Operating system update management for enrolled devices

A system, comprising:

• at least one computing device;
• and
• program instructions executable in the at least one computing device that, when executed, cause the at least one computing device to:
• publish, to an agent application on a client device enrolled in a management service, a deployment profile comprising a setting that specifies at least one restriction associated with download or installation of software updates by a subset of client devices comprising the client device;
• receive, from the agent application, an identification of a software update available for the client device;
• provide software update metadata associated with the software update to an administrator console associated with the management service based on a query for the software update, wherein the software update metadata is received as part of a synchronization with an operating system update service;
• receive, in the administrator console associated with the management service, a specification of the subset of client devices to apply the software update;
• and
• in response to an input being received in the administrator console, direct the agent application of at least one client device in the subset of client devices to install the software update based on identifying the deployment profile as being applicable to the at least one client device in an instance in which the deployment profile has been published.

A computer-implemented method, comprising:

• publishing, to an agent application on a client device enrolled in a management service, a deployment profile comprising a setting that specifies at least one restriction associated with download or installation of software updates by a subset of client devices comprising the client device;
• receiving, from the agent application, an identification of a software update available for the client device;
• providing software update metadata associated with the software update to an administrator console associated with the management service based on a query for the software update, wherein the software update metadata is received as part of a synchronization with an operating system update service;
• receiving, in the administrator console associated with the management service, a specification of the subset of client devices to apply the software update;
• and
• in response to an input being received in the administrator console, directing the agent application of at least one client device in the subset of client devices to install the software update.