Block and unblock Android Enterprise provisioning

By default, all Knox Guard activated devices manufactured with Android 15 OS and higher can’t be enrolled into Android Enterprise and managed with a UEM. This blocks IT admins from enabling fully managed and work profile device provisoning. The Fully managed device provisioning mode — also known as device owner (DO) provisioning mode — provides full device management control to the MDM app. The Work profile device provisioning mode — also known as profile owner (PO) provisioning mode — allows personal devices to be enrolled as managed devices.

To manage devices with Android Enterprise, you must unblock device provisioning in Knox Guard. Only select partners can submit a request to Samsung admins for Android Enterprise provisioning permissions.

Allow Android Enterprise provisioning

To allow device provisioning:

1. Select one or more devices from the Devices page.

2. Select ACTIONS > Manage policy > Unblock DO Provisioning.

   

3. On the Unblock DO Provisioning pop-up, review the device provisioning agreement. If you accept the terms, click Confirm. A message displays near the top of the screen verifying that the devices have been submitted.

Activation might take some time based on the device’s network.

Allow Android Enterprise provisioning in bulk

You can select devices in bulk by entering their IMEIs or serial numbers into a standardized template. The maximum number of devices you can select in one action is 10,000.

To allow device provisioning in bulk:

1. Select BULK ACTIONS in the bottom of the left navigation pane.

2. To download a standard template, click Download CSV template.

3. Under the ADVANCED CONTROLS section of the Bulk actions screen, select UNBLOCK DO PROVISIONING and upload your CSV file containing the device IDs.

   

4. Click CONFIRM to submit the devices. A message displays near the top of the screen verifying that the devices have been submitted.

Activation might take some time based on the device’s network.

Block Android Enterprise provisioning

To block selected devices:

1. Select one or more devices from the Devices page.

2. On the Devices page, select ACTIONS > Manage policy > Block DO Provisioning.

   

3. On the Block DO Provisioning pop-up, review the device provisioning agreement. If you accept the terms, click Confirm. A message displays near the top of the screen verifying that the devices have been submitted.

Activation might take some time based on the device’s network.