As IT administrators, there are several scenarios where OS updates are to be restricted in iOS devices. Some of the possible cases are:
Apple has started supporting automated OS updates, by which you can ensure the OS gets updated based on the policy configured while automatically restricting manual OS updates. This is supported only on devices running iOS 11.3 or later versions. For other devices, you need restrict device OS from being updated either OTA or through iTunes.
The device must be Supervised, preferably using Apple Configurator. Know more about Supervising iOS devices here.
The domain mesu.apple.com is used by Apple devices for updating the OS. If the devices cannot contact this domain, the OS cannot be updated. The most optimal way to prevent the domain from being accessed by the device, configure a proxy through which all internet communications are routed. In this proxy, blacklist the domain as explained below:
To restrict OS updates across all networks,
To restrict OS updates only in enterprise networks, ensuring the enterprise network is not affected,
Blacklist the domain mesu.apple.com in the organization firewall/proxy or any third-party filters being used.
Once both the policies are configured, save and publish the profile. To distribute the profiles,
You can update the OS for few devices by connecting them to the specific machine, which was used for Supervising the devices through Apple Configurator.
NOTE:If you cannot restrict OS updates as explained above, contact our Support team for alternate solutions.