Back to top

Block non-mainline firmware updates

Last updated October 11th, 2023



  • Knox Service Plugin
  • Firmware updates that are Android releases and security maintenance releases


With Android, firmware updates are typically divided into three categories — Google System updates, major Android releases, and security maintenance releases (SMRs). Through Knox Service Plugin, you can perform some firmware over-the-air (FOTA) functions on the latter two types of updates. You can stop a device from downloading and applying Android version updates and SMRs with the Firmware update (FOTA) policy.

Mainline updates can’t be blocked. Refer to Device randomly reboots without warning to learn how to manage mainline updates.

How to block non-mainline firmware updates

To block firmware updates from Android releases and SMRs:

  1. On your EMM console, go to the Knox Service Plugin configuration.

  2. Set the following policies in Device-wide policies:

    Policy Value
    Enable device policy controls True
    Firmware update (FOTA) policy > Enable firmware controls True
    Firmware update (FOTA) policy > Allow firmware update over-the-air False
    Firmware update (FOTA) policy > Allow firmware update in recovery mode False
  3. Save the profile and push the changes to your devices.

Is this page helpful?