies/control-os-updates.html

XenMobile Server:
https://docs.citrix.com/en-us/xenmobile/server/policies/control-os-updates.html

 

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

This article summarizes the functionality of Control OS policy along with general asked question.