Hello, I manage our field team's Samsung S20 devices and some of our current applications require us to remain on Andriod 10 as there is currently some incompatibility with Android 11. We will be wanting to upgrade when this is solved for security reasons but ideally, I would like to be able to limit user's ability to upgrade and instead push safe updates out to the field when they are tested.

I am hoping there is a new solution to this but so far I have not seen anything. Other than moving over to the Samsung Knox suite that does appear to have this functionality.

So for now I have been using this script to stop the updates.

Up until now, this solution has been working, however, if any changes are made to profiles assigned to the devices the fix is undone requiring me to send the script again. If this is not caught, then the device is left vulnerable for the automatic updates to start downloading. Once they are downloaded we have to factory reset the phone in order to avoid it asking to start the update every day.

Any ideas why this is happening? I am not making any changes to the feature control, even moving devices between groups will reset the OS upgrade block. 

At device enrollment, I have also set a task scheduler to send the script but this seems to be ignored, not sure why this is but it means enrollment has 1 extra manual step. I have considered are using a task scheduler to send the feature control script every couple of minutes but this seems like overkill and I would rather a cleaner solution. 

Does anyone know of any other workarounds? 

Thanks in advance