Jamf Pro 11.22: DDM Software Update Settings, Blueprints, and Deprecations

Jamf has released an update to Jamf Pro v.11.22.0, which includes a few new features.

Reviewing the release notes, we see the following within some of the new functionality:

1. MDM Server Migration with App Preservation for iOS and iPadOS Devices
   1. You can migrate iOS and iPadOS devices from another MDM server to the Jamf Pro server while preserving installed apps and data.
   2. Mobile device PreStage enrollments include a new setting to install apps before Setup Assistant. The settings serve two purposes:
      1. Installs apps before Setup Assistant displays for standard PreStage enrollments with Jamf Pro
      2. Installs apps and associated data before the Setup Assistant displays during MDM migration to Jamf Pro

Under deprecations, though, the primary purpose for this post is the following callout:

Support for MDM software updates via remote command The ability to deploy software updates via remote command using the Management tab in an individual device record or via mass action will be removed in late 2026. Managed software updates will remain functional.

This deprecation is in line with Apple’s announced deprecations around software updates in macOS and iOS/iPadOS 26:

Software update management using mobile device management commands, restrictions, the com.apple.SoftwareUpdate payload, and queries is deprecated and will be removed next year. Going forward, software updates can be managed and enforced using only declarative software update management.

While no action may be required at this moment, organizations should begin planning or migrating to non-deprecated workflows.

What does that look like, though?

Scenario: Using super to deploy updates with the Jamf Pro API

If using super with the Legacy Managed Software Updates API, aka you’ve never enabled “use the new software updates feature as seen in the image below, you will want to consider enabling the functionality and updating the API permissions. As called out in the current change log for super, “The Jamf Pro new Managed Software Updates feature remains unreliable if the workflow target is not the latest minor update or major upgrade. In the meantime, the legacy Jamf Pro software update API remains stable (although deprecated), and local authentication is always the most reliable.”

An alternative method, if one does not wish to enable the new software update feature, is to migrate to local authentication.

Scenario: Deploying Software Update and Deferral Configuration Profiles

Many organizations have configuration profiles that affect both com.apple.SoftwareUpdate and com.apple.applicationaccess to configure software update settings and deferrals. An example profile is pictured below for when using the Jamf Pro UI to do so:

This configuration profile covers software updates and deferrals. All settings are deprecated and to be removed either in a future update to macOS Tahoe 26 or macOS 27, as well as iOS 26 or iOS 27.

What should you do? Transition to Jamf Blueprints now.

To replicate this profile in a supported manner, you’ll want to take advantage of Declarative Device Management’s (DDM) declarative configuration, and not legacy profile payloads. The DDM Configuration Domain is com.apple.configuration.softwareupdate.settings.

Configuring Jamf Blueprint for Software Update and Deferrals

Scenario: Attempting to send software updates via a Computer Record or Mass Action in Jamf Pro while New Software Updates are Enabled.

Many organizations already have Jamf’s New Software Updates featured enabled. So when attempting to send Mass Action Commands, it has already been disabled for some time.

Attempting to manually send commands to update macOS via Jamf Pro are no longer viable.

Navigating to a single system, selecting the Management tab, and then clicking “Download and Install Updates” displays a pop-up message directing you to the Software Updates section and to enable the functionality if applicable.

Trying to take a Mass Action against a group of systems will prevent you from progressing when selecting install updates.

Notice the Next button is non-selectable.

Scenario: Using Jamf’s new Software Updates functionality and are Unhappy with Reliability

At JNUC 2025, Jamf announced enhanced functionality in Blueprints, which they are marketing as “set it and forget it updates.” You would configure this within the Software Update blueprint itself, which alleviates the need to go to Computers > Software Update and deploy a plan. Instead, you’d set a maximum number of days before software updates must be applied. Watch the JNUC keynote to see how to configure this. This feature is in beta.

In my conversations around JNUC, there was an unconfirmed rumor that the entire software update section (i.e, Computers > Software Update or Devices > Software Update) will ultimately become deprecated and removed in favor of having everything set within Jamf Blueprints, like this new “set it and forget it” declaration and configuration. I would assume this will be the ultimate outcome of the late 2026 removal. So, it might not be that far off down the road, but if true, it’s always better to be ahead of the curve.