Auto Update

Automatically adjust Trust Levels and enforce security policies based on whether a device installs operating system updates on its own

  • Last validated: Oct 16, 2026
  • Contributors

Auto Update Overview

Auto Update assesses whether a device installs new versions of its operating system automatically. The point of the factor is to keep devices off operating system versions with known vulnerabilities, so the app looks at whether updates install, not only whether the device checks for them. A device that checks for updates and then waits for a person to click Install does not satisfy the factor. Which updates have to install automatically depends on the operating system, so read the collection rules for the operating system you support.

How to add Auto Update as a Trust Factor

  1. In the Command Center, navigate from Trust > Profiles.

  2. Either select an existing Trust Profile or create a new one.

  3. Under the Trust Factors tab, select + Add Trust Factors if creating a new Trust Profile; select Edit and then +Add Trust Factors if adding new Trust Factors to an existing Trust Profile. Select Auto Update.

  4. Set the Trust Effect.

How Cloud Secure Edge Collects the Auto Update Trust Factor

OS Command Input Expected Output
macOS The app reads five keys from /Library/Preferences/com.apple.SoftwareUpdate.plist. See macOS. 1 for CriticalUpdateInstall
Windows (v.4.7.0 and later) The app calls IAutomaticUpdatesSettings::get_NotificationLevel. 4
Windows (pre v.4.7.0) echo (New-Object -com Microsoft.Update.AutoUpdate).Settings.NotificationLevel 4
Linux cat /etc/apt/apt.conf.d/10periodic and cat /etc/apt/apt.conf.d/20auto-upgrades  

macOS

On macOS the app does not read a single setting. It reads five keys from /Library/Preferences/com.apple.SoftwareUpdate.plist and reports each one to the Command Center as its own field.

Property list key Reported as What it controls Value when the key is absent from the file
AutomaticallyInstallMacOSUpdates updates_install_enabled Installing macOS updates without a person approving them false
CriticalUpdateInstall updates_install_critical_enabled Installing security responses and critical updates true
AutomaticCheckEnabled updates_check_enabled Checking Apple for available updates true
AutomaticDownload updates_download_enabled Downloading an available update in the background true
ConfigDataInstall updates_install_system_enabled Installing system data files true

Two rules in that table surprise people, so read the last column carefully:

  • AutomaticallyInstallMacOSUpdates counts as false when the key is missing, because macOS ships with full automatic macOS installs turned off.
  • The other four keys count as true when the key is missing, because macOS ships with those turned on. macOS writes a key into the file only once something changes the setting, so a missing key means the device still holds the Apple default.

CriticalUpdateInstall is the key that decides the result. Security responses and critical updates are what close known operating system vulnerabilities, so a macOS device satisfies Auto Update when critical updates install automatically. Full macOS version installs are not required.

Why a macOS device can pass with AutomaticallyInstallMacOSUpdates set to 0

Running this command on a device returns the state of one key, not the result of the Trust Factor:

defaults read /Library/Preferences/com.apple.SoftwareUpdate.plist AutomaticallyInstallMacOSUpdates

0 means false and 1 means true. A device that returns 0 has turned off unattended installs of full macOS versions. That device still satisfies Auto Update as long as CriticalUpdateInstall is enabled, which it is by default. To see every value the app actually used, check the desktop app logs for the New Features entry, which lists all five updates_ fields.

Was this page helpful?