Distinguish Android update postponement from a system-update freeze

Source facts

Intune’s Android Enterprise system-update options include postponing updates for 30 days before prompting the user. Microsoft warns that the manufacturer or carrier may prevent important security updates from being postponed. A configured freeze period is different: it prevents system updates, security patches and pending-update notifications during that period, and users cannot manually check for updates. Microsoft Learn.

Applicability

Review organization-owned Android Enterprise devices managed by Intune, with the actual enrollment mode and manufacturer recorded. Do not use the source’s historical minimum-OS examples as a current support matrix; establish supported versions separately.

DSE recommendation

Choose the delay mechanism from the required behavior, not from the assumption that every pause is equivalent. Have the device and application owners describe the critical operating period and the security-update exception they can accept. Review the current platform’s limits before approving any freeze. Document how urgent manufacturer or carrier updates will be handled, and assign someone to inspect devices that do not follow the expected postponement behavior. Avoid extending a freeze merely to conceal an unresolved compatibility test.

Verification

On representative approved devices, inspect the effective update configuration and the observed availability and installation behavior. Record the manufacturer, enrollment mode and update type with each result. Check the planned return to normal updating after the critical period. Preserve deviations for follow-up rather than treating a configured 30-day postponement as proof that no security update can arrive.

Official references

Microsoft Learn: Admin checklist for Android software updates in Microsoft Intune.