How to install/update an application on devices through Knox Guard?

Overview

The Knox Guard solution has been widely used by carriers and financial institutions to reduce financial risks on installment plans, as with Knox Guard, it is possible to send to devices lack of payment alerts and impose device restrictions.

In many situations, companies have an own developed application that is used to allow users make payments. Knox Guard offers a mechanism to push and install an application to enrolled devices so in case device is locked by Knox Guard, the application can be invoked by end user. This article will cover application installation procedure and update.

Steps to install an application in device through KG console:

Uploading an application at KG console:

• Access KG console > Policies menu > Advanced Controls > Application Installation option

  

• Browse the application package that should be stored on your PC and select it. The application will be uploaded to KG then select the option “save” on the bottom of the page.

  

• To update or change an existing application at KG the process is quite similar, so the IT admin should select a different application file (or the same application but with a newer version) by selecting “Change” button in the console.

Application Installation on devices enrolled on KG

Once the application was uploaded at KG console, it is necessary to update the Default Lock Screen Policy to show it. This can be achieved following the path:

• Access KG console > Policies menu > Device Lock > Default Lock Screen option
• At “Advanced support methods” select “Make an app available on lockscreen” option, then “Import APK information”. This will link the Lock Screen with the uploaded application.
• Save the policy

The application will be installed/updated on the device as soon as one of the 3 conditions below are met:

• Heartbeat — Once a day all devices receive a heartbeat signal from KG server, which is used to update their status on the server. The application will be installed/updated on device when the server sends this heartbeat request. It is not possible to determine the exactly time that server sends this type of request.

• Blink Reminder — Another action that trigger the application installation/update is when a blink reminder notification is issued. This type of message will update the policies applied to the device on server side, so if an application was uploaded on KG console, the device that receives the blink reminder will install/update the application.

• Lock Device — It is also possible to trigger the application installation/update by sending a Lock device action. This command will make the device update the policies that are applied on KG console including installation/update of the application.

In case it is an application update/change, once the IT admin has uploaded the new application file at KG Console (Policy “Application Installation”) then he/she needs to reflect the new application file also at “Default Lock Screen” Policy by selecting “Import APK information” option.

How can an End User remove the Application Installed by Knox Guard?

Due to security reasons, end users are not allowed to uninstall the application set by KG on their devices. The option to uninstall the application appear greyed out.

In case KG IT admin wants to allow end users to remove the installed application, they should remove the application from Application Installation policy and wait the device get synced with KG server (Heartbeat or the other 2 conditions explained earlier). After that sync, the application can be manually removed by users.

How can I enable the Application Installation in my Knox Guard console?

Currently, the Application Installation policy is an optional feature of Knox Guard. Please contact your local Samsung Knox Guard administrator to enable it on your account.