Prevent iOS Updates from Downloading Over Cellular in DDM Update Policy

Hi everyone,

I'm currently managing iPhones and iPads using Microsoft Intune in combination with Apple Business Manager (ABM). I've set up a Declarative Device Management (DDM) update policy to push the latest available iOS/iPadOS version to our devices.

The policy itself works well — users receive a notification that an update is available, and they can see the deadline for deferring the update. However, there's one major issue:

I want to prevent the update from downloading over 4G/5G cellular data and ensure that it only downloads via Wi-Fi.

So far, I haven’t found any setting in Intune or ABM that allows me to enforce this behavior.

Is there a way to restrict iOS updates to Wi-Fi only when using DDM update policies in Intune with ABM-managed devices?

Any insights, experiences, or workarounds would be greatly appreciated!

Thanks in advance!