Unenroll and delete devices

When you unenroll a device from Knox Manage, the device is unregistered from the server and its license seat becomes available for another device’s use. Once unenrolled, devices are factory reset, except for personal devices with a work profile. For company-owned devices with a work profile, you have the option to not factory reset them — you can then delete the device to remove its information from the console.

Delete installed apps during unenrollment

Before you unenroll a device, you can configure Knox Manage to automatically delete any installed apps as the device unenrolls. This will also delete installed internal apps (on all Android devices and iPhones running iOS 11 or later).

To configure this, go to Setting > Configuration > Basic Configuration > Device, and set Delete App upon Unenrollment to Yes.

Unenrollment methods

Unenrollment methods differ depending on the device type, and are described in the sections below.

Unenroll connected devices

To unenroll devices that are connected to the server:

1. In Knox Manage, go to the Device page. Select a device you want to unenroll, then click Unenroll.

2. The Unenroll dialogue opens. Depending on your device type, you may have the option to select one or more of the following actions to be performed during unenrollment:

   • Unassign KME profiles — Unassigns any Knox Mobile Enrollment profiles on the device. This option appears only for Android Enterprise devices.
   • Delete devices from KME — Deletes the device from Knox Mobile Enrollment, if applicable. For information about unenrolling devices from Knox Mobile Enrollment, see Use Samsung Knox Mobile Enrollment (KME). This option appears only for Android Enterprise devices.
   • Unenroll devices from KAI — Unenrolls the device from Knox Asset Intelligence. For information about Knox Asset Intelligence license management, see Manage licenses. This option appears only for Android Enterprise devices.
   • Remove eSIM upon factory reset — Removes eSIM information from the device even if the eSIM wasn’t installed using Knox Manage. To reuse the sim, you need to activate it through the carrier. This option is read-only if the device doesn’t support eSIM and doesn’t appear for personal devices with a work profile. This option appears only for Android Enterprise, Wear OS, and iOS devices that haven’t been factory reset or unenrolled from Knox Manage since the eSIM was installed.
   • Remove Work Profile only (The device will not be factory reset.) — Removes the work profile from an Android Enterprise device without factory resetting it. This option only appears if the device has a work profile.

   

3. Click one of the following options:

   • Force Unenroll — Unenrolls the device if it’s offline and disconnected from your network. If you choose this option, the console asks you to confirm again.
     • You can also select this option if you previously reset the device without unenrolling it. This ensures that the license seat is freed.
     • This option isn’t available if you selected Remove Work Profile only (The device will not be factory reset.)
   • OK — Unenrolls the device.

You can also unenroll a device by sending the Unenroll Device command. You can use this option if you don’t need to force unenroll devices. To send the Unenroll Device command:

1. Go to the Device page > select a device > Device Command.

2. On the Device Command dialog, click the Knox Manage tab > Unenroll Device. For Wear OS devices, the command is Unenroll & Factory Reset.

3. On the dialogue that appears, you may have the option to select one or more of the following actions to be performed during unenrollment depending on your device type:

   • Unassign KME profiles — Unassigns any Knox Mobile Enrollment profiles on the device. This option appears only for Android Enterprise devices.
   • Delete devices from KME — Deletes the device from Knox Mobile Enrollment, if applicable. For information about unenrolling devices from Knox Mobile Enrollment, see Use Samsung Knox Mobile Enrollment. This option appears only for Android Enterprise devices.
   • Unenroll devices from KAI — Unenrolls the device from Knox Asset Intelligence. For information about Knox Asset Intelligence license management, see Manage licenses. This option appears only for Android Enterprise devices.
   • Remove eSIM upon factory reset — Removes eSIM information from the device, (even if the eSIM wasn’t installed using Knox Manage). To reuse the eSIM, you will need to activate the eSIM through the carrier if you want to reuse it. This option is read-only if the device doesn’t support eSIM and doesn’t appear for personal devices with a work profile. Additionally, this option appears for only Android Enterprise, Wear OS, and iOS devices that haven’t been factory reset or unenrolled from Knox Manage since the eSIM was installed.

4. Click OK. The device is unenrolled.

Unenroll disconnected devices

To unenroll a device that is disconnected and can’t reconnect to your network:

1. Go to the Device page on the Knox Manage console and select the disconnected device that you want to unenroll.

2. Click Unenroll. The Unenroll dialog opens, showing relevant options and the Offline Unenrollment Code for the device. Copy the unenrollment code to send to the device user later.

If a device is deleted from Knox Manage, go to the Device page and click Deleted Devices. Search for the device you want to find. The Unenrollment Code appears in its details.

3. Click Force Unenroll.

4. Instruct the user to enter the Offline Unenrollment Code from step 2 in the Knox Manage agent’s Offline Unenrollment screen. Users can find this screen by navigating to Settings > Offline Unenrollment on their device.

The device unenrolls.

Bulk unenroll devices from a group

You can send the unenrollment command to a group to bulk unenroll all of its devices at once.

Accidental use or misuse of this action can have severe consequences on a large number of devices at once. You can only unenroll one group at a time, and the Knox Manage console asks you twice to confirm your decision.

To unenroll all the devices in a group:

1. Go to Group.
2. Select the group you want to delete devices from, then click Unenroll Device. A confirmation dialog opens.
3. (Optional) Select Unassign KME profiles to delete the Knox Mobile Enrollment profiles on devices, or Delete devices from KME to delete Knox Mobile Enrollment profiles in addition to deleting the devices from Knox Mobile Enrollment.
4. Read the on-screen warning, then select I have read the warnings and agree to proceed with the process if you agree.
5. Click one of the following options:
   • Force Unenroll — Unenrolls devices even if they’re disconnected from your network. If you choose this option, the console asks you to confirm again.
     • You can also select this option if you previously reset the device without unenrolling it. This ensures that the license seat is freed.
     • This option isn’t available if you selected Remove Work Profile only (The device will not be factory reset.)
   • OK — Unenrolls connected devices.

The group’s devices are unenrolled.

Allow users to unenroll their devices

If a device is connected to a network and can establish communication with the server, then users can unenroll the devices by uninstalling the Knox Manage agent from it.

To allow the user to uninstall the agent:

1. Go to Setting > Configuration > Knox Manage Agent Policy.
2. On the Knox Manage Agent Policy page, click the Default tab. You can also add more agent policy sets by clicking .
3. Set the Allow Unenroll Request policy to Allow.
4. Click Save & Apply.

Delete devices

Once you unenroll a device, you can delete it from Knox Manage. When you delete a device, you remove it from the Device page.

To delete devices:

1. Go to the Device page.
2. Select one or more devices, then click Delete.
3. On the Delete Device dialog, click OK.

The device is deleted.

View deleted devices

To view records of previously deleted devices, such as the device’s name, IMEI, serial number, and more, go to the Device page and click Deleted Devices.

The Deleted Devices list opens. Besides displaying the details of deleted devices, you can find the unlock, unenrollment, and exit kiosk codes. To download the list of deleted devices, select Export to CSV.