Keeping Macs up to date in a Jamf Pro environment can be a challenge—especially when dealing with complex OS versioning, smart group-based rollouts, and risk-aware decisions based on security vulnerabilities. This blog post walks through how I automated the entire process using PowerShell, Jamf Pro’s API, the SOFA feed, and an Azure Automation Runbook.

Overview

Using the SOFA feed, CVE data from NVD, and the Jamf Pro API, these scripts:

• Parse available software updates for iOS/iPadOS or macOS
• Evaluate CVE severity and assign custom deadlines
• Scope updates by Smart Group, with deferral logic and override support
• Prevent unintended major OS upgrades
• Automatically create Declarative Device Management Software Update Plans via the Jamf Pro API

Prerequisites

Before using the scripts, make sure you have:

• A Jamf Pro environment
• Jamf API Client ID and Secret with appropriate permissions
• Azure Automation Account
• Devices enrolled with membership to smart groups in Jamf Pro for testing

Key Features

ProcessGroup – Handles devices in Smart Groups, applies version logic and deadlines

Create-UpdatePlan – Calls Jamf API to create a plan for a device

Check-CVESeverity – Assigns deadline days based on CVE severity data (critical, high, etc.)

Azure Runbook Ready – Designed for unattended, scheduled runs

Example Workflow

1. Jamf Pro Smart Groups are used to define deployment rings (Alpha, Beta, Release)
2. Runbook triggers at scheduled intervals (i.e., daily or weekly)
3. Script:
   • Pulls the latest SOFA json feed
   • Matches applicable version for devices in Smart Groups
   • Skips devices if deferral dates haven’t passed
   • Evaluates security severity
   • Creates Software Update Plans only if needed

Getting Started

Create a Runbook

1. Within your Automation account page, under Process Automation, select Runbooks

2. Select + Create a runbook
   • Give your runbook a name
   • From the Runbook type drop-down menu, select PowerShell
   • From the Runtime version drop-down, select 7.2
   • (Optional) Add a description for your runbook
   • Select Review + create

Scripts

The scripts can be found in GitHub: Apple Auto-Patch and Azure Runbooks

Setting up variables

Some important variables that should be set up include:

• Jamf Pro API Variables
  • client_id, secret, and URI
• NVD API Variables (A request for a NVD api key is free)
  • apiKey
• Jamf Pro Smart Group IDs and Software Update Deferral Days
  • Add the Smart Group IDs of the groups you want to target for DDM software updates
  • For Deferral Days, the name of the deferral days should match the group names defined in the Group IDs variables section
• Jamf Pro Group Version Type Overrides
  • If you want to override a version type for a specific group, define that group and version type here
• Software Update Variables
  • updateAction
  • versionType
• (Optional) Deadline Days
  • In the Check-CVESeverity function, you can change the values for adding deadline days based on the severity of CVEs addressed in the updates.
• $targetDeadline
  • In the default configuration state, the script will make the default deadline time be 06:00 PM for the user (trying to avoid normal business hours). Change this to fit your needs. Pro tip: There are two mentions of $targetDeadline in the iOS/iPadOS script and one mention in the macOS script

$targetDeadline = (Get-Date $bestMatch.ReleaseDate).AddDays($SWUDeferralDays + $bestMatch.DeadlineDays).Date.AddHours(18).ToUniversalTime()

Once the script is uploaded into your Runbook, you can link it to a schedule for running and you’ll be on your way to a more secure and automated environment!