Create a Mac Policy to Delay or Block Ventura

Starting with macOS 13 Ventura, Apple has changed software update behavior. Starting with macOS 12.3, Apple will provide a smaller “delta” update for devices that will allow users to quickly update to macOS 13 Ventura. However, this will cause changes that will affect JumpCloud and JumpCloud IT Admins.

To address this, JumpCloud has created new software management policies for IT Admins to use to prevent unwanted upgrades to macOS Ventura. The steps you  need to take to prevent unwanted upgrades to macOS Ventura will vary depending on the state of your current macOS devices. See the section below that matches your organization’s needs.

This article covers:

• ​​​​​If your devices are running macOS 12.2.1 or earlier
• If your devices are running a macOS version between 12.3 and 12.6
• If your devices are running macOS 12.3 or later
• If your devices are running macOS 12.6.1 or later

If your devices are running macOS 12.2.1 or earlier

If your macOS devices are running version 12.2.1 or earlier and you want to block the upgrade to macOS Ventura, you need to configure the following policies:

• Block macOS Ventura Installer - Restricts the macOS Ventura installer from running. Users are allowed to download the installer, but the installer will be blocked from launching. 
• Delay Major macOS Software Upgrades - Restricts the visibility of the macOS Ventura update from Apple's System Preferences > Software Update. Users with this policy set will not see macOS 13 Ventura as an available upgrade.

Block your macOS 12.2.1 and earlier devices from upgrading to macOS Ventura:

1. Log into your JumpCloud Admin Portal: https://console.jumpcloud.com
2. Navigate to DEVICE MANAGEMENT > Policy Management.
3. In the All tab, click (+).
4. On the New Policy panel, select the Mac tab.
5. Select the Block MacOS VenturaInstaller policy from the list, then click configure.
   1. (Optional) Select the Policy Groups tab and select one or more policy groups that will include this policy.
   2. (Optional) Select the Device Groups tab and select one or more device groups where you'll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
   3. (Optional) Select the Devices tab and select one or more devices where you'll apply this policy.
6. Click save.
7. Repeat steps 3 and 4.
8. Select the Delay Major MacOS Software Upgrades policy from the list, then click configure.
   1. Under Settings, select Force Delayed Major Software Updates to delay major OS software updates from appearing for the length of time you specify in Software Upgrade Delay Days.
   2. For Software Upgrade Delay Days, specify the number of days to delay the software upgrade. The minimum value is 1 and the maximum is 90.
   3. (Optional) Select the Policy Groups tab and select one or more policy groups that will include this policy.
   4. (Optional) Select the Device Groups tab and select one or more device groups where you'll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
   5. (Optional) Select the Devices tab and select one or more devices where you'll apply this policy.
9. Click save.

If your devices are running a macOS version between 12.3 and 12.6

For the best experience, you should upgrade to macOS 12.6.1, which has resolved Apple’s issue with major and minor update restrictions. If your macOS devices are running a version between 12.3 and 12.6 or later, you need to configure the following policies:

• Block macOS Ventura Installer - Restricts the macOS Ventura installer from running. When users attempt to launch the installer, it will be terminated. Users will not receive a block message.
• Delay Major macOS Upgrades - Sets how many days to delay a major software upgrade, up to 90. 
• Delay Minor OS Updates - Sets how many days to delay a minor software update, up to 90.

To block your macOS devices running versions between 12.3 and 12.6 from upgrading to macOS Ventura:

1. Log into your JumpCloud Admin Portal: https://console.jumpcloud.com
2. Navigate to DEVICE MANAGEMENT > Policy Management.
3. In the All tab, click (+).
4. On the New Policy panel, select the Mac tab.
5. Select the Block MacOS VenturaInstaller policy from the list, then click configure.
   1. (Optional) Select the Policy Groups tab and select one or more policy groups that will include this policy.
   2. (Optional) Select the Device Groups tab and select one or more device groups where you'll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
   3. (Optional) Select the Devices tab and select one or more devices where you'll apply this policy.
6. Repeat steps 3 and 4.
7. Select the Delay Major MacOS Software Upgrades policy from the list, then click configure.
   1. Under Settings, select Force Delayed Major Software Updates to delay major OS software updates from appearing for the length of time you specify in Software Upgrade Delay Days.
   2. For Software Upgrade Delay Days, specify the number of days to delay the software update. The minimum value is 1 and the maximum is 90.
   3. (Optional) Select the Policy Groups tab and select one or more policy groups that will include this policy.
   4. (Optional) Select the Device Groups tab and select one or more device groups where you'll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
   5. (Optional) Select the Devices tab and select one or more devices where you'll apply this policy.
8. Repeat steps 3 and 4. 
9. Select the Delay Minor OS Updates policy from the list, then click configure.
   1. Under Settings, s​​​elect Force Delayed Software Updates to delay minor OS software updates from appearing for the length of time you specify in Software Update Delay Days.
   2. For Software Update Delay Days, specify the number of days to delay the software update. The minimum value is 1 and the maximum is 90.
   3. (Optional) Select the Policy Groups tab and select one or more policy groups that will include this policy.
   4. (Optional) Select the Device Groups tab and select one or more device groups where you'll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
   5. (Optional) Select the Devices tab and select one or more devices where you'll apply this policy.
10. Click save.

If your devices are running macOS 12.3 or later

If your macOS devices are running version 12.3 or later, your users can now perform major version upgrades to macOS Ventura 13.1. Prior to the release of macOS 13, local Admins were required to perform major OS software upgrades. Standard users can now use Apple’s new over-the-air (OTA) software upgrade path to Ventura without running a full installer app or authenticating as an Admin. This ability saves time for users and Admins. With macOS 13, both major upgrades and minor updates are enforced using JumpCloud’s scheduled MDM OS update commands. 

When macOS 13.1 is available, neither the Block macOS Ventura Installer policy nor the Delay Major OS Upgrades policy will be able to block the installation of the macOS Ventura OTA installer. 

If you do not want your users to upgrade to macOS 13, you must perform at least one of these actions:

• Use macOS patch policies to enforce minor upgrades and ensure that no devices are running macOS Monterey 12.3 through 12.6. 
• Communicate to your users that they should not proceed with any upgrades that mention macOS Ventura.
• Restrict access to the Software Update preference pane using the System Preferences Control Policy in JumpCloud. See Create a Mac System Preferences Control Policy.

If your devices are running macOS 12.6.1 or later

If your macOS devices are running version 12.6.1 or later, you need to configure the following two policies:

• Block macOS Ventura Installer - Restricts the macOS Ventura installer from running. Users are allowed to download the installer, but the installer will be blocked from launching. 
• Delay major MacOS Software Upgrades - Sets how many days to delay a major software upgrade, up to 90. 

To block your macOS 12.6.1 and later devices from upgrading to macOS Ventura:

1. Log into your JumpCloud Admin Portal: https://console.jumpcloud.com.
2. Navigate to DEVICE MANAGEMENT > Policy Management.
3. In the All tab, click (+).
4. On the New Policy panel, select the Mac tab.
5. Select the Block MacOS VenturaInstaller policy from the list, then click configure.
   1. (Optional) Select the Policy Groups tab and select one or more policy groups that will include this policy.
   2. (Optional) Select the Device Groups tab and select one or more device groups where you'll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
   3. (Optional) Select the Devices tab and select one or more devices where you'll apply this policy.
6. Repeat steps 3 and 4.
7. Select Delay Major MacOS Software Upgrades from the list, then click configure.
   1. Under Settings, select Force Delayed Major Software Updates to delay the software update for the length of time you specify in Software Upgrade Delay Days. 
   2. For Software Upgrade Delay Days, specify the number of days to delay the software upgrade. The minimum value is 1 day and the maximum is 90 days.
   3. (Optional) Select the Policy Groups tab and select one or more policy groups that will include this policy.
   4. (Optional) Select the Device Groups tab and select one or more device groups where you'll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
   5. (Optional) Select the Devices tab and select one or more devices where you'll apply this policy.
8. Repeat steps 3 and 4. 
9. Select Delay Minor OS Updates from the list, then click configure.
   1. Under Settings, select Force Delayed Software Updates to delay minor OS software updates from appearing for the number of days specified in Software Update Delay Days.
   2. For Software Update Delay Days, specify the number of days to delay the software update. The minimum value is 1 day and the maximum is 90 days.
   3. (Optional) Select the Policy Groups tab and select one or more policy groups that will include this policy.
   4. (Optional) Select the Device Groups tab and select one or more device groups where you'll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
   5. (Optional) Select the Devices tab and select one or more devices where you'll apply this policy.
10. Click save.