Create a Mac Policy to Block Upgrades to MacOS Big Sur or Monterey

You can block end users with standard or administrative permissions from upgrading to macOS Big Sur or Monterey using a JumpCloud policy. Two policies are available:

• Block Monterey Installation policy – Prevents users from launching installers for Monterey or Monterey Beta.
• Block Big Sur Installation policy – Prevents users from launching installers for Big Sur or Big Sur Beta.

These policies restricts these installers from running. A policy will not prevent the download of the Big Sur or Monterey package. However, when end users attempt to launch the macOS Big Sur installer, it's terminated. End users don't receive a block message. To allow end users to upgrade their systems to Big Sur or Monterey, systems must be disassociated from the policy.

These policies provide a safeguard against any local user upgrading to Big Sur or Monterey until your organization is ready. The policy can prevent most, if not all, of the Big Sur or Monterey upgrades from happening.

To block an upgrade to macOS Big Sur or Monterey:

1. Create the Block Monterey Installation policy or the Block Big Sur Installation policy:
   1. Log in to the JumpCloud Admin Portal: https://console.jumpcloud.com/login.
   2. Go to DEVICE MANAGEMENT > Policy Management.
   3. In the All tab, click (+).
   4. On the New Policy panel, select the Mac tab.
   5. Select the policy from the list, then click configure.
   6. (Optional) On the New Policy panel, enter a new name for the policy or keep the default. Policy names must be unique.
   7. (Optional) Select the Device Groups tab and select one or more device groups where you’ll apply this policy. For device groups with multiple OS member types, the policy is applied only to the supported OS.
   8. (Optional) Select the Devices tab. Select one or more devices where you’ll apply this policy.
   9. Click save, then click save again.
2. After the policy is applied to devices or device groups, you can run the following command on the device to ensure that the appropriate process is running that will block the Big Sur or Monterey installation. For example, for Monterey: ps -ef|grep ‘com.apple.InstallAssistant.macOSMonterey’
3. If the process to block the Big Sur or Monterey installation is running, the command output will be similar to this Big Sur message:

If the process to block the installation is not running, the command output will be similar to this Big Sur message:

You can further verify that the policy is applied by reviewing the jcagent log located here: /var/log/jcagent.log.

The following items appear in the log if the policy was applied successfully:

Considerations:

• Applying the policy installs a monitoring process that checks for the start of the Big Sur or Monterey installation, and if detected, immediately stops it. The policy will not prevent the download of the Big Sur or Monterey package. However, after the download has completed, the installation process receives a kill signal and does not complete.
• In System Preferences, the existence of the Block Big Sur or Monterey policy will work for local user (unmanaged) profiles.
• This policy restricts the macOS Big Sur or Monterey installer from running. When end users attempt to launch the installer, it is terminated. End users will not receive a block message; the upgrade will simply fail.
• This table provides an overview of the policy and the instances in which it will prevent an upgrade:

• If you need to return to a previous version of Big Sur or Monterey, follow Apple’s recommendations.