Controlling the software updates that are installed on devices

You can control the device software releases that are installed on 

Android Enterprise

 devices, 

Samsung Knox

 devices, and 

BlackBerry 10

 devices. For 

Android Enterprise

 devices, you can also set an update period for apps that are running in the foreground.

For 

Android Enterprise

 devices with 

Work space only

 and 

Work and personal - full control

 activations, you can specify whether the user can choose when to install available software updates or whether software updates are automatically installed. You can specify different rules depending on the device model and currently installed OS version. For all 

Android Enterprise

 devices, you can also set an update period for apps that are running in the foreground because, by default, when an app is running in the foreground, 

Google Play

 can't update it. You can also control how 

Google Play

 applies the changes to the device, for example, specifying whether the user can allow the change or whether the change occurs only when the device is connected to a 

Wi-Fi

 network.

For 

Android Enterprise

 devices with 

Work space only

 and 

Work and personal - full control

 activations, for any devices that you have specified an OS update rule other than the default rule, you can also suspend updates during dates when updates should not occur. For example, you may want to suspend updates during holiday periods. If you want to suspend updates for all devices, you must first create an OS update rule for all devices. For example you could create an OS update rule for all devices running 

Android

 7.0 and later to apply updates automatically at certain hours.

On 

Samsung Knox

 devices, you can use Enterprise Firmware Over the Air (E-FOTA) to control when firmware updates from 

Samsung

 are installed. 

Samsung Knox

 devices that are activated as 

Work space only

 (

Samsung Knox

), 

Work and personal - full control

 (

Samsung Knox

), 

Work space only

 (

Android Enterprise

 fully managed device), and 

Work and personal - full control

 (

Android Enterprise

 fully managed device with work profile) support software restrictions using E-FOTA.

E-FOTA is not supported for 

Work and personal - user privacy

 (

Samsung Knox

) or 

Work and personal - user privacy

 (

Android Enterprise

 with work profile) activation types. 

Controlling firmware versions ensures that users’ devices are using firmware versions that their apps support and comply with your organization’s policies. You can use a device SR requirements profile to create firmware rules for the 

Samsung Knox

 devices that are activated on 

UEM

. You can schedule when firmware updates are installed and specify when forced updates must be installed. For more information about E-FOTA, visit enterprise-fota.

On devices running 

BlackBerry 10

 OS version 10.3.1 or later that are activated with 

Work and personal - Regulated

 or 

Work space only

, you can limit which software release versions that 

BlackBerry 10

 devices can have installed using a device SR requirements profile. You can also add exceptions to the global settings for specific device models. For example, you may want to test a software release before making it available to your organization.

On devices with 

MDM controls

 activations, you can't control when and how users update their device OS but you can use compliance profiles to restrict a device OS version. For all devices, to enforce a particular action if a restricted software release version is installed on a device, you must create a compliance profile and assign the compliance profile to users, user groups, or device groups. The compliance profile specifies the actions that occur if the user does not remove the restricted software release from the device.

You can't control the software releases installed on 

iOS

 devices, but you can can force supervised 

iOS

 devices to install an available update. For more information, see Update the OS on supervised iOS devices.