Monterey Block Jamf School

[Logan_Guard]

In Jamf School, We have a Restriction Policy with Software and App updates deferred for 30 days but our staff still has the ability to download Monterey.

I tried creating a Profile Named Block Monterey and in the Safest and Blocklist I added /Applications/Install macOS Monterey.app/Contents/MacOS/InstallAssistant to the Paths to disallowed applications which did not work.

Has anyone had success blocking Monterey using Jamf School?

[vinu_thankachan]

On macOS Big Sur you can use the new "com.apple.applicationaccess" preference keys to delaying major OS updates for 90 days: set "forceDelayedMajorSoftwareUpdates" to true, set "enforcedSoftwareUpdateMajorOSDeferredInstallDelay" to 90. This works Specifically for 11.3 and onwards clients

https://developer.apple.com/documentation/devicemanagement/restrictions?changes=latest_minor

[Logan_Guard]

Thank you. I'm pretty new to this so can you tell me where this is added in Jamf School?

[Fluffy]

Just made a Blocklist for this yesterday. If you still end up going that route, I just listed the app itself. Like this:

/Applications/Install macOS Monterey.app

[Logan_Guard]

Thanks Fluffy,

I copied that path to "Paths to disallowed applications" and Scoped it to one device and I'm still able to load Monterey. I have a Restriction policy on software and app updates for 30 days but Monterey is still getting through... weird.

[Fluffy]

Interesting. I checked on our end with a different device than last time and it blocked it successfully. Not sure what else to suggest other than ensuring the profile was installed correctly.

Same here, except set to 90 days. Looking at what vinu posted earlier, software updates must be organized in different categories with different settings. Meaning "major updates" are not managed with that setting.

[Fluffy]

Just for the sake of clarification. With the Blocklist you're still able to launch the Install macOS Monterey app? The download will not be blocked by it, but running the installer is blocked.

I'm double checking myself and downloading the update on a different device to see if the automatic launch after download is blocked... Previously I was copying the installer to other devices.

[Logan_Guard]

Thank you for the clarification. I was able to see the download and download it up to 99% but then received an error. I appreciate your help and testing this with me.

[Fluffy]

Glad to help.

And I believe the preference keys vinu shared is for adding to a custom .plist to upload as a configuration profile. As far as I can tell, Jamf Pro has the feature built into their configuration profile payload while Jamf School does not.

[Logan_Guard]

I actually tried this workflow on a few more Macs and I was able to download and install Monterey. I do have the Profile to Block Monterey installed on each. I believe the Mac I received there error on was just a problem during the download process since I was able to go back and download and install on the second time. I appreciate your help though but I'll need to find another solution.

[user-ray77]

Ironic, I am looking to have Monterey installed but it won't let me. 😄