You can set up a Software Update Policy for macOS devices to force OS updates or permit OS updates only for admin accounts. Here is how it works.
There is a setting “Restrict software update require admin to install” that we can also prevent OS upgrades without an admin account's approval.
When creating the software update policy and assigning it to the device with the Require Admin to install as True and deploy the policy to a device. You can see the settings as True.
Log in as an admin account, you can install the update successfully without any password prompt.
Log in as a non-admin account, it will require admin credentials to download and install the update.
Otherwise, if we set the Restrict software update require admin to install as false in the policy:
When deploying the policy to the device, you can see the settings become False.
When logging in as a non-admin account, you can install an OS update successfully without asking for admin permission.
