Frequently Asked Questions (FAQs)

General FAQs

  • Q: Where are the Knox E-FOTA servers hosted?

    A: Knox E-FOTA is hosted in the following regions:

    Region Amazon Web Services
    North/Central/South America and the Caribbean
    • Oregon, US
    • Virginia, US
    Rest of the world, except China and the Americas
    • Frankfurt, Germany
    • Ireland

    The server location is matched with the region the customer selects during the registration process on

  • Q: Which devices are supported by Knox E-FOTA?

    A: Knox E-FOTA supports devices that are running Android N and later on the following UI platforms:

    • Android – Secured by Knox
    • Android – Others

    Visit Devices Secured by Knox and filter for these devices.

  • Q: Which firmware versions can be downloaded through Knox E-FOTA?

    A: Knox E-FOTA gives you access to a list of official firmware released through the general Samsung FOTA service within the last 12 months.

  • Q: Do I need to do a firewall exception to use Knox E-FOTA?

    A: Yes, in order to securely reach and connect to Knox services and resources, a firewall exception is required. See Firewall exceptions for more information.

Features FAQs

  • Q: What does OOBE installation mean?

    A: If devices are preregistered through the Knox Deployment Program (KDP) and enrolled in the Knox E-FOTA service, the Knox E-FOTA client is automatically installed on these devices during the out-of-box experience (OOBE). This means a campaign will be automatically applied to the devices right after they are unboxed. If a factory reset is done on a device, the Knox E-FOTA client app will be installed again and the latest campaign will be applied automatically. For more information, see Automatically install and launch the client after unboxing.

  • Q: How can I install the Knox E-FOTA client app to devices?

    A: There are several ways you can install the Knox E-FOTA client app. See Install the Knox E-FOTA One client for more information.

  • Q: How does a device behave during a firmware update?

    A: See What happens to a device during a campaign?

  • Q: What happens when a device is unenrolled?

    A: If a device is unenrolled from the Knox E-FOTA service, the Knox E-FOTA client app is uninstalled automatically (depending on the device's condition). B2C-FOTA updates are then re-enabled on the device. In cases where the Knox E-FOTA client is not uninstalled automatically, the device user must uninstall it manually.

  • Q: How does EMM sync work?

    A: Once EMM sync is established, the device and group info will be synced every 6 hours. On-demand manual sync is also possible on the Knox E-FOTA portal.

  • Q: What happens when an admin deletes or cancels an active campaign (for example, the server is currently streaming binaries to target devices)?

    A: If an active campaign is stopped, ongoing activities (such as downloading) will continue to run until completed, but the firmware will not be installed.

  • Q: How many tags can be applied?

    A: There is no limitation to the number of tags that can be applied.

  • Q: Will Knox E-FOTA operate correctly under DO and COPE environments?

    A: Knox E-FOTA will operate correctly when it's installed on the User0(Primary user) area. Also, if the DO environment has a list of allowed apps, then Knox E-FOTA should be added to this list for it to work properly.

  • Q: How does Block the factory reset option in a Knox E-FOTA campaign work?

    A: In a Knox E-FOTA campaign, enabling Block the factory reset option disables factory reset for all devices in that campaign, including those managed by an MDM. If you previously configured factory reset for your device in an MDM, ensure you unconfigure the policy first. As soon as a device is assigned to a campaign with Block the factory reset option enabled, factory reset is disabled even if the campaign is scheduled to start at a later date. If the campaign expires, factory reset remains disabled on the device until you unassign it.

Technical FAQs

  • Q: What is a FOTA service?

    A: Firmware-over-the-air (FOTA) is a service that allows IT admins to efficiently and securely push firmware updates to a fleet of enterprise mobile devices. When pushing a firmware update, Samsung generates a delta file or a change file for updating a firmware to a new version. This will then be released through the general Samsung FOTA service, which is then delivered to enterprise devices over-the-air.

  • Q: What is the communication mechanism between the Knox E-FOTA server and client?

    A: The main communication mechanism is push based. When an IT admin configures devices through the Knox E-FOTA portal, the push message is sent through a Google FCM server. To back up the push system, we also implemented a polling mechanism. The client will periodically poll the server configuration information every 24 hours. Alternatively, the device user can manually poll for the latest policy from a server. See Push and poll.

  • Q: What background activities are happening on a device during the following processes:

    • Installation of Knox E-FOTA client app

    • Enrollment to Knox E-FOTA

    A: During the installation, no background activities are performed. During enrollment, the following are performed in the background:

    • Disable the device's B2C FOTA client

    • Disable uninstallation of the Knox E-FOTA client app. That is, the device user cannot uninstall it.

  • Q: What is the update policy for the Knox E-FOTA client?

    A: When the latest version of the Knox E-FOTA client app is published, the client app is updated.

  • Q: Is the Knox E-FOTA client a preloaded app?

    A: No. The Knox E-FOTA client is a downloadable app (platform-signed app).

  • Q: Is the Knox E-FOTA client available on Google Play?

    A: Yes, you can download and install Knox E-FOTA through Google Play.

  • Q: When an organization has multiple Knox services, in what order are the Knox services enrolled?

    A: See Enrollment flow.

Security FAQs

  • Q: Is multi-factor authentication for the Knox E-FOTA admin portal planned?

    A: Currently, Samsung Account supports 2FA. If you turn on 2FA for Samsung Account authentication, you can harden your authentication method.

Post support FAQs

  • Q: What is the post-GA release policy?

    A: The post-GA release policy is as follows:

    • Server only feature—Monthly release

    • Server / client feature—Bi-monthly release

Roadmap FAQs

  • Q: Which EMMs can be integrated with Knox E-FOTA?

    A: See Supported EMMs for a list of EMMs you can integrate with Knox E-FOTA. MobileIron and IBM will follow soon.

License FAQs

  • Q: What happens when the license expires?

    A: When a license expires, the firmware version is frozen on the devices that are using that license. If you want to stop using the Knox E-FOTA service after license expiration, you must unenroll the device to enable B2C FOTA updates.

    When your license expires, you can no longer assign devices to campaigns.

  • Q: How do Knox E-FOTA license counts work?

    A: Under the Knox Suite license key, Knox E-FOTA consumes license count on a per-seat basis. For example, if you enroll a device's IMEI in Knox E-FOTA and Knox Manage, only one license count is deducted.

  • Q: When are the license counts in Knox E-FOTA consumed?

    A: When your devices are uploaded to your Knox E-FOTA console, they are placed in a Pending status. Once you approve the upload, the corresponding number of license seats are consumed. For steps on how to approve your devices, see Add devices in the Knox E-FOTA admin guide.

Share it: