What is SoftwareUpdateNotificationManager on Mac?

Last updated: 2026-07-31

What it is

SoftwareUpdateNotificationManager is an Apple component built into macOS. It runs in each signed-in user’s session and manages notifications related to macOS software updates. Its executable is inside the system-protected SoftwareUpdate.framework, and both its bundle identifier and LaunchAgent use Apple’s com.apple.SoftwareUpdateNotificationManager identity.

Apple’s own documentation describes SoftwareUpdateNotificationManager as responsible for showing software update notifications. That description covers more than placing a line of text on the screen. SoftwareUpdateNotificationManager also handles the interactions attached to those notices, including notification buttons, installing later, restart countdowns, insufficient-storage warnings, and installation-completion messages. Managed update reminders can also depend on this notification path.

SoftwareUpdateNotificationManager is not the component that single-handedly performs the entire update. Apple identifies softwareupdated as the main daemon responsible for running software updates. A useful distinction is that softwareupdated performs the update work, while SoftwareUpdateNotificationManager presents update state to the signed-in user and coordinates the choices made from those notifications. Calling SoftwareUpdateNotificationManager the macOS updater would therefore be inaccurate, but describing it as completely passive would also leave out part of its role.

Why it talks to the network

launchd can wake SoftwareUpdateNotificationManager after several update-related events. These include user login, discovery of an available update, a change to the update badge, insufficient space for an automatic download, completion of an installation, and a pending restart reminder. Once running, SoftwareUpdateNotificationManager uses local XPC communication to coordinate state and user actions with other Software Update components.

The wider software update system can access the network when someone opens Software Update, when macOS performs a periodic check, when the system checks after a restart, or when a person or the automatic-update configuration starts a download. During those operations, the update system may contact Apple’s update catalog and download CDN. If content caching is available, it may instead obtain eligible content from a cache on the local network.

That system-level behavior does not prove that SoftwareUpdateNotificationManager itself opens each remote connection. Apple has not publicly documented direct remote hosts for this process or shown that it personally transfers update packages. Listing Apple update servers or a local cache as confirmed direct peers of SoftwareUpdateNotificationManager would therefore go beyond the available evidence. If a monitor shows a large update transfer, check softwareupdated and the other update services before attributing the bytes to SoftwareUpdateNotificationManager merely because of its name.

How much traffic is normal

Apple does not publish per-process traffic measurements for SoftwareUpdateNotificationManager, so there is no reliable normal figure in megabytes or gigabytes. Its expected pattern is idle most of the time, with occasional activity at the control or metadata level when update state changes or a user responds to a notification.

A macOS update package can be large, but the package size is not a valid estimate of SoftwareUpdateNotificationManager traffic. The actual download belongs to the wider update workflow and should not be assigned to the notification manager without process-level evidence. It is reasonable to expect SoftwareUpdateNotificationManager to use much less traffic than the update payload, but whether its direct traffic is always negligible remains unverified.

Treat sustained or unexpectedly large usage as something to measure, not as proof of either normal behavior or compromise. Timing matters: an update check, an automatic download, an installation result, and a restart reminder can occur close together even though different update components are doing different parts of the work.

Can you turn it off

The practical recommendation is to keep SoftwareUpdateNotificationManager enabled. Apple does not provide an independent switch for this process, so there is no System Settings path that turns SoftwareUpdateNotificationManager itself off.

Forcibly unloading or blocking SoftwareUpdateNotificationManager may prevent notices about available updates, insufficient storage, installing later, restart countdowns, managed updates, and installation results from reaching the user. It does not guarantee that background checks or downloads will stop, because those jobs are handled by other parts of the update system. launchd or a later system update may also start SoftwareUpdateNotificationManager again.

Automatic download and installation choices can be changed through System Settings > General > Software Update > the information button next to Automatic Updates. Those controls adjust automatic update behavior; they do not disable SoftwareUpdateNotificationManager. Turning off automatic downloading also does not mean that all software update notices disappear. Apple says macOS can still show a notification and a System Settings badge after it detects an update.

What people get wrong

1. “SoftwareUpdateNotificationManager is malware or a third-party updater.” It is an Apple system component. Its executable is stored in the protected SoftwareUpdate.framework, and its bundle identifier and LaunchAgent both use Apple’s com.apple.SoftwareUpdateNotificationManager identity.

2. “SoftwareUpdateNotificationManager performs every update check and downloads the complete installer.” That assigns too much responsibility to it. Apple defines softwareupdated as the main daemon that runs software updates. SoftwareUpdateNotificationManager officially manages update notifications and the interactions connected to them.

3. “SoftwareUpdateNotificationManager only displays notifications and can never initiate an update-related action.” That is too absolute. An Install Now button, an install-later choice, or a restart action starts with an interaction managed by SoftwareUpdateNotificationManager. The requested work is then coordinated with and carried out by the relevant update services.

4. “Disabling SoftwareUpdateNotificationManager with launchctl will save a meaningful amount of bandwidth.” There is no reliable evidence for that conclusion. Apple documents no configuration options for SoftwareUpdateNotificationManager, and its independent traffic volume has not been published. Disabling it primarily damages the notification path; it does not reliably shut down the separately operating update checks and downloads.

5. “Turning off Automatic Updates also turns off every software update notification.” Apple documents otherwise. Even with automatic downloading disabled, macOS can notify the user and add a badge in System Settings after an update has been detected.

Seeing what it actually used

Use Bytetally’s per-process statistics to check the bytes recorded specifically for SoftwareUpdateNotificationManager instead of assigning the whole update download to it by name. Compare a quiet period with the times when an update is detected, downloaded, installed, or awaiting a restart. If the large transfer appears under another update service, investigate that process separately.

Related processes

Common questions