Cross-Platform Updates & Delivery Optimization

Android update management

Simple explanation

Android updates are like different postal services — it depends on who made the device and how it’s managed.

Unlike Windows (where Microsoft controls updates directly), Android updates come through the device manufacturer (Samsung, Google, etc.). Intune can influence WHEN updates install and which updates are allowed, but it works differently depending on the management level and the OEM.

Android update options

Method	What It Controls	Supported Devices
System update configuration profile	When updates install (immediate, scheduled, postpone 30 days)	All Android Enterprise managed devices
Freeze periods	Block updates during critical business periods	Android Enterprise (API level 28+)
Samsung FOTA (Knox E-FOTA)	Specific firmware versions, force or block updates	Samsung devices with Knox
Managed Google Play auto-update	App updates from Play Store	All Android Enterprise devices

System update behaviour settings

Setting	Behaviour
Automatic	Device downloads and installs updates when available
Windowed	Updates only install during a defined time window (e.g., 2 AM - 5 AM)
Postpone	Delay system updates for up to 30 days
Default	Device follows its default OEM update behaviour

Samsung FOTA with Intune

Samsung’s Enterprise Firmware Over The Air (E-FOTA) provides deeper control:

Pin devices to a specific firmware version — prevent uncontrolled updates
Force a specific update — push a tested firmware version to all Samsung devices
Schedule updates — install during maintenance windows
Requires Samsung Knox Mobile Enrollment and Knox E-FOTA licence

Exam tip: Android updates vary by OEM

The exam recognises that Android update management is more limited than Windows:

Standard Android Enterprise — you can schedule install windows and postpone up to 30 days
Samsung Knox — deeper control with firmware pinning and forced updates
Personal work profile devices — you generally can’t control system updates (user manages the device)

If a question asks about forcing a specific Android firmware version → Samsung FOTA is the answer.

Delivery Optimization

What is it?

Simple explanation

Think of Delivery Optimization like a neighbourhood lending library.

Instead of every house (device) driving to the bookshop (Microsoft’s servers) to buy the same book (update), the first house buys the book and shares it with the neighbours. Delivery Optimization lets devices share update content with each other over the local network — dramatically reducing internet bandwidth usage.

Download modes

Mode	Behaviour	Best For
HTTP only (0)	No peering — download only from Microsoft	Testing, or when peering isn’t desired
LAN (1)	Share with devices on the same local network	Most organisations (default)
Group (2)	Share within a defined group (AD site, domain, Entra group)	Multi-site organisations
Internet (3)	Share with any device running DO, including internet peers	Large distributed organisations
Simple (99)	HTTP only, no peering, no cloud service	Environments with strict network policies
Bypass (100)	Use BITS instead of DO	Fallback for troubleshooting

Configuration via Intune

Where: Intune admin center → Devices → Configuration → Settings catalog → Search “Delivery Optimization”

Setting	Purpose	Sam’s Choice
Download mode	How devices share content	Group (2) — share within each office location
Max cache size	Percentage of disk for cached content	20%
Max cache age	How long to keep cached content	7 days
Bandwidth limits	Maximum upload/download bandwidth for DO	50% foreground, 30% background

Sam configures Group mode so devices in the Wellington office share with each other, and devices in the Auckland office share separately — preventing cross-site WAN traffic.

Monitoring updates

Where to monitor

Dashboard	What It Shows
Intune admin center → Reports → Windows updates	Update ring compliance, feature update status, quality update status
Intune admin center → Devices → Monitor	Per-device update status, pending updates, failed updates
Microsoft Defender portal → Device inventory	Security update status per device
Endpoint Analytics	Update impact on device performance (boot times, crashes)

Key reports

Report	Purpose
Windows update compliance	Which devices are current vs behind on updates
Feature update status	Progress of a targeted feature update rollout
Quality update status	Which devices have the latest security patches
Update failures	Devices where updates failed with error codes
Delivery Optimization	Bandwidth savings from peer-to-peer sharing

Deep dive: update monitoring workflow

Sam’s weekly update monitoring routine:

Monday: Check quality update report — any devices missing last week’s patches?
Tuesday: Review update failures — investigate and remediate failed devices
Wednesday: Check Delivery Optimization report — verify bandwidth savings
Friday: Review feature update rollout progress (if active)

For Ring 0 (IT preview), Sam monitors daily for the first 3 days after updates release. If issues appear, he pauses the update ring for Ring 1 and Ring 2 before they receive the update.

🎬 Video walkthrough

🎬 Video coming soon

Cross-Platform Updates & Delivery Optimization — MD-102 Module 27

~10 min

Flashcards

Question

How does Intune manage Android system updates?

Click or press Enter to reveal answer

Answer

Through device configuration profiles: set update behaviour to automatic, windowed (specific time), or postpone (up to 30 days). For Samsung devices, Knox E-FOTA provides deeper control including firmware version pinning. Personal work profile devices can't be controlled for system updates.

Click to flip back

Question

What is Delivery Optimization and why use it?

Click or press Enter to reveal answer

Answer

A peer-to-peer content sharing technology in Windows. Devices share update and app content with nearby devices instead of each downloading from Microsoft's servers. Reduces internet bandwidth usage. Default mode is LAN (local network sharing).

Click to flip back

Question

Name three places to monitor update status in Intune.

Click or press Enter to reveal answer

Answer

1. Intune admin center → Reports → Windows updates (compliance overview). 2. Devices → Monitor (per-device status). 3. Endpoint Analytics (update impact on performance). Additionally, the Defender portal shows security update status.

Click to flip back

Knowledge Check

Riko has 20 Samsung tablets at Pixel & Co that must stay on a specific Android firmware version because the design app hasn't been tested on newer firmware. How should Riko control this?

Knowledge Check

Sam notices that every time a Windows update is released, his office's internet bandwidth is overwhelmed because all 300 Wellington office devices download the update simultaneously from Microsoft. What should Sam configure?

🎉 Congratulations! You’ve completed all 27 modules of the MD-102 study guide. Review any modules you found challenging, then head to the practice questions to test your knowledge.