By: Priya Ravichandran – Principal Product Manager | Microsoft Intune
Intune allows administrators to control when and how system updates apply to their Android Enterprise corporate devices. This is done via Intune’s device restriction policy, which leverages the SystemUpdate resource in Google’s Android Management API.
This post provides clarity around this policy and how this affects the user experience on the device.
System update policy options
Today, administrators have four choices when configuring system update behavior via Intune:
- Device default: This will follow the device’s default update experience as defined by the original equipment manufacturer (OEM).
- Automatic: Updates are automatically installed without user interaction.
- Postponed: Updates are postponed for 30 days before being installed.
- Maintenance window: Updates are attempted during the daily maintenance window.
The Device default experience matches the update experience enabled on the device by the OEM for all consumers. This is the default setting value.
The Automatic or Maintenance window options don’t notify or prompt the user before an update installs. The update will apply as soon as the policy requirements are fulfilled and will trigger a reboot as needed. Additionally, if the Maintenance window option is selected and the update does not successfully install during that window within 30 days, the update will then be automatically installed by the system at the next available opportunity regardless of the defined maintenance window. No user messaging will be displayed.
When Postponed is selected, updates are deferred by 30 days. At the end of the 30 days, updates are installed per the device default experience.
Google System updates
In addition to the OS updates released by the OEM, Google also releases system updates that apply to all Google-certified Android devices. Similar to the OS updates, Google system updates – which are released weekly - may also require a device reboot to fully apply the update. These updates comply with any system update policy that is set on the device.
Using the System update setting
Google’s System update settings are primarily intended to manage updates on dedicated devices that don’t have users on the device such as digital signage. Since the policy was designed for these types of devices, setting this policy effectively removes any user notifications on this device.
It’s important to understand the scenarios for which these update policies are being configured to ensure the experience on the device is appropriate. Scenarios may include:
- A kiosk device at a retail store. A “Maintenance window” setting is likely appropriate since the device will not be actively used after the store closes and any necessary reboots won’t impact the store’s customers.
- A device assigned to a frontline worker whose shift schedule may not provide a predictable time for necessary reboots. In this case, the “Device default” setting is likely the most appropriate as the user will typically be notified of pending updates and can determine when to allow the updates to complete.
As always, before deploying a policy broadly, we recommend verifying that the impact and experiences of policy choice meet your organization’s needs.
Completing updates on the device
Users can manually check and apply updates on their device at any time by checking the System Update option, located in Settings. Asking the user to periodically check and install available updates will help manage any unplanned reboots.
Resources
Learn more about System update settings through the following resources:
- (Google) What’s new in Google System Updates
- (Google) Learn more about Google System updates
- (Google) Google System updates on devices enrolled using Android Enterprise
- (Google) Manually updating your Android device
- (Microsoft) Admin checklist for Android software updates in Microsoft Intune
- (Microsoft) Corporate-owned Android Enterprise device restriction settings in Microsoft Intune
If you have any questions, leave a comment on the post below or reach out to @IntuneSuppTeam on Twitter.