Google System updates on devices enrolled using Android Enterprise

IT admins can use their Enterprise Mobility Management (EMM) provider to apply system update policies which change the behavior of Google System updates. System update policies can be useful for organizations that have dedicated devices which are always active and where there is no end user to accept update prompts (e.g. digital signage).

Summary of system update policies

IT admins can also specify freeze periods. A freeze period is a range of dates which repeat annually during which system updates should not be installed. This policy will prevent updates from being installed and a user will not be able to manually perform an update. Freeze periods can be configured up to 90 days. There must be at least 60 days separating adjacent freeze periods. When the device is outside of any freeze periods you set, the normal policy behavior (none, automatic, windowed or postponed) applies.

Google Play System updates (Mainline)

Google Play System updates (also called Mainline updates) are automatically downloaded but require a device reboot to be installed. These updates will not trigger an automatic reboot and instead they are installed on the next user, admin, or policy initiated reboot. Reboots triggered by system update policy will install the associated Google/OEM system update and any previously downloaded Google Play System updates.

Google Play System updates can also be manually installed by navigating to Settings About Android Version Google Play system update.

IT admins can use an Enterprise Mobility Management (EMM) provider to apply compliance policies that ensure devices stay current with Google System updates.

Compliance engines can make use of many signals that are present on the device such as OS version, security patch details, application versions and even connected SSID to ensure devices remain compliant. If a device becomes non-compliant, the compliance engine can trigger an action such as un-enrolling the device, or removing access to corporate resources.

Compliance engines can be configured to monitor time since the last update was applied to a device. A compliance policy can then be configured to apply an action if a desired time period between updates has been exceeded. Compliance policies can also be configured to warn users, and encourage them to act, before a policy is enforced. We recommend using compliance policies to ensure devices remain up to date for most knowledge worker use cases.