Troubleshooting Mac patching

This article provides you information on troubleshooting Mac patching-related problems.

Miradore provides information about patch deployments, for example, on the Patches page, Action log, and Device page, as explained in the Patch reporting article.

If you run into a patching-related problem, read the subsections in this article.

Prerequisites of the patching feature

Patching for macOS is available for devices running the following macOS versions:

• Catalina (macOS 10.15)
• Big Sur (macOS 11)
• Monterey (macOS 12)
• Ventura (macOS 13)
• Sonoma (macOS 14)

Patch installation method

The patch installation method, which the software vendors define, can be one of the following:

• Automatic - The patch is installed automatically.
• Manual - The Miradore client cannot download and install the patch, so the device user must do it manually.
• Partly manual - Some language versions of the patch require manual installation.

Notifications and alarms sent by the Miradore client

• Allowing notifications and alarms to be displayed on your device
  When an alarm or notification is about to show for the first time, the macOS system displays a pop-up for the device users to give authorization for showing notifications from the Miradore client.
  If these are allowed, device users get notified, for example, about the need to restart the device after a patch is installed.
  
  If device users don’t allow the notifications, the Miradore client is not able to show the restart requests.
  Note: This setting can be modified in the System Settings option of the OS after the first notification has been displayed to the user.
• Notifications for device restart
  When it is required, the Miradore client displays a notification to restart the Mac device to complete the software patch installation.
  

Notification that patched computer will restart in 60 seconds

After an OS patch is installed, the macOS operating system sends a notification that the patched computer will restart in 60 seconds.

Note: If you ignore this notification, the computer does not restart after the 60 seconds elapse. Your computer restarts only if you hover over the notification, and select Restart.

If you allowed previously the macOS client to show notifications on your computer, in 0-10 minutes after the macOS notification is displayed, the macOS client displays a more user-friendly restart notification.

Note: If you previously did not allow the macOS client to show notifications on your computer, to receive the more user-friendly restart notifications, navigate to System Settings > Notifications > Miradore client notification and allow the notifications.

Hover over the restart notification to select if you want to restart the computer, or delay the restart.
The computer does not restart if you:

• Dismiss the restart notification.
• Ignore the restart notification.
• Select Not now.

If you delay restarting your computer, the restart notification is displayed again in about 24 hours, or if you select Start patch installation now in the Actions menu in Miradore.

OS upgrade limitation

The patch library provider we use for patch management lists patches only for the minor OS versions. Due to this limitation, you can update only to minor OS versions through Miradore.
For example, from OS version 13, you can update to 13.1, but you cannot upgrade to version 14.
To upgrade the OS to a major version, use the Software Update option of your Mac and follow the standard software upgrade process. The menu path to the Software Update option may differ in different macOS versions. Learn more about Apple's instructions on updating software.

Identical URLs used in different patch versions

Some software vendors use the same URL for distributing the different patch versions of the product. The URL today points to one software version, but the same URL tomorrow may point to a newer version.
The patch library provider used by Miradore might not update the version data in sync with the software vendors, meaning that the latest version in the patch library might differ for a while from the latest release.

If the patching URL contains a different version than the one to which the device is trying to update, the patching process stops, and the device is not updated.

The device is patched after the patch library contains the latest software version that the vendor provides.

Note: If automatic patching fails five times, the patching can be started manually from the Device page (Management > Devices > Device) with the Start patch installation now action.

Preventing OneDrive double installations on devices

Issue: OneDrive under macOS can have two different bundle IDs.

If you install OneDrive through VPP, as recommended, OneDrive will get the com.microsoft.onedrive.mac bundle ID. If patch management is enabled on the device and OneDrive needs a patch installed, during the patching process, the new OneDrive versions is downloaded and installed from the third-party patch provider, or from Microsoft. This OneDrive version receives the com.microsoft.onedrive bundle ID, which is different from the bundle ID received during the VPP installation.

Workaround: If you install OneDrive through VPP, apply the application update policy and exclude OneDrive from patch management.