Stop macOS Sequoia install app automatic downloads?

[howie_isaacks]

What is the best way to stop the macOS Sequoia install app from downloading automatically? The problem that this creates is when non-admin users try to upgrade to macOS Sequoia, the install app launches. The install app requires an admin user to run the install. If the upgrade is done entirely through Software Update, a non-admin user can run the upgrade. The install app doesn't launch since it wasn't downloaded. This was an issue last year when I opened up upgrades to macOS Sonoma. I had to create a policy that would temporarily elevate users to admin. They would be demoted back to a standard user at the first check-in after the upgrade. This worked well, but I prefer not to have to do this again.

[mvu]

Curious what others say to stop the download. 

But what about creating a smart group for those that have the Install macOS Sequoia.app, then running a script to remove/delete it?

[AJPinto · Accepted solution]

I have only seen macOS fall back from using the delta for the OS upgrade to using the install macOS blah.app when something is breaking the task sequence for the delta on the device. Check your security clients and network configurations to make sure nothing is breaking the OS update workflow. The macOS installer is a fallback for when something is not working right.

[howie_isaacks]

Interesting... We install (in my opinion) too many agents on our Macs. If it was one of them causing this, I wonder why it doesn't do this on every Mac. I have a policy that finds and deletes the install app. I see that it has been successful doing that.

[AJPinto]

We have quite a few ourselves, and are actually evaluating for overlaps and consolidations in 2025 thank god.

For us its a EPM tool that loves to get in the way. You need to write new policies for it's allow rules as Apple updates things, and different devices are in different enforcement levels for one reason or another leading to tons of variables. 

[howie_isaacks]

Right now, all of our Macs not yet upgraded to Sequoia currently display a 15GB upgrade size, meaning that the Mac will be downloading the full installer. A moment ago, I created a new Mac VM running Sonoma and did not enroll it into my Jamf Pro server. It has none of our software installed. Software Update is showing at 7.5GB download for Sequoia. So, I am going to enroll this VM in Jamf Pro and exclude it from all the agent install policies. I will check Software Update after enrollment, and keep checking it after I manually install one of our agents. Maybe this will pin down which agent is responsible for interfering with the upgrade. We have seen some random failures to run minor updates where macOS displays an error similar to "update settings have changed". We were never able to pinpoint what caused it and the updates would eventually work.

[howie_isaacks]

As it turns out, your idea of the full installer app downloading as a "fall back" was correct. We defer most updates for a set period of time to give us time to test the new version and make sure nothing will break before we allow everyone to update. I noticed that the profile we use to defer major macOS upgrades had what looked like a conflicting setting in it. It defers the major upgrades for the specified time, but it seemed to be causing Software Update to download the full installer. Removing this conflicting setting has resulted in the smaller delta upgrade being presented in Software Update. Thank you for giving me the idea of this being a fall back behavior because something is breaking the workflow. Because of this issue, I was having to run a policy to temporarily elevate non-admin users to admin so that they could get the upgrade to Sequoia done. A follow up policy demotes them back to standard. The process is working perfectly, but I would prefer not to have to use it.

[AJPinto]

Im glad I was of some help. 

Ironically we are actually having issues with this right now. Our EPM tool which has a local account with a secure token is screwing with the volume ownership workflow of the OS updates triggering macOS to download the full OS installer. Im trying to keep from giving people admin access as a work around as my security team (or rather in the end it will be me) figures out the configuration issue. The fun never ends :).

[oli]

The first way is to not grant admin rights to your users. If you're not an admin, you can't install a new major release. As second, you can configure Restricted Software to prevent the execution of Install macOS Sequoia.app. And last but not least configure the Restrictions part of a Configuration Profile. Under the tab Functionality you can find "Defer updates for..." so it would not be shown as available update.