Managing OS updates on devices with

MDM controls

activations

You can't control when software releases are installed on devices with

MDM controls

activations; however, you can use compliance profiles to help manage devices that users have updated to an OS version that your organization doesn't allow. For example,

Android

10 and later devices do not support

MDM controls

activations. If users with

Android

9.x devices upgrade to

Android

10, some device management features will no longer work, leaving the device in a compromised state. You can use device groups and compliance profiles to detect

Android

devices with the

MDM controls

activation type and set compliance rules to take appropriate action, such as notifying the user, untrusting the device, or unmanaging the device.

Follow these steps to manage OS updates on devices with

MDM controls

activations.

Step	Action
	Create a device group that includes devices that conform to the following parameters: MDM controls activation type Device OS version that you want to restrict If a user upgrades a device to the specified OS it automatically becomes part of the device group.
	Create a compliance profile and specify the device OS version as a restricted OS version.
	In the compliance profile, specify the enforcement action that is appropriate for your organization. For example, you can notify the user that their activation type is not supported by the device OS and recommend reactivating the device with a different activation type, or you can deactivate the device.
	Assign the compliance profile to the device group.
	Optionally, create an event notification to inform administrators when a device is out of compliance with the compliance profile.