The usual trick I recommend is to configure the daily update window to be only the shortest possible period of 1-minute, so short that no firmware upgrade can even get started.

If you push out a Profile with the "Allow OS Upgrade" Feature Control disabled, that should prevent any OTA updates to the device.

Hi Chris,

Thanks for responding. Could you tell me which to find that feature? I se work managed for my devices, and i can't find that option.

Looking forward to hearing from you.

Thanks & regards,

Randy Saputra

Randy,

Sorry about that.  It looks like that Feature Control is not available for Android Enterprise enrollment, just Android Classic.

Hello.

We have faced same issue on some customers.

The solution.for Samsung devices only,  is bit pricely (around US$30 per device per year)

You may control when and which samsung update to apply the device by installing Knox E-FOTA.

Or you could just add multiple freeze periods for OTA in an update policy profile (postponed, max. 90days each) as long as the A11 Samsung problem is there (Raymonds solution is interesting as well^^). And i would, as just said from Chris, additional untick "Allow OS Update" in feature control.

 This costs no money and you can assign that with the filters only to samsung devices.

But be sure: All new enrolled devices will get the update during enrollment, if you enroll with ZT because you need the internet connection and so you can't go around that.

If MobiControl server is a bit outdated with no ""Allow OS Upgrade" option in the Android-Enterprise Feature-Control profile payload, one can always try sending the script

  writesecureprofstring DeviceFeature   BlockOsUpgrade  1

  apply featurecontrol

to achieve the same effect.   This should be supported for Samsung devices with KNOX library included in the device firmware.