This is one reason why everyone should have their own Mobile Device Manager profile installed (e.g., JAMF), so that you can make it part of your profile to proh

This is one reason why everyone should have their own Mobile Device Manager profile installed (e.g., JAMF), so that you can make it part of your profile to prohibit major OS upgrades. Apple can encourage it all they want for consumers, but they have to support MDMs being used this way for Enterprises. Fortunately, there’s software out there in this space that lets you operate like an one-person (or one family) Enterprise.