Manage devices

Devices uploaded to the Knox cloud services are shown in the common device list on the Knox Admin Portal’s Devices page after they are approved. You can access the Devices page to view your devices.

Approved devices are shown in the Devices page of specific Knox service consoles, such as the Knox Mobile Enrollment console or the Knox E-FOTA console, only when you assign them one of the following:

• An enrollment profile containing configuration settings for Knox Mobile Enrollment, Knox E-FOTA, or Knox Asset Intelligence
• A Knox E-FOTA campaign
• A Knox Configure profile
• A Samsung Care+ for Business license

For more information about how to view devices in your Knox service console, see Register devices to your Knox services.

About the Devices tab

The common device list on the DEVICES tab shows device information, such as the device IMEI/MEID, model name, and device status for each service.

If a device has more than one IMEI, the primary IMEI is shown by default, with the secondary IMEI shown as a tooltip when you hover over the primary IMEI. In the tabs above the list, click a service name to jump to information about that service for the devices you’re currently seeing. To see all the service details in a sliding panel, click the device IMEI/MEID.

You can also sort the list by column and apply filters to one or more columns. To remove any filters that you applied, click Clear all filters.

By default, 25 devices are shown per page, with the option to adjust the view to 50 or 100 devices per page. You can use the search bar to find single or multiple devices.

To perform an action on certain devices, select them in the list. Above the list, you’ll then see links to the service consoles the devices are associated with. Select a service to go to a filtered view of that service’s device list, which only shows the devices you selected from the common device list.

Configure the device list

To customize the columns in the common device list, click Settings. You can select which services you want to see in the list, as well as specific device information related to each service. If you can’t see or select a particular service, make sure you’re registered for it and that the service is shown on the portal.

Export device information

You can download device information from the common device list as a CSV file, and have the option to customize the data that’s exported.

To export common device information:

1. On the Devices page, click Download as CSV. The Download as CSV page opens.

2. Choose whether you want to include all available columns in your export, or just specific columns that you select. By default, the columns shown in the device list are pre-selected.

3. Click DOWNLOAD ALL COLUMNS or DOWNLOAD SELECTED COLUMNS to export those device details.

The information is downloaded as a CSV file.

Assign enrollment profiles

Using enrollment profiles, you can bulk-enroll corporate devices right out of the box, manage how they are enrolled, and specify what they can do during and after enrollment. You can assign or unassign enrollment profiles, if at least one of the following services is registered and selected under Settings > Show/hide services:

• Knox Mobile Enrollment
• Knox Manage
• Knox E-FOTA
• Knox Asset Intelligence

Access permissions

Ensure that your assigned role has the required permissions to manage devices, profiles, and campaigns.

• To view and perform common actions, you must have the required common permissions. For more information, see Manage roles.
• To view and perform actions specific to a service, you must have the required permissions for that service. For more information, see the respective service documentation.

Common menu and actions

Assign an enrollment profile

1. Click Devices on the Knox Admin Portal navigation pane. The Devices page displays.

2. Select the devices to which you want to apply the enrollment profile.

3. Click Actions > Common > Assign enrollment profile. The Assign enrollment profile page opens and shows a list of available profiles.

   If no profile is available, click Create new profile. For more information, see Create an enrollment profile.

4. Select an enrollment profile and click Assign.

The enrollment profile is applied to the selected devices. Any existing enrollment profile already assigned to the device is overridden by the new enrollment profile you just assigned.

Consider the following when assigning enrollment profiles:

• If your account is registered for multiple Knox cloud services and you assign an enrollment profile to a device that’s not yet enrolled in a service, it’s auto-enrolled in that service.
• If the enrollment profile applies to a Knox cloud service that’s hidden (Settings > Show/hide services), you won’t be able to use the service in the Knox Admin Portal.
• In case of both Knox E-FOTA and Knox Asset Intelligence, on assigning enrollment profiles, the AUTO ENROLLMENT column on the Devices page displays the status On.

Unassign an enrollment profile

When you unassign an enrollment profile, out-of-box-experience (OOBE) enrollment is disabled on your device for Knox cloud services.

1. On the Devices page, select the devices from which you want to remove profiles.
2. Click Actions > Common > Unassign profile. The Unassign enrollment profile dialog displays.
3. Click Unassign.

Assign EMM credentials

To manage devices with an EMM, you must assign the EMM’s credentials to devices. This action is available only if:

• The Knox account is registered for Knox Mobile Enrollment, Knox Manage, Knox E-FOTA, or Knox Asset Intelligence.
• You are assigned the EMM credentials > Create and edit permission.

To assign EMM credentials:

1. On the Devices page, select one or more devices to be managed using the EMM.

2. Click Actions > Common > Assign EMM credentials. The Assign EMM credentials dialog displays.

3. Select or enter the EMM user ID to assign.

   You can enter a maximum of 100 characters for the EMM user ID. Ensure that the user ID doesn’t contain these special characters: # / $ * % & : \ ( ) + ? { } [ ] < >.

4. (Optional) Enter the EMM password to assign. If a password is saved for the selected user ID, it is automatically populated in the field.

   You can enter a maximum of 100 characters for the EMM password.

5. Select Overwrite existing EMM credentials to replace any EMM credentials that already exist on the device.

6. Click Assign.

A notification confirms the successful assignment of EMM credentials to selected devices. In case of unsuccessful or partially successful assignments, you can download a CSV file from the notification to view details.

The EMM credentials associated with a device are available in the device details panel for future reference.

Assign and remove common tags

You can assign up to 10 common tags to devices. The tags assigned to a device are also shown in the device details.

When you assign a common tag to a device, the information is shown in the device list and the device details. It is also shown in the common tag list.

To assign common tags, select one or more devices, click Actions > Assign common tags, enter the tag names, and click Save. You can select from an existing tag or add a new tag.

To remove assigned tags from devices, select the devices and click Actions > Remove common tags.

Reassign license keys

In addition to viewing devices and their assigned licenses, you can also reassign different license keys to active or expired Samsung devices on the Devices page.

You can use this feature with Samsung devices that are assigned a license key for a Knox Suite Plan, Knox E-FOTA, Knox Asset Intelligence, Knox Manage, or Knox Manage for Wearables. Samsung devices managed by Knox Manage are supported only if the device uses at least one other Knox cloud service (excluding Knox Guard and Knox Remote Support). Devices enrolled in Knox Guard and Knox Remote Support are not shown in the common device list.

To reassign licenses for Samsung devices:

1. Select one or more devices in the Devices page. You can also select all devices displayed on the page.
2. Click Actions > Reassign license key. The Reassign license key page opens and lists the licenses you have access to.
3. Search for and select the license you want to reassign to your selected devices.
4. Click Assign.
5. (Optional) If more than one license seat gets assigned to a device, the Duplicate license seats used dialog displays. To proceed, select Confirm to assign the license anyway. To remove the duplicate licenses, you must manually unenroll the device first.

The licenses are updated and the changes are shown in the common device list.

Enroll devices in services

You can now enroll devices to Knox E-FOTA and Knox Asset Intelligence directly from the common device list without performing a factory reset. This feature is available only for the devices that were added to the Knox Admin Portal after completing setup, but are not yet enrolled in any Knox service.

Ensure that you are assigned the Enroll devices in services permission to use this feature.

To enroll the devices:

1. On the Devices page, select the devices to enroll.
2. Click Actions > Common > Enroll devices in services. The Enroll devices in services dialog displays.
3. Select Knox services to enroll the devices:
   • Knox E-FOTA
   • Knox Asset Intelligence
4. Click Enroll.

Select or enter the EMM user ID to assign

Delete devices

As an admin, you can delete devices across Knox cloud services from the Devices page on the Knox Admin Portal, without the need to navigate to individual services. To do so, you must have access to the services and the Delete devices common permission assigned to your role.

Before you delete a device, make sure that it can be safely deleted from all Knox cloud services. If you want to delete a device from specific services only, you must delete it from their respective consoles instead of the Devices page. For example, if your device is enrolled in Knox E-FOTA and Knox Configure, and you want to keep it enrolled in Knox E-FOTA, delete the device from the Knox Configure console.

You can delete selected devices manually or in bulk using a CSV template.

To manually delete devices from Knox cloud services:

1. Select one or more devices in the Devices page.

2. Click Actions > Delete device. This option is disabled if you don’t have the right permissions. The Delete device dialog displays.

3. (Optional) Enter a reason for deleting the devices, and click Delete.

A notification is shown to confirm whether the devices were successfully deleted or not.

• If the deletion is successful, the device is deleted from all supported services in the Knox Admin Portal, including Knox Remote Support.
• If the deletion fails or is only partially successful, you’ll see a notification with a link to download a CSV file containing information about each failed deletion.

Knox Mobile Enrollment menu and actions

If your devices are assigned an enrollment profile with advanced settings, you can lock, unlock, and factory reset the devices directly from the common device list, without navigating to the Knox Mobile Enrollment console.

You will need the Knox Mobile Enrollment > Devices and Uploads > Manage devices permission to perform these actions from the common device list. See Manage roles for more information.

Lock devices

You can restrict user access by locking devices from the common device list. This feature is available only if an enrollment profile with advanced settings is used for the device and the device is in the Provisioned status.

To lock a device using the Actions menu:

1. On the Devices page, select the devices to lock.
2. Click Actions > Knox Mobile Enrollment > Lock devices. The Lock devices dialog displays.
3. Click Lock.

The device is locked and cannot be accessed till it’s unlocked. The device status changes to Locked on the common device list.

Unlock devices

For devices that are in the locked status, you can restore full access for device users in two ways: - From the Actions menu - Using PIN in the Lock status column or the device details panel

To unlock from the Actions menu:

1. On the Devices page, select the locked devices.

2. Click Actions > Knox Mobile Enrollment > Unlock devices. The Unlock device dialog displays.

3. Click Unlock.

PIN-based unlocking requires you and the device user to perform the following actions:

1. On the Devices page, select the Knox Mobile Enrollment tab and scroll to the Lock status column.

2. Click PIN. The Unlock device dialog opens. Additionally, an eight-digit passkey is displayed on the device user’s screen.

3. Request the device user to share the passkey with you.

4. Enter the passkey in the Unlock device dialog, and click Continue to generate a one-time eight-digit PIN.

5. Share the generated PIN with the device user. The device user enters this PIN to unlock their device.

The device is unlocked and its status is updated to Unlocked on the common device list.

Factory reset devices

You can factory reset devices that are in the Locked status and are assigned an advanced profile:

1. On the Devices page, select the locked devices.

2. Click Actions > Knox Mobile Enrollment > Factory reset devices. The Factory reset devices dialog displays.

3. Click Reset devices.

The devices are restored to the original out-of-the-box state.

Knox E-FOTA menu and actions

You can perform the following actions directly from the common device list, without navigating to the Knox E-FOTA console. See Manage roles for the permissions required for each action.

Assign a campaign

Knox E-FOTA campaigns are used to apply firmware updates to devices. For more information see Introduction to campaigns.

You can manage the firmware updates from the Devices page in Knox Admin Portal by assigning or unassigning campaigns to selected devices.

1. Click Devices on the Knox Admin Portal navigation pane. The Devices page displays.

2. Select the devices to apply a Knox E-FOTA campaign.

3. Click Actions > Knox E-FOTA > Assign campaign. The Assign campaign page opens and shows a list of available campaigns. You can click a campaign to view detailed information.

   If no campaign is available, click Create campaign. For more information, see Create a campaign in the Knox E-FOTA guide.

4. Select a campaign and click Assign.

5. (Optional) If a device is already associated with a campaign, the Reassign campaign dialog displays. Click Reassign to assign the selected campaign instead.

The campaign is applied to the selected devices.

Unassign a campaign

1. On the Devices page, select the devices from which you want to remove a campaign.
2. Click Actions > Knox E-FOTA > Unassign campaign.
3. Click Unassign in the Unassign campaign dialog that displays.

Force client refresh

If you have the Knox E-FOTA > Manage devices permission, you can force refresh the Knox E-FOTA client on enrolled devices.

Note that this action is not supported on devices associated with any of the following statuses:

• Client status: Client not enrolled, Failed to enroll
• Operation status: Pending, Approved

To refresh the Knox E-FOTA client:

1. On the Devices page, select the devices.

2. Click Actions > Knox E-FOTA > Force client refresh. The Force client refresh dialog displays.

3. Click Refresh.

The Knox E-FOTA client on the devices is reset, and the campaigns assigned to the devices are restarted.

Unenroll devices

If you have the Knox E-FOTA > Manage devices permission, you can unenroll devices associated with the following operation statuses:

• Campaign not assigned
• Campaign sync expected
• Campaign synced
• Invalid license

For more information about the Knox E-FOTA status, see Manage devices.

To unenroll the devices:

1. Select the devices to unenroll.

2. Click Actions > Knox E-FOTA > Unenroll devices. The Unenroll devices dialog opens and displays information about the devices that can’t be unenrolled.

3. Click Unenroll to proceed.

A notification confirms the unenrollment of devices, and the devices status changes to Not enrolled. In case of unsuccessful or partially successful assignments, you can download a CSV file from the notification to view details.

Knox Asset Intelligence menu and actions

Unenroll devices

If you have the Knox Asset Intelligence > Manage devices permission, you can unenroll Active, Expired, or Inactive devices as follows:

1. Select the devices to unenroll.

2. Click Actions > Knox Asset Intelligence > Unenroll devices. The Unenroll devices dialog opens and displays information about the devices that can’t be unenrolled.

3. Click Unenroll to proceed.

A notification confirms the unenrollment of devices, and the devices status changes to Client not enrolled.

Request device diagnostics log

If you have Knox Asset Intelligence’s Diagnostics and Manage devices permissions, you can request diagnostic logs of Active devices enrolled in Knox Asset Intelligence:

1. Select the required devices.

2. Click Actions > Knox Asset Intelligence > Request device diagnostics log. The Request device diagnostics log dialog opens.

3. Select the logs to include in the device diagnostics:

   • Device debug log: Select to include device issues in the diagnostics.
   • TCPdump log: Select to include network issues in the diagnostics
   • Silent request: Select to include logs from fully managed devices without informing device users — admins are responsible for informing device users. This option is not available if you select TCPdump log for network issues.

4. Click Request.

Request device snapshot

If you have the Knox Asset Intelligence > Manage devices permission, you can request a snapshot of an Active device as follows:

1. Select the required devices.

2. Click Actions > Knox Asset Intelligence > Request device snapshot.

When the device snapshot is ready, it is displayed in the SNAPSHOTS tab of the Knox Asset Intelligence console.

Schedule device snapshot

If you have the Knox Asset Intelligence > Manage devices permission, you can also automate the collection of snapshots of Active devices enrolled in Knox Asset Intelligence:

1. Select the required devices.

2. Click Actions > Knox Asset Intelligence > Schedule device snapshot. The Schedule device snapshot dialog opens.

3. Select the conditions for which snapshots must be automatically collected. You can automate snapshots for:

   • App events
   • Battery drain event
   • Mobile network events

4. Select Device debug log to include it in the snapshot.

5. (Optional) For fully managed devices, toggle Silent request to capture snapshots without notifying device users.

6. Click Schedule.

Automated snapshots are displayed in the SNAPSHOTS tab of the Knox Asset Intelligence console.

Send permissions notifications

If you have the Knox Asset Intelligence > Manage devices permission, you can send notifications to device users asking them to permit the collection of their device’s location data. This action is available only for Active devices enrolled in Knox Asset Intelligence.

To send the notifications:

1. Select the required devices.

2. Click Actions > Knox Asset Intelligence > Send permission notification. The Send permission notification dialog opens. It shows the notification displayed to device users, and information about the devices that won’t be notified.

3. Click Send notification.

The device users will be sent the email notification for permission to collect their location data. For more information, see Location dashboard.

Knox Configure menu and actions

Assign a profile

With Knox Configure profiles, you can configure settings, such as restrictions, apps, and content, for your enterprise devices when they’re deployed or updated. For more information see About Knox Configure profiles.

You can apply or remove Knox Configure profiles from devices using the Devices page.

1. Click Devices on the Knox Admin Portal navigation pane. The Devices page displays.

2. Select the devices to apply a Knox Configure profile.

3. Click Actions > Knox Configure > Assign profile. The Assign profile page opens and shows a list of available profiles.

   If no profile is available, click Create profile. For more information, see Create a profile in the Knox Configure guide.

4. Select a profile and click Assign.

5. (Optional) If a profile was already assigned to the selected devices, choose whether to continue using the current license for the new profile:

   • Click Keep licenses to use the current license with the new profile
   • Click Select new license to use a different license with the new profile

6. The Select license page opens. Select a license to use for the new profile and click Assign.

7. (Optional) If the license does not have enough seats for the number of devices you selected, use the Enter license key or Get a license options on the Select license page to get additional licenses. For more information, see Enter a license key and Get a license in the Knox Configure guide.

The profile is applied to the selected devices.

Unassign a profile

1. On the Devices page, select the devices from which you want to remove a profile.
2. Click Actions > Knox Configure > Unassign profile.
3. Click Unassign in the Unassign Knox Configure profile dialog.

Push profile update

If you have the Knox Configure > Manage devices > Assign and push update permission, you can apply profile updates to devices that are enrolled in Knox Configure and are in the Configured, Updates pushed, Failed to configure, and Failed status:

1. On the Devices page, select the devices to apply the profile update.

2. Click Actions > Knox Configure > Push profile update. The Push profile update dialog displays.

3. Select from the following to configure which updates to apply to devices:

   • Only changed items
   • Full profile update

4. Select from the following to configure the notification settings for device users:

   • Request consent from device user

   • Request consent and show custom notification. This option is available only if all selected devices have the same Dynamic profile and use Knox 3.4 or higher in Normal or ProKiosk mode. You can set the following additional options:

     • Select existing notification: Select from the options available.
     • Create new notification: The notification version is auto-generated. Specify the text for the new notification. Optionally, you can also specify a hyperlink.

   • Push update without requesting end-user consent

5. Select from the following options to configure when to set the profile updates:

   • Push now
   • Schedule date and time: Specify the Date, Time, and Time zone for the profile update.

6. Click Push update.

Depending on your configuration, a notification confirms the successful assignment or scheduling of profile. In case of unsuccessful or partially successful assignments, you can download a CSV file from the notification to view details.

Lock devices

If you have the Knox Configure > Manage devices > Lock permission, you can lock devices that are enrolled in Knox Configure with dynamic profiles and are in the Configured, Updates pushed, and Failed to configure status:

1. On the Devices page, select the devices to lock.

2. Click Actions > Knox Configure > Lock devices. The Lock devices dialog displays.

3. Select the contact details to display to device users when unlocking their devices:

   • Show contact information from the assigned profile
   • Show custom contact information. Specify company name, phone number, and email in the additional fields that display.

4. Click Lock.

The device status is changed to Locked.

Unlock devices

If you have the Knox Configure > Manage devices > Unlock permission, you can unlock devices that are in the Locked status in two ways: - From the Actions menu - Using PIN in the Lock status column or the device details panel

To unlock from the Actions menu:

1. On the Devices page, select the locked devices.

2. Click Actions > Knox Configure > Unlock devices. The Unlock device dialog displays.

3. Click Unlock.

To unlock using a PIN, you and the device user must perform the following actions:

1. On the Devices page, select the Knox Configure tab and do one of the following:

   • Scroll to the Device status column
   • Click on the device IMEI or serial number to open device details panel.

2. Click PIN. The Unlock device with a code dialog opens and displays a code.

3. Share the code with the device user, who must enter it on their device.

The device is unlocked and its status is updated on the common device list.

Reboot or factory reset devices

If you have the Knox Configure > Manage devices > Reboot/Factory reset permission, you can factory reset or reboot devices in the Configured, Updates pushed, and Failed to configure status:

1. On the Devices page, select the locked devices.

2. Click Actions > Knox Configure > Reboot or factory reset devices. The Reboot or factory reset devices dialog displays.

3. Select an option:

   • Reboot devices: Reboots the devices without device user consent.
   • Factory reset devices: Restores the devices to the original out-of-the-box state.
   • Factory reset and eSIM deletion: Restores the devices to the original out-of-the-box state and removes eSIM configuration.

4. Click Reset devices.

A notification displays to confirm the reboot or factory reset. In case of unsuccessful or partially successful assignments, you can download a CSV file from the notification to view details.