You have a Microsoft 365 E5 subscription and need to manage OS updates for corporate-owned Android Enterprise devices enrolled in Microsoft Intune. Which mechanism should you use?

A configuration profile is the correct mechanism because Intune uses device configuration profiles to manage settings and features on devices, including OS updates for Android Enterprise. You can create a profile that specifies update policies, such as automatic updates or maintenance windows. A compliance policy defines the conditions a device must meet to be considered compliant, but it doesn't deploy updates. An Android FOTA (Firmware Over-The-Air) deployment is a manufacturer-specific update mechanism, not a general Intune management feature. An Endpoint security policy focuses on security settings like antivirus and firewall, not OS update deployment.