Samsung Knox gives IT control over Android OS updates

Knox's E-FOTA feature lets IT test Android OS updates before users install them on their Samsung devices, preventing apps from breaking.

IT administrators in Samsung shops can finally manage Android OS updates with a new Knox feature.

A common problem in organizations is users being able to update the operating system on their mobile devices without IT having any control. As a result, some business apps may not work, because they don't support the new version of the OS. The new Knox feature, Enterprise Firmware Over-The-Air (E-FOTA), gives IT departments control over Android OS updates on Samsung devices. Citrix XenMobile is the first third-party enterprise mobility management (EMM) platform that will support this feature.

"It would be highly beneficial to have this capability," said Matt Kosht, an IT director at a utility company in Alaska that uses XenMobile. "This puts the mobile device into a better-controlled asset lifecycle IT is more accustomed to."

IT has had the ability to control Windows operating system updates for a long time -- although, some of those capabilities are changing in Windows 10 -- but it is still emerging for mobile devices. There is no way for IT to control Apple iOS updates, and E-FOTA is the first for Android.

Test first, deploy Android OS updates later

Knox, Samsung's enterprise mobile security software for its Galaxy devices, is a stand-alone feature that separates and protects business and personal content on the same device. It can also integrate with third-party EMM products to provide additional functionality. With E-FOTA, IT can set a policy to configure a device and restrict users from downloading Android OS updates right when they come out, giving IT time to test app compatibility first.

It's important for IT to know which apps will have a problem with an OS update, so it's a great capability.
Eric Kleindirector of mobile software at VDC Research Group

"It's important for IT to know which apps will have a problem with an OS update, so it's a great capability," said Eric Klein, director of mobile software at VDC Research Group Inc., in Natick, Mass. "It saves them from downtime based on an application not working."

From a productivity perspective, having business apps down for an extended period of time can be costly, said Jack Gold, principal and founder of J. Gold Associates LLC, a mobile analyst firm in Northborough, Mass. At the same time, IT should not completely avoid updating mobile operating systems, because they need users to get the latest security enhancements, he said.

"You want to test to make sure when something new comes out, it's OK, and then roll it out, rather than let Samsung dictate that," he added.

E-FOTA device support

Samsung devices running Android Nougat 7.0 or later support E-FOTA. This list includes Galaxy S6, S7 and S8 smartphones, as well as the Galaxy Note 5 tablet.

How XenMobile fits in

Knox customers can use E-FOTA today on any supported Samsung devices. Citrix customers who want to use the feature must have their devices enrolled in XenMobile, as well as Knox, and they must pay an additional cost to Samsung. The companies did not disclose pricing. The new feature will be available for XenMobile around the launch of the Galaxy S8 on March 29, Citrix said.

Although Citrix is the first EMM platform to say it will support E-FOTA, it's safe to assume other vendors will follow suit, Klein said.  

"I don't think this would be a differentiator," he said. "I don't see anything stopping other vendors from doing the same thing."

Next Steps

The 411 on Samsung Knox security

Citrix advances XenMobile EMM options

Samsung Knox is NSA-approved

New initiative might make Android more business-friendly

Dig Deeper on Mobile management

Unified Communications