Patch Management for UAE and GCC Organisations: Windows, Mac, iPhone and iPad

Patch management process: a monthly routine in eight steps

Jump to: Windows, Mac, iPhone and iPad, third-party apps, Saudi, UAE and GCC frameworks, audit evidence, questions. The steps below work for Windows, Mac, iPhone and iPad together; the timings are an example to adapt, not a rule.

1. List what you patch: operating systems, browsers, PDF readers, meeting apps, design software and anything else installed on more than a few devices.
2. Split devices into a pilot group (IT and a few volunteers from each department) and everyone else; Microsoft calls these deployment rings.
3. When updates are released (Microsoft’s on the second Tuesday of each month, widely called Patch Tuesday, which is Tuesday evening in the Gulf, and Apple’s whenever it ships them), approve them for the pilot group the next working morning.
4. After a few working days without problems, approve them for everyone, with an install deadline.
5. Let third-party apps follow their own schedule: automatic upgrades where you trust the source, a tested new version where you do not.
6. Treat an update for a flaw that is being actively exploited as an exception: skip the waiting period.
7. Before the deadline, look at the devices that have not updated and find out why: offline, out of space, or a failed install.
8. Keep a monthly record: what was released, what was installed, which devices are behind and why.

What patch management covers, and why it matters now

Devices fall behind on updates quietly. Nobody decides to leave a laptop unpatched; it drops out of sight because it was offline, short of disk space or simply not on anyone’s list. A patch routine answers four questions every month: what was released, which devices need it, what happened when it was installed, and which devices are still missing it. Patching is one part of device management; enrolment, configuration and inventory are covered in our MDM and unified endpoint management guide.

Why this autumn matters. Apple’s enterprise notes say legacy software update management “no longer functions” on its 27.0 releases, including MDM update commands, update queries and restrictions such as deferrals; only declarative update management works. Microsoft’s release information shows Windows 11 version 24H2 Home, Pro, Pro Education and Pro for Workstations reached the end of servicing on 13 October 2026, while Enterprise, Education and IoT Enterprise editions are listed until 12 October 2027. Pro Education follows the Home and Pro dates, not the Education ones. In 2025 the UAE Cyber Security Council also urged people and organisations to keep devices updated and turn on automatic updates, as reported by WAM.

Windows patch management with FileWave

FileWave gives three ways to update Windows, and they can be combined. All three install updates with Microsoft’s own tools; the files come from Microsoft, or from a FileWave Booster that caches them. If your Macs and PCs sit side by side, our Mac and Windows device management guide covers onboarding and software for both.

• Policy over MDM. On PCs enrolled in Windows MDM through Microsoft Entra ID, a FileWave Windows profile sets Microsoft’s update policies: how long quality and feature updates wait, whether drivers come through Windows Update, active hours, install deadlines and grace periods, and whether users may pause updates. This route needs an Entra ID P1 or P2 licence (on its own or in a Microsoft 365 bundle); no other Microsoft management service is needed. Windows Home cannot join this route.
• Rule-based policy. Since FileWave 16.2, a Fileset policy applies any Windows update that matches its rules (name, critical, reboot needed, category). FileWave positions it for estates that need little oversight, or for updates you always want applied; since 16.3 such updates show as “Triggered by Policy”.
• Approve and deploy. The Software Updates view lists the updates your PCs report they need. You test one on a few devices, then deploy it to a group or to every device that requests it. Automation Rules (16.2 and later) can turn reported updates into Filesets, but FileWave’s knowledge base says that, for now, you run them by hand with the Run Automation button.

Microsoft’s limits. Microsoft now calls these settings Windows Update client policies (formerly Windows Update for Business). Quality updates can be deferred by up to 30 days and feature updates by up to 365 days, and pausing, a separate control, lasts up to 35 days. A deadline and a grace period decide when a pending restart is forced. Microsoft’s guidance is that deferral, deadline and grace period together should get a security update installed within about seven days of release, and it cautions that a grace period of zero can force a restart before users have been warned.

Reporting. Supported Windows PCs report their update status to FileWave every hour, whatever their enrolment type, with each missing or installed update’s KB number, Microsoft’s severity rating and category. Since FileWave 16.0, PCs also report updates installed outside FileWave. Branch offices on slow links can use FileWave Boosters, which cache Microsoft updates for Windows.

Check the Windows version. A PC that installs every monthly update is still unpatched once its Windows 11 version leaves servicing. Run a report of Windows versions and move any 24H2 PC running Home, Pro, Pro Education or Pro for Workstations to version 25H2 or 26H2. Windows 10 PCs are covered in our Windows 10 Extended Security Updates guide.

Mac, iPhone and iPad patching: declarative updates with a deadline

FileWave has used only Apple’s declarative device management (DDM) for Mac updates since version 15.4, which puts the floor at macOS 14. A Mac that cannot run macOS 14 is outside this route, so list it for replacement and record it as an exception until then. For iPhone and iPad, declarative updates need iOS or iPadOS 17 or later. In a DDM Software Update Fileset you name the version each device must reach and the time by which it must get there; the device then downloads, prepares and installs the update itself and reports its progress back to FileWave.

• Set the deadline yourself. If the deadline field is left empty, FileWave uses the moment the assignment is created, which can mean an install straight away. Pick a time outside working hours.
• Enforcement wins over deferral. Apple says enforcement overrides any deferral you have set. Users get reminders that become more frequent as the deadline nears; at the deadline a Mac closes open apps, even with unsaved work, and an iPhone or iPad asks for its passcode to install, so warn users.
• Deadlines across time zones. Apple’s declaration sets the deadline in each device’s local time. FileWave’s knowledge base notes that update timing is not exact, so test on pilot devices in each country, including when users first see Apple’s reminders, before relying on one deadline across Dubai and Riyadh.
• Deferrals. On supervised devices running iOS 18, iPadOS 18 or macOS 15 or later, Apple’s declarative settings can hold an update back for between 1 and 90 days from the day Apple releases it. FileWave’s own deferral article still describes the older Restrictions method, which Apple has retired in iOS 27, iPadOS 27 and macOS 27; ask us which deferral route your FileWave version supports for those devices. Our macOS 27 checklist covers holding back a major upgrade.
• Background Security Improvements. From iOS 26.1, iPadOS 26.1 and macOS 26.1, Apple can ship security fixes for Safari, WebKit and some system libraries between full updates; they took over from Rapid Security Response. FileWave 16.3 added settings and inventory fields for them, but on devices running iOS 27, iPadOS 27 or macOS 27, Apple says the older restriction settings for them no longer work, so manage them through declarative software update settings.
• Staff-owned phones. Apple does not allow updates to be enforced on devices enrolled through User Enrollment, so personal phones need a policy and reminders instead; see how staff-owned phones are enrolled.

Stay on the current release. Apple does not publish a fixed support period for older releases, and its security release notes show older versions receiving some fixes, not a promise of all. Move devices to the current release where the hardware allows. If your current MDM cannot send declarative software updates, it has no way to defer or enforce updates on devices running iOS 27, iPadOS 27 or macOS 27; our guide to moving devices to a new MDM without wiping them explains the options.

Apple devices download updates from Apple. For branch offices, Apple’s own Content Caching service on a Mac serves Apple updates locally; FileWave’s Booster documentation lists caching for Microsoft OS updates only. Company iPhones, iPads and Macs should be added to Apple Business (Apple School Manager for schools) so they are supervised when they enrol, which the deferral settings require; our Apple Business set-up guide covers that step.

Third-party patch management: browsers, PDF readers and other apps

Most browsers, PDF readers, meeting apps, runtimes and design tools are updated by their makers whenever each chooses, separately from Windows Update and Apple’s software update. FileWave deals with them app by app, with no published list of covered titles, so decide which applications your routine includes.

One trap: Fileset verification restores files that differ from the packaged version, so an app that updates itself can be put back to the old version if its Fileset is set to self-heal. Choose the verification setting per application. Packaging, revisions and rollback are covered in our remote software deployment guide.

Pilot groups, deadlines and exceptions

Microsoft recommends rolling updates out in rings, typically a preview group, a limited pilot on representative devices and then broad deployment, moving on only when agreed criteria are met. The example below shows one month for a 300-device company. The gaps are a starting point to adjust after the first two or three cycles.

If you work to the Saudi National Cybersecurity Authority’s Essential Cybersecurity Controls (ECC), add a test stage before the pilot: install each update first on non-production devices, such as a spare PC and a spare Mac, and record the result.

Exceptions. Some devices cannot take an update on time: a lab PC running instrument software, a Mac waiting for a driver, or a medical device whose maker must approve each update. Record each one with an owner, a reason and a review date rather than leaving it to drift. In FileWave, a monthly deployment reused for each cycle needs its install and restart dates moved forward each time, or new updates are past their deadline the moment they are added.

Priorities. When time is short, start with flaws listed in the free Known Exploited Vulnerabilities catalogue from CISA (the US Cybersecurity and Infrastructure Security Agency) or named in alerts from your national cyber security authority, then devices reachable from the internet, then updates Microsoft rates critical.

What Saudi, UAE and other GCC frameworks ask of patch management

Most frameworks used in the GCC ask for patching that is regular, risk-based and documented, rather than a set number of days. This is a summary, not legal advice: check the current text that applies to you.

In Saudi Arabia, NCA’s Essential Cybersecurity Controls (ECC-2:2024) cover patch management, including within vulnerabilities management (2-10), and NCA publishes free patch management policy and standard templates that ask for patches to be tested before production. Banks follow SAMA’s Cyber Security Framework, which asks for mitigation timelines by class of vulnerability (3.3.17). Saudi enquiries are handled by PRONEXT, our company in Riyadh; see enterprise IT in Saudi Arabia: NCA, SAMA and PDPL.

In the UAE, the Information Assurance Standard covers technical vulnerability management and lets entities apply some controls on the basis of a risk assessment. Abu Dhabi healthcare entities follow ADHICS, and Abu Dhabi private schools follow clause 6.1 of the ADEK School Digital Policy. Dubai Government entities, financial institutions and others each have their own information security rules.

Elsewhere in the GCC, Kuwait, Bahrain and Oman have their own national frameworks, which we have not summarised here. Wherever you operate, ask your compliance team or regulator what they expect, then build the report below around it.

Patch compliance evidence auditors ask for

• A device list with OS versions, built in FileWave Reports, showing which devices are on a release that still gets updates.
• Missing updates per device: for Windows, each update’s KB number and Microsoft’s severity rating; for Apple devices, the pending OS version reported after a declarative update is scheduled.
• The monthly record from step 8: released, approved, installed, behind.
• Exceptions with an owner, a reason and a review date.
• Last check-in times, because a device that has not reported for weeks shows old data. Our inventory guide covers reconciling the device list with the asset register.

FileWave does not publish a named patch compliance dashboard; the reports above are built from its inventory, and we can set them up with you.

What to check in patch management software, and what FileWave does not do

Whichever tool you consider, check it on your own devices: Windows, macOS, iOS and iPadOS from one console, with declarative updates for iOS 27, iPadOS 27 and macOS 27; how third-party apps are covered (a published list, a package manager or app-by-app packaging); pilot groups, deadlines and grace periods; per-device evidence an auditor can read; and whether it runs in the cloud or on your own server, with caching for branch offices. FileWave covers the operating systems, handles third-party apps one by one and runs either way. It does not do the following.

• No vulnerability scanning. FileWave reports which updates devices are missing; it does not scan networks or applications for vulnerabilities.
• No published list of third-party apps. Third-party apps are handled one by one through the routes above.
• No hotpatch. Microsoft delivers Windows hotpatch updates, which install without a restart in most months on eligible Windows 11 Enterprise PCs, only through its own Windows Autopatch service, not through FileWave.
• Firmware not covered. FileWave’s documentation covers driver updates through Windows Update, not BIOS or firmware updates, so plan those with each device maker’s own tools.
• Not antivirus. Patching closes known holes; endpoint protection is a separate product that FileWave can deploy and update like other applications.

Setting up patch management with PRO TECHnology

We are FileWave’s distributor and partner for the Middle East, and an authorised FileWave reseller in the GCC since 2009. With your IT team we set up the update policies, pilot groups and deadlines, build the reports above, train your administrators and support your team through the first monthly cycles from Dubai. We do the same work whether FileWave hosts your server or you run it on your own premises, as long as the server and devices can reach Apple’s and Microsoft’s update services; see what an on-premises server still connects to. More on the relationship is on our FileWave partnership page.

Saudi customers are served by PRONEXT, our Riyadh company. For licences and quotations in the UAE, Qatar, Kuwait, Bahrain and Oman, see how to buy FileWave.

Sources

Gathered on 23 October 2026 from FileWave’s knowledge base, Apple and Microsoft documentation and the bodies that publish each framework. These pages change, so check the source before you act on any detail.

• FileWave: Windows MDM software updates (Update Policy CSP)
• FileWave: Automated Windows OS updates policy
• FileWave: Windows software update reporting
• FileWave: OS software updates automation rules
• FileWave: OS software updates (evaluation guide)
• FileWave: Upgrading a package with WinGet
• FileWave: AutoPkg integrated with FileWave (15.5)
• FileWave: Apple MDM OS software updates
• FileWave: Apple Background Security Improvements
• FileWave: Defer Apple OS updates
• FileWave: Booster overview
• Apple: What’s new for enterprise in iOS
• Apple: What’s new for enterprise in iPadOS 27
• Apple: What’s new for enterprise in macOS 27
• Apple: Install and enforce software updates for Apple devices
• Apple: Software Update settings declarative configuration
• Apple: About Background Security Improvements for iOS, iPadOS and macOS
• Apple: Enrollment methods for Apple devices
• Apple: Apple security releases
• Microsoft: Update release cycle for Windows clients
• Microsoft: Configure Windows Update client policies
• Microsoft: Policies for update compliance and user experience
• Microsoft: Create a deployment plan
• Microsoft: Windows 11 release information
• Microsoft: Windows 11 Home and Pro lifecycle
• Microsoft: Windows 11 Enterprise and Education lifecycle
• Microsoft: Hotpatch updates (Windows Autopatch)
• CISA: BOD 26-04, Prioritizing Security Updates Based on Risk
• CISA: Known Exploited Vulnerabilities catalogue
• NIST: SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
• PCI Security Standards Council: FAQ 1597 on requirement 6.3.3
• NCA: Essential Cybersecurity Controls (ECC-2:2024)
• NCA: Cybersecurity toolkits (patch management templates)
• SAMA: Cyber Security Framework 3.3.17 Vulnerability Management
• UAE Cyber Security Council: UAE Information Assurance Standard
• Department of Health Abu Dhabi: ADHICS v2 standard
• Department of Health Abu Dhabi: ADHICS v2 implementation guideline
• Qatar National Cyber Security Agency: National Vulnerability Management Guidelines V1.0
• WAM: UAE Cybersecurity Council stresses importance of regular device updates

Frequently asked questions