So with iOS 17, we've seen in the field that updates actually work as intended now! So what do I mean by that? Well, this is our observations:
1. Admin uses the traditional method of sending a mass-action command do a device to update to the latest version, with download, install and reboot
2. The device receives the command and downloads the update
3. The next time the user unlocks it, it will require the device PIN regardless if you have touch-ID or not, presumably to get the PIN to allow software installation
4. Then the update is scheduled overnight
5. During the night, regardless if the device is connected to a charger or has usufficient battery charge, the update will install and the device will reboot
This might seem like a no-brainer and obvious. However, this didn't work pre-17. Then users weren't prompted for a PIN at all, or they were prompted but could dismiss it. Update would fail to install overnight etc etc. In essence, what a huge positive change!
Is it just me or is this your experience as well? Another good thing about this is that the updates are deemed non-intrusive by most users as they are used to enter their PIN on occasion, and the update/reboot happens overnight instead of when the user unlocks the device.