Skip to main content
Question

MacOS updates management with Nudge

  • November 26, 2025
  • 5 replies
  • 86 views

Forum|alt.badge.img+3

Hi all,

I’m looking for some advice on improving our macOS update workflow.
 

Current setup

Right now we’re using a mix of:

Restrictions payload with no deferral for our tester group, 1week deferral for everyone else.

Nudge -separate config profiles depending on whether we want to push a required update or just remind users.

This works, but managing multiple profiles every time there’s a new macOS version isn’t ideal.

What I’d like to achieve is:
 

A cleaner process for forced updates for everyone when needed.

A standard workflow where users get UI prompts to update (Nudge-style), based on our deferral policy.

Ideally: define the update version and handle the user prompts from one place, without juggling several profiles.

 

Does Jamf Pro offer any built-in way to handle both the update logic and user prompts together?
Or is Nudge still the best option?
If you have a setup that avoids maintaining multiple profiles per update, I’d love to hear how you do it.

Thanks!

5 replies

Ke_ReM
Forum|alt.badge.img+7
  • Contributor
  • November 26, 2025

Since moving to the SUPER method, our macOS Major update workflow has been much more streamlined with simply requiring a small adjustment/upgrade of the script for each new version and updating of the blocking mechanism for when we want to restrict deployment to endusers to allow for internal testing (a restriction config blocking only major software updates for X period and excluding IT Test devices group from the scope).

https://github.com/Macjutsu/super

Our Updates Config Plist looks like this (not updated for Tahoe yet).

 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>AuthJamfComputerID</key>
<string>$JSSID</string>


<key>InstallMacOSMajorUpgrades</key>
<true/>
<key>InstallMacOSMajorVersionTarget</key>
<string>15</string>
<key>InstallRapidSecurityResponses</key>
<true/>
<key>DeferralTimerDefault</key>
<string>480</string>
<key>DeadlineCountSoft</key>
<string>3</string>
<key>DisplayUnmovable</key>
<string>ALWAYS</string>
<key>DisplayHelpButtonString</key>
<string>Your IT - For assistance please contact us at support@your.org</string>

</dict>
</plist>
  • allows minor/security updates,
  • allowed deferral amount (3 in this case)
  • time between deferrals (480 minutes / 8 hours)

We then obviously scope this to devices that

  • are compatible/eligible with the latest update (via smart groups and extension attributes).

AJPinto
Forum|alt.badge.img+26
  • Legendary Contributor
  • November 26, 2025

I gave up on nudge years ago. Its okay, but considering you cant trigger updates from CLI anymore its literally just a notification tool and for that I use Jamf Helper. As ​@Ke_ReM said look in to using SUPERMAN, or look in to blueprints. 


Chubs
Forum|alt.badge.img+21
  • Jamf Heroes
  • November 26, 2025

Don’t get stuck in the past with some third party patching tooling (which was great when MDM protocols were the only way updates could really be had). Declarative updates is the future and will be the best bet here - considering it’s all native to the OS.  I’d recommend using Software Updates or Blueprints to apply updates.  


Ke_ReM
Forum|alt.badge.img+7
  • Contributor
  • November 26, 2025

I agree that its good to stay upto date with developments but its not broken, so no fix required.
Also we are primarily a Windows org so I have minimal time to invest into new methods when the existing just works. Any pointers to the new methods appreciated though, I will put some time aside to read up on it.

Also, not impressed by Apples “in-house” methods from the past which might have been fine for non enterprise level endusers but were not suitable for our standards. Hence the need for things like SUPER and previously Nudge..

The world of Open Source is all giving as someone mentioned in a blog post somewhere...
I would hate to have to rely on Apple for (working) solutions when you need them..


Chubs
Forum|alt.badge.img+21
  • Jamf Heroes
  • November 26, 2025

I agree that its good to stay upto date with developments but its not broken, so no fix required.
Also we are primarily a Windows org so I have minimal time to invest into new methods when the existing just works. Any pointers to the new methods appreciated though, I will put some time aside to read up on it.

Pointers to the new method?  Just create a blueprint and test.  It has been an awesome resource for us.  We leveraged the old MDM push method for years and it was pretty reliable.  DDU has been flawless minus some of the older devices that are ornery….but that’s like .02% of our fleet.  We turned on jamf SSO less than a month ago and are currently leveraging blueprints for updates.  Just did the 26.1 update to our mobile devices last night and it got over 95% of them up to date.