Block macOS Update

Here’s a good thread …
 

• 

From the thread I gather that the way to go would be via blueprints, is that correct? In that case that does not help me, because I have an on-Premis installation, an those do not support blueprints.

You are correct!  MDM deferments are being sunset as of OS 27 and will be replaced with DDM (blueprints). 
 

Apple is moving to more declarative and less MDM. 

So for on premise installations there will be no way to defer or block OS upgrades?

Again, Apple has set the standard for this. 
 

You could build a custom launchdaemon that runs a script that checks for the auto update caching of the OS (or the .app in Applications) and then remove it - but messing with the system like that is not recommended at all. It could cause some instabilities. 

I’m sure jamf will have a resolve for this before it hits. A lot of folks still have onprem due to FedRAMP requirements. 

​@Andixon Be curious what Jamf support says for on premise. Have you talked to them? 

Opened a ticket with the support. Until now they only said they will forward my question to their engineers.

Cool. If you don’t mind, can you share your outcome? Either way, maybe we can help.

Received the answer: Nothing new there. They say Apple is going to remove the keys with MacOS 27 and there is nothing they can do. There is no alternative solution für Jamf Pro on premises going forward. 

I understand that it is Apple who are removing the functionality with the next MacOS, but that is only an excuse, because it is Jamf who are choosing not to support DDM on Jamf Pro on premises. If they would do that there wouldnt be a problem, as there is follow-up solution provided by Apple, Jamf is just denying me access.

Anyway ​@mvu you mentioned that maybe you can help. I would be grateful for a solution for this, because I do not see one, as my employer just will not migrate to the cloud.

Did your employer give a reason as to why they won’t migrate? JAMF wants to make things more dynamic - and cloud is the way to go for that. 

Deprecated is still functional.
The keys should function properly in macOS Sequoia and macOS Tahoe.
When Tahoe releases, you will still be able to defer software upgrades via MDM config profile.
BUT when going from macOS 27 to macOS 28, you must use a DDM Configuration (Blueprints) as the keys will be removed in macOS 27.

As for on-prem, some customers (like myself) are FedRAMP dependent and are waiting on Jamf Cloud to get certified before migrating so we can stay compliant.

What ​@Jared_Y said. From what I read, functional, but your results may vary. Which won’t make you feel better.

Are you using the Resticted Software tab as well?

Deprecated does not mean sunset.  Means it still works….for now 😉