Defer major but allow minor updates

[ITTN]

Hi 

I would like to:

Defer a major update (from Sonoma to XX) for 90 days
 & Allow all minor updates (from 11.5.2 to 11.5.3) 

How i can achieve that. 

[AJPinto]

You can defer Major and Minor OS updates separately, your options are 1, 7, 30, 60 and 90 days from the date the OS update released. Since Ventura is older than 90 days, you cannot defer it anymore. You could still block the minor builds of Ventura (ie 14.4, 14.3.1, 14.3) that are less then 90 days, but the major build (14.0, 14.1, 14.2) is too old to defer.

In the off chance you are still running macOS 11. You really want to get that out of your environment as Apple stopped releasing security updates for macOS 11 last August.

[ITTN]

@AJPinto Thanks for prompt response 

I will rephrase this
I want to block major updates like from SONOMA to next new OS but want to allow minor updates that sonoma has . 

anyway to do that?

[AJPinto]

You can block any OS update for 90 days from its date of release. Once that date passes, it will be presented to the user to install. There is no way to defer an OS update longer then 90 days, Major or Minor.

Major OS updates do require Admin Access to install, so if users don't have admin access, they can't install the update, but they will see popups about it.

[Tribruin]

Major OS updates only require Admin Access if they are initiated from the installer App. If you initiate the upgrade form Software Update (and are getting the "Delta" upgrade in SU), a Standard user is allowed to upgrade. If on Apple Silicon, they just need to be a Volume Owner. 

[AJPinto]

Oh, I was not aware of that. I thought it still needed Admin access for a Major Update. Thank you for pointing that out.

[daniel_behan · Accepted solution]

You can only defer its availability in System Settings for up to 90 days.  For scripted deployments of minor patches, super it the way to go.

[ivishalj7]

  A weird observation I had was, we had major os upgrades restricted for 30 days which we extended to 45 days for Sequoia. That means from date of release 16 September it should have been blocked till end of October 30-31approx.

On my own test device with this configuration profile I was still able to see macOS 15 sequoia update available for download(unexpected behaviour). Its only after updated profile and  extended the deferral to 60 days, as soon as the profile was updated on device the sequoia update option disappeared. I will advised everyone to validate the deferral on the device with the restriction profile