How can I restrict app updates to Wi-Fi and track OS build version after security patch updates in Android kioskSolved

Hello @rob_mitch ,

For Android app updates, Hexnode UEM can control the update behavior only for apps managed through a Required Apps policy.

To restrict managed app updates to Wi-Fi only:

1. Go to Policies.
2. Open the Android app policy applied to the devices.
3. Navigate to Required Apps.
4. Add the apps that Hexnode should manage.
5. Enable the option Update apps only over Wi-Fi.

This applies to apps deployed and managed through that Required Apps policy. Apps installed outside Hexnode, including preloaded or manually installed apps, are not controlled by this setting. Hexnode cannot change the global Google Play Store auto-update preference for those unmanaged apps.

For OS updates, there are two different cases:

• Standard Android Enterprise Device Owner enrollment: Use Policies > Android > Security > OS Update. This lets you control the update behavior, such as automatic updates, inactive-hour updates, or postponing updates for a limited period.
• ROM-integrated/system app devices: The Update OS remote action can be used for custom firmware update packages only when the Hexnode agent is installed as a privileged system app by the OEM or as part of the ROM.

If the devices are not ROM-integrated, installing the agent later as a normal app will not provide the system-level permissions required to silently flash a firmware ZIP.

Regards,
Simon Scott
Hexnode UEM

What about downloading the firmware ZIP with our own app and storing it on the device, then using Hexnode to trigger the install? We were hoping to control exactly which devices get the patch and when.

The remote Update OS action that installs a firmware ZIP requires the Hexnode agent to be present as a privileged system app. A regular enterprise app does not have permission to silently trigger a local firmware flash, even if the ZIP file is already downloaded to the device.

For non-ROM-integrated devices, use the OS Update policy to manage the update window or postponement period. If you need devices to reboot after the OEM update is installed, you can also use Hexnode Automation to schedule a Restart device action for a selected device group during a maintenance window.

We also need reporting after the update. The OS version column only shows the major Android version, which isn’t enough for us. We need to confirm the exact build/security patch variant across the fleet.

For more detailed OS version tracking, add the Build Version column to the device report/export.

You can do this from the device list/report column customization option, then include Build Version before exporting the device details. This column can show the more specific build value that may not appear in the basic OS version field.

After an OS update, run a device scan so Hexnode refreshes the device inventory data. Once the scan completes, export the report again with the Build version column included. This should show the updated build information for the devices.