Deferring a macOS Update

This workflow covers how to defer macOS updates on an individual computer or group of computers by deploying a configuration profile with settings that restrict the macOS update. Computer configuration profiles are XML files (.mobileconfig) that provide an easy way to define settings and restrictions for macOS computers and users. You can use Jamf Pro to create computer configuration profiles and specify the computers and users to which the profile should be applied (called “scope”). You can use the smart computer group you created as the scope of the configuration profile.

Note: macOS can still be updated via an MDM command even if updates are deferred.


To defer a macOS update, you need the following:

  • Jamf Pro 10.3.0 or later

  • Computers with macOS 10.13 or later with a User Approved MDM status (For more information, see the Managing User Approved MDM with Jamf Pro Knowledge Base article.)

  • A valid push certificate in Jamf Pro

Deploying a Configuration Profile to Defer a macOS Update

You can use a configuration profile to defer a macOS update. You can scope this configuration profile to a specific group of computers, including a smart computer group of managed, MDM-enabled computers not using the current macOS version.

  1. Log in to Jamf Pro.

  2. Click Computers at the top of the page.

  3. Click Configuration Profiles.

  4. Click New images/download/thumbnails/81527197/Icon_New_Button.png .

  5. On the General pane, enter a name for the profile and configure other settings on the pane as needed.

  6. To configure the Restrictions pane, do the following:

    1. Click Functionality.

    2. Select the Defer software updates for checkbox at the bottom of the pane, and then select the number of days to defer the update after it is released by Apple from the pop-up menu.

      Note: Computers with macOS 10.13.0–10.13.3 defer the update for 90 days (not configurable).

  7. Click the Scope tab and configure the scope of the profile. With scope, you can add targets, limitations, and exclusions for remote management tasks.
    If you want to update macOS before the deferral period is over, remove the computer from the scope or send a remote command to update macOS.

    1. On the Targets pane, choose “All Computers” or “Specific Computers” from the Target Computers pop-up menu.

    2. To narrow the restriction to a specific group of managed, MDM-enabled computers that are not using the current macOS version, select Computer Groups and click Add next to the smart computer group you created.

  8. Click Done.

  9. To deploy the configuration profile, click Save.

    Note: If a computer has two or more configuration profiles with restrictions, it will accept the most restrictive settings.

Copyright     Privacy Policy     Terms of Use     Security
© copyright 2002-2022 Jamf. All rights reserved.