You can block macOS upgrades (i.e. from macOS 12 to macOS 13 Ventura) by deploying a Configuration Profile with an update deferral setting.

You will need to create a configuration profile with appropriate settings if one doesn't exist. If a profile already exists, you can update it appropriately:

In Jamf Pro, under Configuration Profiles ("Content Management" in the left sidebar), you should check if there's a profile with a payload type "Restrictions".

  • If such profile exists you will need to change or adapt the settings as explained later in this document.
  • If such profile does not exist, you will need to create one and set it as explained later in this document and make sure all other settings in all other tabs in this payload suit your preferred settings, as they will deploy together with this payload.

Step One - Creating the Configuration Profile, or searching for an existing one:

Step Two - Choosing the correct Payload - Restrictions,  and the correct tab - Functionality.

Step Three - Choosing the option to defer updates. You can choose which type of updates to defer. macOS upgrades are "major software updates"

Step Four - Don't forget to scope which macs to enforce the deferral on.


Additionally, you can also block "Install macOS Ventura.app", using "Restricted Software" in Jamf's sidebar:

  1. Go to the Restricted Software section and click New. Depending on your OS you can enter the following:
  2. In the "Process Name" field, enter e.g. "Install macOS Monterey.app" or "Install macOS Ventura.app"
  3. Check the "kill process" box.
  4. Add a message to display to the end user if they try to launch the macOS installer.
  5. Click on the Scope tab, and select the computers, groups, or users you want this restriction to apply to.
  6. Save.
  7. If you'd like to restrict more than one version, clone this and edit the process name. For example, you may wish to restrict the beta version of macOS 13 with "Install macOS Ventura beta.app" as well as the final release with "Install macOS Ventura.app".
    1. Note: While it is possible to use a wildcard to catch both the beta and final release, we have found it more reliable to enter the app name exactly, and recommend avoiding wildcards.

  8. Software restrictions should take effect on computers after their next check in, which normally happens about once every half hour.

    When a user tries to run the macOS installer, it will quit instantly and the user will see the message you specified.