Skip to main content

We have a smaller environment and some flexibility on our update schedule. There is an MDM profile we push out with a software update payload where everything is checked except “Restrict software updates to administrator users only”. It has been like this for years and usually it means after a few weeks some folks have updated and others need a little reminder. The recent 15.5 to 15.6 update appears to be different for us. This time it pushed out to everyone on either 8/5 or 8/6. Has anyone noticed a change in how the built-in software update runs in Sequoia with that kind of set it and forget it MDM payload?

 

There are only 10 computers running Sequoia in our environment with another few dozen running a mixture of Sonoma and Ventura, so it might be sampling/anecdotal. The other releases are in their usual state of lag two weeks after the update and all of them are using the same payload. 

 

This all came to attention because the one Sequoia user who hadn’t updated reached out complaining about the “scheduled” update quitting all their applications every night and then getting stuck when it hit something like Office with unsaved changes or an IDE that doesn’t want to close. This is expected for something like a scheduled update, but not something anyone has ever reported before 15.6. Client screenshots and Update payload are attached. Please reply if you are seeing this.

 

 

MacOS 14 and macOS 15 do have differences with how they handle managed OS updates, mainly in regards to DDM commands. However, it is absolutely possible that applications that prevent themselves from being closed (like an unsaved document) can hang the OS update process. OS updates I a major pain point of managing Apple products and especially macOS.

 

When you deploy OS updates, make sure to use the Download and Schedule Install option to use the DDM commands for your best results for macOS 15. For macOS 14, it lacks the OS update fixes that came in macOS 15 and you really need to be updating off macOS 14 at this point if at all possible.

                  AJPinto is absolutely a legend! Following up here now that 15.6.1 has appeared to confirm this is definitely changed behavior on Sequoia. The main thing is that the update payload now causes the update to schedule automatically for that night no matter what the user does. It is possible to kick off or cancel using the System Settings UI. If someone shuts down at night the scheduling will take place again the next day and may prompt for a user password to get the token if they kick it off using System Settings or after the restart happens. If it is after the restart the user will have to wait for the update to complete. 

                  This is really a change for the better, since now our Sequoia compliance is really good. Install automatically in the Updates configuration profile actually installs the updates automatically! It just ended up being a bit of a learning curve as people were used to the previous update where they could control the timing. It is very similar to the article and comments on Eclectic Light:
https://eclecticlight.co/2025/02/27/how-your-mac-can-update-macos-when-you-dont-want-it-to/

                 There is definitely more work to be done to get folks off old releases, but historically things have worked out that the last 3 releases are supported due to security and application vendors. Apple is deprecating the SoftwareUpdate payload, so the DDM writing is on the wall. Too bad, since the behavior is actually getting better. We have been using DDM to update hot spares and the Schedule commands work better than the last time the workflows were evaluated. Scheduling a 15.5 to 15.6 DDM with scheduling worked exactly as expected and completed without issue. Then work switched over to testing some workflows on Sonoma by running a DFU restore on the test mac. 

                 The test mac would not stop grabbing the previous DDM command to update to 15.6. It was allowed to complete several times and then followed by some other DDM commands to attempt latest version just to see if it would clear out. The jobs all showed completed in Jamf, but every time the test mac came up on Sonoma it would still get the scheduled 15.6 command. Downgrading isn’t a normal thing, but it is just another time where the only solution is to completely disable the feature in Jamf and then enable it again losing all the logs/history that goes with it.

                 Hopefully things get a little better before Apple forces the issue of relying on it. Just would like things like complete to mean that it isn’t going to reappear in the wrong place again until you completely disable it.

Reply


Terms & ConditionsCookie settings