Defer Updates on macOS without deploying the full Restrictions Config Profile

Thanks @takayuki . I had just found the following and was testing out. 

https://gist.github.com/haircut/9507aed65ee42dcc848d345b923bae97

I will try yours though since it's cleaner.

@takayuki I was looking at the domain com.apple.applicationaccess and the key enforcedSoftwareUpdateDelay and I realized that maybe these are older legacy values?

When I implement it seems the OS just translates these into putting them into the domain com.apple.SoftwareUpdate and converts enforcedSoftwareUpdateDelay to the key ManagedDeferredInstallDelay

From what I can tell in my prelim testing you can simply have:

Configuration Profiles > 'Application & Custom Settings' Payload > Upload

Preference Domain: com.apple.SoftwareUpdate

Upload File:

<plist>

    <dict>

        <key>ManagedDeferredInstallDelay</key>

        <integer>7</integer>

        <key>forceDelayedSoftwareUpdates</key>

        <true/>

    </dict>

</plist>

What do you think?

Okay, so in the end I ended up sticking with the com.apple.applicationaccess domain and going with the following which is supported starting with macOS 11.3 and allows separate deferral values between Major OS updates, Minor OS updates and App updates. In this case I went with 90 days for Major OS updates (such as the upcoming macOS 12 Monterey) and 21 Days for Minor OS Updates (such as going from macOS 11.5.2 to 11.6, etc)

Configuration Profiles > 'Application & Custom Settings' Payload > Upload

Preference Domain: com.apple.applicationaccess

Upload File:

fernando_gonzal, I'm getting this setup myself. I'm curious why you have forceDelayedSoftwareUpdates, forceDelayedMajorSoftwareUpdates, and forceDelayedAppSoftwareUpdates options set in there? what do those do?

It seems like the keys below are all you need are enforcedSoftwareUpdateMajorOSDeferredInstallDelay, enforcedSoftwareUpdateMinorOSDeferredInstallDelay and enforcedSoftwareUpdateNonOSDeferredInstallDelay.

ohh here is all the deets 😄 

https://developer.apple.com/documentation/devicemanagement/restrictions

So this exactly seems to be working well for me. I'm only going BigSur + and we are all past 11.3 now. 

Great idea - I am doing the same now. 1 question:

Do you still have a (non deferment payload) restrictions profile on your Mac fleet along with the software update deferment-specific profile? If so, do you simply uncheck all the SU-related settings in the regular Restrictions profile? Or does it conflict with your granular custom SU profile?

I'm asking because I have (2) discreet SU profiles in testing now: (1) profile for production (90-day major updates and 30-day minor updates) and (1) profile for IT only (30-day major and 7-day minor). They work great. Sort of...

BUT as soon as I introduce my main Restrictions profile back on the Macs it breaks the discrete deferment profiles - Macs can see all available updates again as if software update deferments aren't managed at all.  As soon as I remove the main Restrictions profile the discreet SU profiles work again as expected.

My main Restrictions profile is simply ALL the common payloads associated with restrictions EXCEPT for the software updates are all unchecked.

You basically can't do deferrals using Jamf's interface because it sets everything as you see it on-screen. Need to hand-craft and sign it before upload. Jamf gonna Jamf after all.