Preventing unattended application updates initiated via the Play Store

Disabling the Play Store can be achieved via the MX AppManager and will prevent all automatic user and system application updates.  This is an all-or-nothing solution and applications cannot be selectively updated; to update any Play Store application it is necessary to first re-enable the Store.

This technique will work equally well on managed and unmanaged Android devices.

Since Google Play Services relies on the Play Store to update, disabling the Play Store will also prevent Google Play Services from updating.

Change the Play Store setting for automatic updates (Global setting).

This applies to both user and system applications.

Note that Google reserve the right in their Terms of Service to override this setting to fix critical security vulnerabilities.

The global Play Store setting is (Play Store) --> (Menu) --> Settings --> Auto-update apps

Applications will only automatically update if configured to do so however this must currently be configured manually since there is no Staging or EMM API to adjust this setting.

If you disable automatic updates, an additional UI component in the Play Store suggests end users turn it back on:

The user is also nagged through a notification from the Play Store to perform the update manually:

The user can then perform the update directly from the notification.  There is no setting to specifically prevent this notification from being shown, it is therefore necessary to block all notifications from the Play Store app to prevent a manual update initiated by the end user.

Change the Play Store setting for automatic updates (application specific setting).

This applies to both user and system applications.

The application specific setting is (Play Store) --> My Apps --> (Select App) --> (Menu) --> Auto-update check

In common with the global setting, if updates are available the end user is presented with a notification prompting them to manually update the application.  An additional confirmation dialog is shown when the user updates an application manually that is configured to not allow auto-updates.  This confirmation dialog is unique to this scenario and is not shown if automatic updates are disabled globally:

Package manager shell:

adb shell pm disable

https://developer.android.com/studio/command-line/adb.html#pm

Manually disable the app from the app info screen by pressing the ‘DISABLE’ button

The disable button will only appear for system apps so this technique is not applicable for user applications.

Applications disabled in this manner will NOT automatically update regardless of whether the Play Store is configured for automatic updates.

Will work for both System and User applications but is only supported on Zebra devices.

MX is accessible through an SDK or via Zebra’s StageNow tool.

The Play Store itself can be disabled via this technique.

Applications disabled with the AppManager will NOT automatically update regardless of whether the Play Store is configured to auto-update applications.  If the end user has access to the Play Store application, they are given the option to manually ‘Enable’ the app from the Play Store UI:

Enabling an application previously disabled by the AppManager undoes the effects of AppManager; the application reappears in the launcher and is once again subject to automatic updates.

This technique will also prevent the end user from using the application.

Will only work for user applications, not system applications meaning this technique cannot be used to disable the Play Store.

Applications disabled with the AccessManager will NOT automatically update regardless of whether the Play Store is configured to auto-update applications.  If the end user has access to the Play Store application, they are given the option to manually ‘Enable’ the app from the Play Store UI:

Enabling an application previously disabled by the AccessManager does not undo the effect of AccessManager whitelisting and the app will not appear in the launcher, in contrast to the AppManager technique described previously.

An application enabled in this manner will now appear in the list of pending updates in the Play Store however it will not be automatically updated and attempting a manual update will lead to a generic error:

To avoid confusion, tools like Zebra's Enterprise Home Screen can be used to prevent the user from accessing the Play Store, if appropriate.

This technique will also prevent the end user from using the application.

Whether or not these system apps are disabled will depend on your method of provisioning as it can be configured.  Your EMM is able to re-enable system apps by calling a client-side API.

Exactly which system applications are disabled will depend on how the Operating System was built and may be customized by the OEM but the Play Store and Play Services will always remain enabled.

System applications disabled in this manner will not appear to the user or show as installed in the Play Store app so are not be subject to automatic updates.

Suspended packages will still be shown to the user but will be grayed out and attempting to click on the icon will present the user with a DO branded message box indicating that the operation is not allowed.

Both system apps and user apps can be suspended however suspension has no effect on whether or not the application is updated. If the Play Store is configured for automatic updates then suspended apps will be updated alongside their non-suspended counterparts.

Will prevent all user and system apps from updating but it is not possible to selectively specify which apps are subject to updates, it is an all-or-nothing solution.  There is a distinction and often a confusion between the Play Store and the Play Services, disabling the former can be achieved without negatively impacting the functionality of the OS or system apps, in stark contrast to the latter.

StageNow barcode to disable the Play Store

StageNow barcode to enable the Play Store

The two barcodes above (also available as attachments to this document) can be used to enable or disable the Play Store with Stage Now.

Note that disabling the Play Store will also prevent Google Play Services from updating.

Disable application updates from the Play Store [(Play Store) --> (Menu) --> Settings --> Auto-update apps]

Block notifications from the Play Store.

Prevent end users from accessing the Play Store to change the setting

Requires additional provisioning steps to:

1. Configure the Play store setting, since it cannot be a changed via EMM
2. Block notifications from the Play Store to avoid the user being prompted to perform a manual update.

At the time of writing, both of these steps can only be performed manually.

There are numerous ways to prevent users from accessing the Play Store e.g. Zebra’s Enterprise Home Screen (EHS).  This leaves the Play Store itself available if required e.g. for remote installation of applications on managed android devices or allowing critical updates to be pushed by Google.

This could save on bandwidth as non-essential apps would not be updated.

Of all the techniques discussed to disable applications, the MX AccessManager provides the most complete solution as it cannot be circumvented from the Play Store and is easily configurable from StageNow or supported EMMs.