macOS Sequoia - Not available to update

[Yam_Moktan]

Hi, Can anyone please help me with this??

We had a restriction payload to delay major macOS for 90 days, which is working fine even more than we wanted. Since it has been more than 90 days after the release of macOS 15, this should be available to update for every device.

But macOS 15 is still not showing up when trying to update! I thing I did was, I modified the same profile but only disable ChatGpt integration didnt change macOS Settings and re-pushed the same profile couple of days ago. JAMF Support confirms that re-pushing the same profile for macOS restrictions doesnt restart the timer, as this timer is depend on the release date by Apple.

Really lost in here! And btw we dont have any profile controlling the macOS except disabling the macOS betas.

[AJPinto]

You can still defer 15.2 to macOS 14.x devices as that Major OS update is not older than 90 days. However 15.0, 15.0.1, and 15.1 are all older than 90 days and cannot be deferred with a configuration profile.

• My guess is you have some firewall rule or TLS filter that is messing with the traffic for OS updates so Apple is failing them, this presents nothing that would be visible to the user.
• You will want to look at /var/log/install.log and see what the OS is saying when you try to run the updates.
  • If they are deferred somehow the log will tell you that it sees deferred updates and how long they are deferred for.
  • It will also give you basic network errors if something is being blocked, but a tool like Jamf Environment Test or Mac Evaluation Utility will give far more useful information on network related issues.

TL;DR: I think something on your network is causing the OS updates to not be seen when macOS is scanning.

[Yam_Moktan]

Thanks for the reply @AJPinto 
As far I understand, macOS 15.2 is minor OS update of major OS 15? Since we have delay minor OS update by just 1 day, 15.2 should be available for devices with OS 14.x? 
Also, we all are on same network and some can update and some cant. From the logs, looks like the major OS update was set to 90 days deferred after re-pushing the profile, which doesnt make sense.

[sdagley]

@Yam_Moktan Any update from 14.x to 15.x is considered to be major, so your major deferral setting is what will control visibility of the 15.x update available on your 14.x machines. The minor update deferral setting applies to the point releases for the same base version of macOS.

For your Macs that aren't showing any update, and if you're not blocking any access to Apple's update servers at the firewall level, have you restarted them recently. We've seen Macs with a long uptime not see updates even when past the deferral period but restarting generally resolves that

[ScottEKendall]

Hey sdagley...On a side note...you said that a restart fixed the issue for not seeing the SUS..  I am trying to build a case to management on forcing systems into a mandatory restart every 30-60 days.  What are some good reasons that you have found that a mandatory restart is a good idea?  (need some firepower for my justification)...Thanks!

[sdagley]

It's not as bad as what I hear from my Windows counterparts, but in a nutshell the longer a Mac has been online, at least one where an org follows the doctrine of "We've never seen a security tool we didn't want to deploy", the more issues you're going to see. The two most common problems I've seen are profiles that won't install and macOS upgrades that repeatedly fail to start. The timeframe for issues to appear varies, but issues with macOS updates are frequent enough that our update required notices to users always call for only initiating the update after a restart.

[Yam_Moktan]

Hi @sdagley , most of the affected users uptime are less than 4 days which is not a lot. And even uptime less than a day are having this issue. But good to know about minor and major OS.

[Yam_Moktan]

@AJPinto The logs says its deferred until 11-3-2025 which makes 90 days since last re- push of profile.

[ScottEKendall]

What does your configuration profile look like in JAMF?  Do you perchance have two deferral policies in place that you might have missed?  That happened to me.  I took over support from another company and I found another deferral policy in the config profiles that I wasn't aware of...

[Yam_Moktan]

No, we dont have two deferral policies @ScottEKendall . I ran the 

sudo profiles show -output stdout-xml | grep -i delay, and there is no any duplicate key for macOS delay.

[obi-k]

Just curious, if you unscope the 90-day restriction profile on one Mac or two, does the option for macOS 15 suddenly show up?

We had a 90-day deferral as well. Even after 90 days, some of our Macs weren't seeing it. 

[Yam_Moktan]

Yes, they can see if they are excluded the profile, which doesnt make validate the delay based on the release date instead of profile push date. So weird. 

[mattjerome]

I ran into the same problem. After some research, I was pointed to 

PI115022

When modifying and saving a computer configuration profile with a Restrictions payload, Jamf Pro sometimes fails to update the profile on scoped computers and incorrectly reports the corresponding InstallProfile command as having completed successfully.

Renaming the profile and hitting distribute to all. fixed the issue b/c It caused a full repush of the profile.

[obi-k]

Good to know I ended up taking the deferral off and re-pushing the profile.

[Yam_Moktan]

Hi @mattjerome , thanks. I have re-pushed the profile to all again and will see if that helps. 

[pete_c]

If you have a 'managed' Apple Account from ABM/ASM, use that to go sign in to AppleSeed and grab Mac Eval Utility (MEU) from the Resources section. Aside from being a terrific tool it will also help you determine of network conditions are impacting your device's ability to download updates.

[russell_garriso]

I found this thread because I have noticed this while cleaning up my bench this week. Have a mixture of Sonoma and Sequoia machines. Some have our 90-day deferral of major updates scoped and some don't. I was expecting 15.1 or older to start showing up on the Sonoma machines with the restriction profile, but it doesn't. Removing the restriction does result in Sonoma showing the offer for Sequoia 15.2, but as soon as I scope the restrictions profile the most Sonoma will get is 14.7.2 and Safari. It does seem like Sequoia is superseded with 15.2. Came here just to see if I was going crazy, but it looks like I am not. FWIW a few people mentioned seeing the older Sequoia offer on Sonoma over the Holidays, so it might have changed on or after 15.2 came out.

[Yam_Moktan · Accepted solution]

 So, the profile was deferring the macOS 15.2, even though 90 was passed. The reason was since 15.2 is the latest version available to update and 15 was not available to update. So delay profile was looking into the release date of latest macOS 15.2 instead of 15. 

- As per Jamf Support.