Defer Major macOS Upgrades Using MDM in macOS 13

Yes, you can defer major macOS upgrades using Mobile Device Management (MDM) profiles in macOS 13 (Ventura). Apple provides native configuration keys within the MDM framework that allow administrators to hide and postpone major OS upgrades—such as the transition from macOS 13 Ventura to macOS 14 Sonoma—for a specified window of up to 90 days. This article outlines how these deferrals work, the specific configuration keys required, and how they behave on managed devices.

How MDM Update Deferrals Work

In macOS 13, software update visibility is controlled using the com.apple.applicationaccess payload delivered via an MDM configuration profile. When a deferral is applied, standard users cannot see or install the deferred upgrade through the System Settings application or the softwareupdate command-line tool until the specified time has elapsed.

The deferral window begins on the day Apple publicly releases the upgrade, not on the day the device is enrolled or the profile is deployed.

Key Configuration Settings

To separate major platform upgrades from routine security patches, Apple provides distinct deferral keys. To defer major upgrades, administrators must configure the following key within the com.apple.applicationaccess domain:

  • Key: enforcedSoftwareUpdateMajorOSDeferredInstallDelay
  • Type: Integer
  • Allowed Values: 1 to 90 (representing the number of days)

Setting this value delays the availability of major version releases. For example, setting the integer to 60 will prevent managed Macs running macOS 13 from discovering or installing the next major macOS version for 60 days following its public release date.

Differentiating Major and Minor Updates

It is best practice to configure major and minor updates independently to keep devices secure while testing major OS changes:

  • Major OS Upgrades: Controlled by enforcedSoftwareUpdateMajorOSDeferredInstallDelay. This targets full version jumps (e.g., macOS 13 to macOS 14).
  • Minor OS Updates: Controlled by enforcedSoftwareUpdateMinorOSDeferredInstallDelay. This delays point releases and security updates (e.g., macOS 13.5 to macOS 13.6).
  • Non-OS Software Updates: Controlled by enforcedSoftwareUpdateNonOSDeferredInstallDelay. This applies to standalone app updates, such as Safari.

Device Behavior and Limitations

When the major upgrade deferral is active:

  • The major upgrade will not appear in System Settings > General > Software Update.
  • Command-line queries via softwareupdate --list will not show the deferred major upgrade.
  • Administrators can still bypass the deferral if needed by sending a direct MDM command (ScheduleOSUpdate) specifying the target OS version, allowing selective testing on designated hardware before the deferral expires organization-wide.
  • Once the deferral duration reaches its limit (maximum 90 days), the upgrade becomes visible to users immediately.