How does Jamf Pro collect "Software Update" details?

[JevermannNG]

Is Jamf using the "softwareupdate" command line tool to collect the details on the Mac client?

I am just wondering because even on clients with a major software update deferral profile (90 days set),

Jamf Inventory shows the macOS Ventura Upgrade on macOS 12.6.1 Clients?

Thanks in advance, Bjoern

[AJPinto · Accepted solution]

JAMF Uses MDM Commands to tell the Mac to query what OS updates are available to it AND eligible to install and report back that information to JAMF. This query also takes in to account MDM deferrals and wont report deferred updates to JAMF. If JAMF is saying the Mac has  macOS13 available, your deferrals probably are not working.

You can fact check this on a device. Run Softwareupdate -l, it will list all the updates the device can install. If MDM is blocking an update it wont show. Then go to /private/var/log/install.log and find where its talking about scanning for updates. The install.log will tell you ALL OS updates available, and then note if the update is differed. The logs should drop almost immediately as you hit enter on the softwareupdate command.

Get the OS Update Status | Apple Developer Documentation

[JevermannNG]

I think that the Major Deferral works because in the System Settings under Software Updates, I do not get the Ventura Upgrade offered. But using the SoftwareUpdate command line or reading out the com.apple.SoftwareUpdate.plist file shows me that the Ventura Upgrade is offered for most of our Mac Clients.

We use an additional Profile which defers the standard macOS Updates with a value of "0", does this have any influence to the Major Deferral Profile?

Thank you, Bjoern

[AJPinto]

If you are seeing Ventura when running softwareupdate -l, then its not differed. The install log should see Ventura, the GUI and CLI wont show it if its differed correctly. 

Minor OS updates and Major OS updates are deferred under separate flags. One should not effect the other beyond the bug where Ventura is seen as a Minor OS update for macOS 12.3-12.6.

Manage upgrading to macOS Ventura in your organization - Apple Support

You should just need to set the Major OS update differ in a configuration profile. The Minor OS update deferral does not matter.

Differed updates should look like this in the install.log. The install.log WILL see the updates, but will put a note saying there is a deferral start date.

Product 012-92138 is MacOS 13.0

Product 012-93766 should be MacOS 13.1, but I would need to fact check that.

This device is running Monterey still, the other items are XCode, safari and Monterey updates.

System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager)
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Using PostDate for deferral start date
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Using PostDate for deferral start date
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Using PostDate for deferral start date
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Product 012-60271 is deferred until 2023-03-13 08:00:00 +0000
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Product 012-90253 is deferred until 2023-01-22 07:00:00 +0000
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Product 012-90254 is deferred until 2023-01-22 07:00:00 +0000
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Product 012-92138 is deferred until 2023-01-22 07:00:00 +0000
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Product 012-93766 is deferred until 2023-02-07 08:00:00 +0000
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Product 032-12833 is deferred until 2023-03-13 08:00:00 +0000
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Product 032-12843 is deferred until 2023-03-13 08:00:00 +0000
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: Using PostDate for deferral start date
2023-01-10 07:21:58-06 C07CW0QUPJJ9 softwareupdated[326]: SUOSUServiceDaemon: Adding client: (null) (pid = 13636, uid = 501, path = /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager, connection remote object interface = <NSXPCInterface: 0x7f9ac086b370>, exported interface = <NSXPCInterface: 0x7f9ab21f7d40>, remote object proxy = <__NSXPCInterfaceProxy_SUOSUServiceClientProtocol: 0x7f9ac0894d30>)

The MacOS GUI and CLI WILL NOT show the deferred OS updates.

If your configuration profile is set correctly, and scoped to the Mac but you are still seeing Ventura, your device management is not correct. Devices must be supervised, among other requirements to defer Ventura. Though you can only defer Ventura until 1.22.23 anyway. With less then 2 weeks left its probably not worth figuring out why your not deferring Ventura correctly at this point and get ready for Ventura instead. 

[JevermannNG]

Thank you for the brilliant explanation! I still assume that the major deferral profile works, however your are right, I am looking forward to macOS 13.2 and its software update fixes ...