KG Frequently Asked Questions (FAQs)

Refer to the following Knox Guard frequently asked questions (FAQs) to familiarize yourself with questions other Knox Guard users are raising with the Samsung Knox team, and the answers shared with the Knox user community.

Q: Can you complete and/or delete a device from any state?

A: Changing any device state to ‘complete’ or ‘delete’ is supported. However, changing the state from ‘active’ to ‘delete’ is not supported in order to prevent the deletion of a device by mistake.

Q: Can we complete, delete and re-enrol the same device?

A: Yes, as long as both the license key and device IMEI are the same. In this case re-enrolling the same device will not consume an additional seat of the license.

Q: What are the length limits for the email and tel. fields? Does the tel. field have any other restrictions enforced?

A: The Tel. field has a maximum length of 20 characters, and only allows ‘#,+, *’ and numeric characters. The email field has a maximum length of 60 characters and must include ‘@’ and ‘dot’

Q: What are the character limits on overdue notifications, blinking reminders and screen lock?

A: Overdue notifications allow up to 500 characters, blinking reminders allows up to 200, and screen lock allows up to 350 characters.

Q: When a device is initially setup, is there a window in which the device will activate within the KG service?

A: When the device is connected to the internet during the setup, it will complete the KG enrolment after the initial setup is completed.
The KG agent will check for enrolment once every 24 hours for 7 days after the initial connection. (In case no enrolment has occurred).

Q: How to unlock devices using pin code?

A: The following steps outline how to unlock a device using a pin code:

  1. User will provide the passkey available on the device lock screen to the KG admin
  2. From the KG portal, the admin will click on [pin] next to the device status, and enter the passkey
  3. In return, the KG portal will generate a pin code that can be provided to the user to unlock their device.

Q: Can we make an application available on lock screen without pushing it via KG?

A: Yes, an application can be available on lock screen without uploading it via KG (by defining the “Application package name” field within the “Default Lock Screen” policies on KG portal). However, the application must be already installed on the device.

Q: Do I need a license to use Knox Guard? If so, where do I get a license? And, how do I use it?

A: Purchasing a license key is required to use Knox Guard. Contact our sales team or your local Knox license reseller for purchase. Once purchased, access the Knox Guard console to enter your license key. After your devices are uploaded by the KDP device resellers with your Customer ID, the license is applied and activated automatically on the devices accepted into Knox Guard.

Q: What happens to a Knox Guard managed device once it is fully paid for by the end user?

A: Once a device's payment status is set as 'completed', the Knox Guard client will be deactivated on the device and the device will no longer be tracked or controlled with Knox Guard.

Q: The device is locked with the notification "This phone can't be used without authorization," but its status on the Knox Guard console is marked as active. Why does this happen?

A: A Knox Guard managed device can automatically lock itself to protect against malicious attacks. In such cases, you can unlock the deviceby deleting the device's IMEI from the Knox Guard console and rebooting the device. Before deleting the device, please ensure that there are no outstanding payments.

Q: What is an Approval ID?

A: The Approval ID is a billing approval ID used with a financial institution's unique billing system to approve a loan payment. An approval ID is also used to distinguish customers, instead of an IMEI. If a carrier is using an IMEI, they do not necessarily need to consider an approval ID. That is why this field is optional.

Q: Who uploads devices into Knox Guard?

A: A device reseller integrating with Samsung can upload devices into Knox Guard using either automation API or the Samsung Knox Reseller Portal.

Q: Does Knox Guard only use a device's IMEI/SN as the device ID?

A: No. A MEID is also supported as a device ID.

Q: Can Knox Guard be used with other Knox services such as Knox Configure?

A: Yes. Knox Guard can co-exist with both Knox Configure (KC) and Knox Mobile Enrollment (KME) when the device is running Android P or above.

Q: What accounts are needed to use Knox Guard?

A: You need both a Samsung account and a Knox portal account to access Knox Guard.

Q: Can an admin accept multiple pending devices into Knox Guard at one time?

A: Multiple pending devices can only be accepted into the portal at one time when they are from the same reseller.

Q: What does a "payment complete" device status mean in Knox Guard?

A: Payment complete means the subscription loan is repaid completely.

Q: What are the options for stopping payment blink reminders on an overdue device?

A: Blink reminders can be stopped from the Guard console's Actions menu for selected devices currently receiving notifications.

Q: How do I restrict a device to a particular telecom operator?

A: Go to Knox Guard Console > Policies > SIM Control and Enter MNC and MCC of the telecom operators that can be used fully without any restrictions on the devices.

Under "Choose to lock the device and/or restrict the following actions for the unlisted MCC/MNC", select the options you want to perform in the device in case an unlisted SIM card is detected. Various possible options are: Lock Device, Block Incoming or Outgoing calls, Block SMS/MMS/RCS, Block data usage for unlisted SIM cards.

Q: How do I restrict a device to a first inserted SIM of an allowed telecom operator?

A: Go to Knox Guard Console > Policies > SIM Control and Enter MNC and MCC of the telecom operators that can be used fully without any restrictions on the devices.

Under "Choose to lock the device and/or restrict the following actions for the unlisted MCC/MNC", check off "Lock Device" and "Turn on mobile number (IMSI) lock". This will restrict the device to the first SIM inserted in the device belonging to the allowed MNC and MCC of the telecom operators.

Note that if any other SIM belonging to the allowed MNC and MCC is inserted in the device, the device will be locked. This feature ensures the device is restricted to the first inserted SIM of allowed MNC and MCC.