Use Samsung Knox Mobile Enrollment

Samsung Knox Mobile Enrollment allows you to quickly and easily enroll a large number of corporate-owned Samsung devices. The devices are automatically enrolled when users connect to the Internet. Even if you reset the devices enrolled by the Knox Mobile Enrollment program, the Knox Manage app is re-installed automatically and the devices are re-enrolled in to Knox Manage.

For devices running Android 11, the IT admin can now choose between fully managed and WP-C enrollment types during the provisioning process. The enrollment settings for devices running Android OS 10 or lower remain unchanged.

The Knox Mobile Enrollment program provides the following advantages:

• Enroll a large number of devices in bulk without having to manually enroll each device.

• Allow the Knox Mobile Enrollment devices to automatically install the Knox Manage app when the Knox Mobile Enrollment devices are reset.

Before using Knox Mobile Enrollment

To use Knox Mobile Enrollment properly, you must first do the following:

• Verify that Knox Mobile Enrollment is available in your country.

• Prepare a device from one of the following carriers or resellers to use the Knox Mobile Enrollment program:

  • A distributor approved by the Knox Mobile Enrollment program
  • A dealer sharing IMEI or serial numbers directly with the Samsung representative

• Ensure the devices are Samsung Galaxy devices running Knox 3.0 or higher.

• Sign up for a Samsung Knox Account to use for the single sign-on (SSO) account. When using Knox Mobile Enrollment from the Knox Manage console, you need to use your Samsung Account SSO credentials.

• Ensure that your target devices are either connected to a charger and charging or have more than 50% of battery. You can only install Knox Manage on your target devices if there is adequate battery backup on your device.

• Before enrolling devices using Android Enterprise’s Fully Managed Device, make sure the devices are running Android 6 or higher. For more information about Android Enterprise, visit the Android website at https://www.android.com/enterprise/.

For more information on using Knox Manage with Knox Mobile Enrollment through the Android Management API, see How do I integrate Knox Manage with Knox Mobile Enrollment?

Logging in to the Knox Mobile Enrollment Portal

Before you can use Knox Mobile Enrollment from the Knox Manage console, you need to create a Samsung Knox Account. You need to use these login credentials to connect your Knox Manage and Knox Mobile Enrollment accounts.

To sign in to the Knox Mobile Enrollment Portal from the Knox Manage console:

1. Go to Device Enrollment > Knox Mobile Enrollment. The Samsung Account SSO page opens.

2. Click Go to Samsung Knox.

3. Enter your Samsung Account single sign-on credentials and click Sign in. These credentials are the email id and password you used to create your Samsung Account.

4. The Knox Manage console opens to show two new menu items—Device and Profile —visible under Knox Mobile Enrollment on the left-hand navigation menu.

Creating profiles

Before enrolling devices, you must create profiles for Android Enterprise on the Knox Manage console. Any profiles created on this page are synced with the Knox Mobile Enrollment portal linked to your Samsung Account.

Knox Manage supports Android Enterprise device profiles only. These profiles allow users to enroll as a Device Owner or Profile Owner.

Creating Android Enterprise profiles

To create profiles for Android Enterprise profile types:

1. Go to Device Enrollment > Knox Mobile Enrollment > Profile.

2. On the Profile page that opens, in the upper-left corner, click Add.

3. On the Add profile page that opens, enter the following basic information for the device owner profile:

   Field	Description
   Name	Enter an appropriate profile name to distinguish it from others with similar attributes.
   Description	Enter a profile description to further differentiate this profile from others.
   Enrollment Type	Select one of the following three options: User defined Fully managed Work profile

4. Set the following device and user settings:

   Setting	Description
   Allow Users to Change Their ID for Enrollment	Allow users to change their ID for enrollment only when end user credentials are pre-populated by the IT admin through Knox Mobile Enrollment.
   Disable System Applications	In special cases, IT admins can use this option to disable default system apps on the target devices.

5. Provide the following company related information:

   Field	Description
   Company Name	Enter the organization name displayed at the time of device enrollment.

6. Enter a valid Legal Agreement document as follows:

   1. In the Legal Agreement area, click Add.
   2. Follow on-screen instructions to add your legal document and return to the Add Profile page.

7. Click Save to create a supported profile configuration for Android Enterprise. The newly created profile is synced with your Knox Mobile Enrollment portal data.

Registering and enrolling devices using Knox Mobile Enrollment

Knox Manage console is integrated with Knox Mobile Enrollment, so when you sign in using your Samsung Account SSO your devices are automatically synced to Knox Manage. And if your devices meet the prerequisites set out in Before you begin, Knox Manage is installed on them.

Assigning profiles to devices and users

Once devices are enrolled in Knox Manage, you can assign Knox Mobile Enrollment profiles you created earlier to your devices.

Individual Assignment

You can assign profiles to devices in one of two ways:

• Using the Device menu
• Using the Profile menu

Assign profiles using the Device menu

To assign profiles and user credentials to a device individually:

1. Go to Device Enrollment > Knox Mobile Enrollment > Device.

2. On the Device page that opens, click All devices.

3. In the list of devices on this page, select the devices to which you want to assign the profiles, and then click Configure. The Configure devices page opens.

4. On this page, do the following:

   1. In the KME profile list, select the appropriate profile you want to apply.
   2. Next to the User Credentials field, click Select to open a page showing a list of Knox Manage users. Select the appropriate user from this page and enter their password, then click Verify.
   3. Click Save to assign the profile to your target device and return to the All devices page.

5. The profile is now assigned to your target devices and is applied to the devices when they next connect to the Internet.

Assign profiles using the Profile menu

In addition to the previously described method to assign profiles to devices, Knox Manage allows you to assign profiles to devices from the Knox Mobile Enrollment profiles page.

To assign profiles to a device from the Profile page:

1. Go to Device Enrollment > Knox Mobile Enrollment > Profile.

2. On the Profile page that opens, select the profile you want to assign to your devices, and then click Assign. The Assign devices page opens.

3. In the list of devices on this page, select the devices to which you want to assign the profile, and then click Save. The profile is now assigned to your target devices and is applied to the devices when they next connect to the Internet.

Unassigning profiles from devices

To unassign a profile from a device:

1. Go to Device Enrollment > Knox Mobile Enrollment > Device.

2. On the Profile page that opens, click the number of devices assigned to this profile from the Profile Assigned column to open the Profile Details page for that profile.

   If there are no devices assigned to this profile, this column shows 0 devices. The number of devices is only clickable if there’s at least one device.

3. In the list of devices on this page, select the devices from which you want to remove the profile, and then click Unassign.

4. When prompted, click OK to confirm that you want to the profile from the target device. The profile is now unassigned from your target devices and is removed from the devices when they next connect to the Internet.

Modifying Knox Mobile Enrollment profiles

IT admins can now modify Knox Mobile Enrollment profiles from within the Knox Manage console:

1. Go to Device Enrollment > Knox Mobile Enrollment > Device.

2. On the Profile page that opens, select the profile you want to modify, and then click Modify. The Modify Profile page opens.

3. This page contains all the details you had specified when you created the profile. Make all the necessary changes to this page and then click Save. The changes are saved to the profile in Knox Manage and Knox Mobile Enrollment. These changes are applied to the device when the device is re-enrolled.

Unenrolling Knox Mobile Enrollment devices

To disable the use of Knox Mobile Enrollment devices, you must unenroll them from Knox Manage and Knox Mobile Enrollment in the Knox Manage console. For information about how to unenroll devices in the Knox Manage console, see Unenroll devices.

After you unenroll devices from Knox Manage, follow these steps to delete them from Knox Mobile Enrollment:

1. Go to Device Enrollment > Knox Mobile Enrollment > Device.

2. On the Devices page, click the ALL DEVICES tab.

3. In the list of devices on this page, click the check boxes next to the IMEI information to select the appropriate devices, click Delete. The selected devices are removed from Knox Manage.