Operating system update management for enrolled devices is disclosed according to various examples. In one example, a computing environment can publish, to an agent application on a client device, a deployment profile with a setting that specifies a restriction associated with download or installation of software updates by a subset of client devices that includes the client device. The computing environment can receive, from the agent application, an identification of a software update available for the client device. The computing environment can receive a specification of the subset of client devices to apply the software update. In response to a predefined interaction being performed, for example, by an administrator, the computing environment can direct at least one client device in the subset to install the software update.