Block non-mainline firmware updates

Environment

• Knox Service Plugin
• Firmware updates that are Android releases and security maintenance releases

Overview

With Android, firmware updates are typically divided into three categories — Google System updates, major Android releases, and security maintenance releases (SMRs). Through Knox Service Plugin, you can perform some firmware over-the-air (FOTA) functions on the latter two types of updates. You can stop a device from downloading and applying Android version updates and SMRs with the Firmware update (FOTA) policy.

Mainline updates can’t be blocked. Refer to Device randomly reboots without warning to learn how to manage mainline updates.

How to block non-mainline firmware updates

To block firmware updates from Android releases and SMRs:

1. On your EMM console, go to the Knox Service Plugin configuration.

2. Set the following policies in Device-wide policies:

   Policy	Value
   Enable device policy controls	True
   Firmware update (FOTA) policy > Enable firmware controls	True
   Firmware update (FOTA) policy > Allow firmware update over-the-air	False
   Firmware update (FOTA) policy > Allow firmware update in recovery mode	False

3. Save the profile and push the changes to your devices.