macOS IT admins dealing with unexpected macOS 27 upgrades

Macs are upgrading to macOS 27 when nobody asked them to. Mac admins across forums, Slack channels, and support queues are reporting fleets that jumped to the new major release overnight, often on machines that were supposed to be held back. The cause isn't a rogue update. It's the removal of one of the most dependable tools in the Mac admin's patching toolbox, and most admins were caught off guard.

Deprecated Restrictions Policy

For years, the software update delay in the restrictions profile was the standard way to keep major macOS releases off managed Macs. Set a delay of up to 90 days, and users wouldn't be offered the new release until your testing window had passed. It was simple, widely understood, and supported by every MDM.

In macOS 26, Apple deprecated it. Apple's direction is Declarative Device Management (DDM) for software updates, but the migration path has been thin. Many admins missed the deprecation entirely, and most MDM providers still haven't shipped a replacement deferral setting. When macOS 27 arrived, the safety net a lot of fleets depended on was no longer doing its job.

Where MDM providers stand today

The landscape is uneven, and the same word, "deferral," doesn't mean the same thing everywhere. As of October 14, 2026:

Jamf Pro and Mosyle have not yet implemented a new DDM deferral setting. Admins who relied on the old restriction have no direct equivalent to move to.

Addigy has implemented a new DDM deferral setting, but it only applies to macOS 27 visibility in Software Update. It does not stop DDM update policies from triggering the upgrade. Admins who had DDM Updates set to "keep on the latest version" with a 90-day deferral woke up to find all of their Macs on macOS 27. The deferral hid the update from the Software Update pane, while the DDM policy went ahead and installed it anyway.

JumpCloud has also implemented a new deferral, and its Updates Policy deferral setting appears to hold off the 90-day update as you would expect.

The takeaway: don't assume a deferral setting defers what you think it does. Two vendors can ship a feature with the same name and produce opposite outcomes on your fleet.

General Software Update Policy Deprecation in macOS 27.

macOS 27 adds another change. Apple has also deprecated the general macOS Software Update policy, the one that lets a Mac check for updates in general and recommend them to the user. Apple is putting far more emphasis on the DDM update cadence instead.

That's a loss for a lot of environments. The general software update profile was ideal for clients who wanted light Apple update suggestions without hard enforcement: a gentle nudge, not a deadline. We wish this setting were still available to use alongside our Proximos and Apple's DDM updates, and its removal leaves a gap for anyone who wants something between "no updates" and "enforced updates."

Where Proximos fits in

This deprecation opens another inlet for Proximos to manage or assist your macOS patching policy. If you're keeping DDM as your primary mechanism, Proximos can fill in the gaps it leaves. If DDM isn't giving you the control you need, or your MDM's implementation is behaving unpredictably, Proximos can replace your DDM setup altogether. Either way, the goal is the same: Macs update when you decide, not when a vendor setting quietly changes meaning underneath you.

Proximos has its own controls for exactly that. The --skip-macosversion <version> and --disable-updates-until <date> command-line options help hold off unnecessary updates until you're ready, and both are documented in the Proximos command line overview.

Proximos also includes Major Mode, which counts down 30 days to a date you specify, then performs the major upgrade to macOS 27 on your own schedule. That turns macOS 27 from a surprise into a planned event.

What macOS IT admins should do right now

• Test your MDM's deferral on a pilot group. Read the documentation, then verify the behavior yourself. "Hides the update" and "blocks the update" are not the same thing.
• Review your DDM update declarations. A "keep on the latest version" policy will move your fleet to macOS 27 regardless of what a deferral does for visibility. Where your MDM allows it, target the specific macOS version you want instead.
• Audit your old restrictions profiles. Don't assume a software update delay profile from before macOS 26 is still protecting you.
• Plan for the Macs that already upgraded. Check line-of-business apps, security tooling, and VPN clients for macOS 27 compatibility, and remember that moving a Mac back to an earlier major release generally means erasing and reinstalling. Rosetta was deprecated in macOS 27, which could hinder various workflows for users of older or  boutique apps.
• Talk to your stakeholders. If your users or clients were surprised, a short heads-up about what happened and what's changing will go a long way.

See the next upgrade through with Proximos

Apple is clearly moving Mac patching toward DDM, and that's a reasonable direction. But the gap between Apple deprecating a control and MDM vendors shipping a dependable replacement is where fleets get hurt. Until that gap closes, the safest approach is to verify, test, and keep your patching policy somewhere you can see and control it. Try Proximos today for a fully-featured macOS Update policy solution.