Self Service policy for Apple Software Updates

That specific softwareupdate command doesn't work the same with ARM based Mac computers (or apparently Monterey, I guess, I'm not 100% sure on that). Apple depreciated the -iar part of the softwareupdate binary. As a result Jamf policies running that command no longer work, nor do policies with the software update payload either. Apple recommends using MDM commands. However that is extremely flaky, and you lack a real good way to schedule or notify users. It seems like something that in a few years might be good, but it's just not good or reliable currently. 

You really have 2 options. Option 1 is to use a 3rd party tool to help gain compliance. Nudge works great, is widely used, and is extremely well documented. Another option is utilizing SUPER which is also pretty well documented. Both essentially bug users to install updates themselves. Home users are the demographic Apple has primarily developed their product for, while the enterprise Mac environments are a languishing thought in the back of their heads often times. Thus modern versions of macOS/Mac hardware essentially require user interaction to complete, until MDM commands improve/are fixed. 

Option 2 is to download the full macOS Monterey 12.5.1 installer (which you can do with the link here), and then make a policy that just installs that over top of the OS. This is non-destructive, it will just take longer. There are multiple methods for that. I believe these two are the most popular ways to do so: 1 2. This generally also require some level of user interaction on modern macOS's/Mac hardware. If you can script an known user password on the machine you can fully automate it though. 

On top of all of that, in general there's been issues on Big Sur & Monterey with timely fetching software updates, even with the "keep my mac up to date" button checked. It's an issue with the softwareupdate binary again. Many people haven't seen the 12.5 or 12.5.1 updates available to them yet because of this. The general fix is to manually check for updates a few times, reboot, or run the "sudo launchctl kickstart -k system/com.apple.softwareupdated" command and then check for updates again.

Thanks. What if the current user doesn’t have admin access though? Nudge and super (I’d heard of the first, but not the second) just prompt users - they’d still need admin rights I guess?

this is going to be a major pain point, I can feel it. It’s fine if users are admins and in a nice office with fast internet. But I’ve a lot of users who are none of those things. :-(

I've just been using the Jamf Helper to bother users to update, and have been having success with that.  If they choose to update right then, one button opens System Preferences/Software Update.  If they choose to do so later, they can close the Helper window and will get notified the next day.  Its a good way to notify a user that their system needs an update and if they are unable to do so at the time of notification, typically they have been updating after hours or when time permits.

It is literally unfathomable to me that this is the way that critical security updates are managed in Mac land or that Apple attempts to sell itself as being suitable for enterprise environments.

I've been responsible for managing around 80 Mac devices for around 3 months and have been trying to figure out how on earth businesses running Mac comply with basic security standards such as ensuring critical updates are installed quickly or at least within 14 - 28 days. In our environment we have many devices that simply don't take updates despite Configuration Policies in Jamf saying that all updates must be applied

I'm really grateful to Dennis for such a comprehensive answer but am genuinely shocked that people can suggest MacOS as being a secure enterprise operating system given that you need the end users permission to keep your own devices safe.  

i just inherited a jamf pro server and about 100 macs. i cant beleive how updates are handled either. my secuirty team informed me about Monterey 12.5.1 and im still trying to figure out the best way to get it out to my clients. 

That specific softwareupdate command doesn't work the same with ARM based Mac computers (or apparently Monterey, I guess, I'm not 100% sure on that). Apple depreciated the -iar part of the softwareupdate binary. As a result Jamf policies running that command no longer work, nor do policies with the software update payload either. Apple recommends using MDM commands. However that is extremely flaky, and you lack a real good way to schedule or notify users. It seems like something that in a few years might be good, but it's just not good or reliable currently. 

You really have 2 options. Option 1 is to use a 3rd party tool to help gain compliance. Nudge works great, is widely used, and is extremely well documented. Another option is utilizing SUPER which is also pretty well documented. Both essentially bug users to install updates themselves. Home users are the demographic Apple has primarily developed their product for, while the enterprise Mac environments are a languishing thought in the back of their heads often times. Thus modern versions of macOS/Mac hardware essentially require user interaction to complete, until MDM commands improve/are fixed. 

Option 2 is to download the full macOS Monterey 12.5.1 installer (which you can do with the link here), and then make a policy that just installs that over top of the OS. This is non-destructive, it will just take longer. There are multiple methods for that. I believe these two are the most popular ways to do so: 1 2. This generally also require some level of user interaction on modern macOS's/Mac hardware. If you can script an known user password on the machine you can fully automate it though. 

On top of all of that, in general there's been issues on Big Sur & Monterey with timely fetching software updates, even with the "keep my mac up to date" button checked. It's an issue with the softwareupdate binary again. Many people haven't seen the 12.5 or 12.5.1 updates available to them yet because of this. The general fix is to manually check for updates a few times, reboot, or run the "sudo launchctl kickstart -k system/com.apple.softwareupdated" command and then check for updates again.

Hi Dennis

Thanks for this answer. Although disappointing you've saved me a few more countless hours trying to figure out why things weren't working in Jamf and MacOS

Can I ask a follow up question on Nudge? Can it be configured to effectively force updates on? So perhaps given the users 3 deferrals (or whatever) but then categorically force them on? More importantly - does the feature actually work, because I'm sure there are comparable features in Jamf, but they just don't seem to work - hence my Nudge exists I guess

Thanks again

The only way to force updates are: if the machine is an Intel one using the softwareupdate -iaR command, using the same command but coding in a known username/password for ARM Macs, or by using MDM commands. However, MDM commands for updates are super flaky across the board, and are lacking in a lot of features currently, when they work, imo. So essentially the only way to automate updates on modern hardware is being able to input a known username/password (where the user is a volume owner) into a script to run the softwareupdate command. HOWEVER, and it's a big but, if you are experiencing the fairly common softwareupdate bug, where no updates are found or presented in sys prefs, this gets you nowhere. That is why, at least currently, I prefer Nudge. I get tickets in from a fair number of people saying "Nudge is telling me to update, but I don't have an update in my system preferences".

With Nudge, you can set a deadline and customize the behavior of the application after you hit the deadline (this is called going into "aggressive mode" with Nudge). In this aggressive mode, you can set Nudge to steal focus as much as you want, I've heard some places are doing as often as 30 seconds. This means Nudge is front and center every 30 seconds (or whatever you want) until the update is installed. So you can incredibly annoy end users until they cooperate. 

found an interesting article Handling major upgrades and minor updates for macOS with Jamf | Babo D's Corner (wordpress.com)

going to give this a test

Admin isn't needed for software update, just being a volume owner. So they will be prompted for a password, but their will allow the process to continue. If you filevault and the user is enabled for filevault, then they should be an owner. Almost all users should be a volume owner. I would suggest giving those a try. 

Thanks, for that share. Any luck? How are you doing updates now for Monterey/Silicon workstations?