Jamf Pro - Restricting upgrades to macOS

There are two ways to restrict OS updates on Macs with Jamf Pro: via Configuration Profiles, and via Restricted Software entries. The configuration profile will allow you to hide updates from end users for up to 90 days after release, while the restricted software entry will automatically quit the installer app if a user tries to launch it. It is recommended to use the configuration profile, but if you need to restrict upgrades for more than 90 days you should also make a Restricted Software entry.

Configuration Profile setup

1. Go the Configuration Profiles section of Jamf Pro and click New.
2. In the Restrictions payload on the left, click Configure.
3. Under the Functionality tab, scroll down and check the "Defer updates" box. Set the the menu options to "Software Updates" and "90 days" (or less if you prefer).
   
4. If you would like restrict the updating to a major OS update (e.g. macOS 12 Monterey to macOS 13 Ventura), and allow minor OS updates, simply select "Only major software updates"
   
5. Click on the Scope tab, and select the computers, groups, or users you want this restriction to apply to.
6. Save.

The configuration profile should be installed and take effect as soon as the target computers are connected to the Internet.

Restricted Software

1. Go to the Restricted Software section and click New. Depending on your OS you can enter the following:
2. In the "Process Name" field, enter e.g. "Install macOS Monterey.app" or "Install macOS Ventura.app"
3. Check the "kill process" box.
4. Add a message to display to the end user if they try to launch the macOS installer.
   
5. Click on the Scope tab, and select the computers, groups, or users you want this restriction to apply to.
6. Save.
7. If you'd like to restrict more than one version, clone this and edit the process name. For example, you may wish to restrict the beta version of macOS 13 with "Install macOS Ventura beta.app" as well as the final release with "Install macOS Ventura.app".
   1. Note: While it is possible to use a wildcard to catch both the beta and final release, we have found it more reliable to enter the app name exactly, and recommend avoiding wildcards.

Software restrictions should take effect on computers after their next check in, which normally happens about once every half hour.

When a user tries to run the macOS installer, it will quit instantly and the user will see the message you specified.

Have Questions or Still Need Help?

• If you need assistance creating restrictions or have any questions, please contact the End User Computing team at euc-help@mit.edu.