# How to deploy OS updates on Android devices?

Hexnode UEM provides central management over Android system update lifecycles, supporting commercial off-the-shelf (COTS) devices managed via Android Enterprise as well as specialized OEM hardware. IT administrators can execute policy-based Over-the-Air (OTA) updates or remotely push signed custom firmware builds to specialized endpoints.

Update Deployment Approaches
----------------------------

Select the deployment approach matching your organization’s device fleet and enrollment architecture:

Deployment ApproachTarget EndpointsManagement EngineUser Impact**System Update Policies**
*(Commercial Off-the-Shelf Devices)*Commercial endpoints (Samsung, Google Pixel, Zebra, Motorola, etc.) enrolled in Android Enterprise.Automated OTA policies ([Schedule OS Updates Policy](https://www.hexnode.com/mobile-device-management/help/how-to-schedule-os-updates-in-android-devices-using-hexnode/)).Zero manual intervention; updates install during scheduled maintenance windows or automatically.**Custom Firmware Deployment**
*(Specialized OEM Hardware)*Dedicated hardware running custom ROM builds with Hexnode System Agent embedded in `/system/priv-app`.Direct ZIP payload push via the [Remote “Update OS” Action](https://www.hexnode.com/mobile-device-management/help/how-to-deploy-os-updates-on-android-devices-using-hexnode-mdm/#native-system-update-policies).Silent background flashing or scheduled installation prompts.Prerequisites & Compatibility Matrix
----------------------------------------

RequirementAndroid Enterprise System Update PoliciesCustom Firmware File PushOperating SystemAndroid 7.0+Android 5.0+Enrollment ModeAndroid Enterprise (Device Owner / Work Managed)Android Enterprise (Device Owner)Firmware TypeStandard Commercial OEM Over-the-Air (OTA) ReleaseOEM-Signed ZIP Custom PackageHexnode App LevelStandard Hexnode UEM app from Google PlayPrivileged System Agent in `/system/priv-app`Custom ROM Required⛔ No (Works on standard commercial devices)✅ Yes (Required for direct file flashing)> **Note:** Commercial devices managed via Android Enterprise do *not* require custom ROM configurations or system-level directory placement. Prerequisites related to custom ROMs apply strictly to direct firmware ZIP file pushes.

Configuring System Update Policies in Android Enterprise
--------------------------------------------------------

Automate update deployment across commercial Android endpoints managed in Android Enterprise using centralized policy controls.

### Step-by-Step Configuration Workflow

1. Log in to the **Hexnode UEM** console.
2. Navigate to **Policies** > **New Policy** (or edit an existing policy).
3. Go to **Android** > **Security** > **OS Updates** and click **Configure**.
4. Select the appropriate **System Update Setting**: 
    - **Update Automatically:** Installs system updates as soon as published by the device vendor.
    - **Update During Inactive Hours:** Restricts update execution to a daily maintenance window (e.g., 00:00 to 06:00).
    - **Postpone Updates:** Pauses incoming system updates for up to 30 days to allow internal testing.
5. Select **Policy Targets** to attach the configuration to target Devices, Device Groups, or Users, then click **Save**.

For detailed policy behavior, review the [Schedule OS Updates Documentation](https://www.hexnode.com/mobile-device-management/help/how-to-schedule-os-updates-in-android-devices-using-hexnode/).

Executing Custom Firmware File Pushes
-------------------------------------

Deploy specialized vendor-signed firmware packages (`.zip`) to dedicated hardware equipped with system-privilege agents.

### Step-by-Step Remote Action Workflow

1. Host the OEM-signed firmware package on a secure web server accessible by target devices.
2. Calculate the **MD5 Hash** of the ZIP file to ensure data validation during delivery.
3. In the **Hexnode UEM** portal, navigate to the **Manage** tab.
4. Select the target Android devices or device groups.
5. Click **Actions** > **Updates** > **Update OS**.
6. Configure the update parameters: 
    - **Update File URL:** Provide the HTTPS direct download link for the hosted update ZIP.
    - **File Hash:** Enter the MD5 hash checksum.
7. Select the preferred installation mode: 
    - **Automatically install the update:** Triggers silent background installation.
    - **Prompt user to install the update:** Delivers an update notification prompt to the device screen.
8. Click **Update** to dispatch the command.

Troubleshooting & Diagnostics
---------------------------------

SymptomRoot CauseResolution“Update OS” action greyed out or unavailableDevice is missing privileged System Agent placement required for direct pushes.Verify that the device runs Android 5.0+ and has the Hexnode System Agent embedded in `/system/priv-app`. For commercial devices, use [System Update Policies](#native-system-update-policies) instead.File verification failure or MD5 checksum errorPayload corruption or incorrect hash value input.Re-calculate the MD5 checksum on the hosting server and verify the direct URL string.Device fails to boot after update executionIncompatible or unsigned firmware package uploaded.Ensure the firmware package is OEM-signed and verified via ADB sideload prior to wide-scale deployment.