Last year, as I was deferring macOS Sonoma, we found out two issues. The first is that Apple's software updates don't always advertise themselves as either a major upgrade or a minor update. Because of this, the profile can't defer them. The second issue I found out from AppleCare Enterprise was that the way that Jamf Pro manages the settings using MCX is actually old. It works most of the time but it needs to be updated. I am seeing a few systems that I did not authorize to upgrade. Some of them were upgraded before they were enrolled. I can tell this by reading the install logs on those Macs. I see the Jamf Pro enrollment happening after the upgrade to Sequoia. These were on user-initiated enrollments. It was the same thing last year. Most of our Macs enroll through PreStage. Only a very tiny number of my Macs have been able to upgrade. I'm not going to worry myself too much over that small number. Out of just over 1400 Macs, only 30 are running Sequoia. One of those is my own MacBook Pro.
