Back to top
Home / Knox Manage / Configure / Devices /

Unenroll devices

Last updated March 27th, 2025

On this tab

You can unenroll the devices registered in the Knox Manage server. The methods for unenrollment differ depending on the device type, and are described in the following sections.

  • To delete the work profile from Android Enterprise devices or delete Knox Manage from fully-managed devices, push the Unenroll device command to them.

  • To subsequently restart the device user’s session, send the Delete account command, then ask the user to sign in again.

When you unenroll Fully Managed or Fully Managed with Work Profile devices, the devices are factory reset. If the devices are running Android 7 to 8.1, any inserted microSD cards are also wiped.

If a factory reset is prevented by other device administration applications, such as Knox E-FOTA and Knox Configure, then the process of removing the device from Knox Manage will fail due to the requirement of a factory reset. As a result, even after successfully unenrolling the device from Knox Manage, the device will continue to show the Knox Manage authentication screen.

Unenroll connected devices

To unenroll devices that are connected to the server:

  1. Go to Device on the Knox Manage console.

  2. On the Device page, select the device you want to unenroll.

  3. Click Unenroll.

  4. (Optional) Select one or more of the following actions to be performed during unenrollment:

    • Unassign KME profiles — Unassigns any Knox Mobile Enrollment profiles on the device.
    • Delete devices from KME — Deletes the device from Knox Mobile Enrollment, if applicable.
    • Remove eSIM upon factory reset (Preview) — Removes eSIM information from the device (even if the eSIM wasn’t installed using Knox Manage). You will need to activate the eSIM through the carrier if you want to reuse it.

  5. On the Unenroll screen, click OK to confirm. Alternatively, click Force Unenroll to unenroll the device both from the server and the Knox Manage agent on the device, and factory reset the device.

  • eSIM removal only works for devices that have neither been factory reset nor unenrolled from Knox Manage since the eSIM was installed. The option will be read-only if the device doesn’t support eSIM.
  • For information about unenrolling devices from Knox Mobile Enrollment, see Use Samsung Knox Mobile Enrollment (KME).
  • For iOS devices that were reset or unenrolled from the Knox Manage console, device users can disable the activation lock by entering the code in the Password field and leaving the ID field empty in the Setup Assistant.

Unenroll disconnected devices

When a device is unable to communicate with the server, you can send an offline unenrollment code to the device. Then, the user can change the device’s status manually and unenroll the device.

To unenroll devices that are offline:

  1. Identify which device needs to be unenrolled. You might need to contact the device user directly. Instruct them to launch the Knox Manage agent and to go to Settings > Offline Unenrollment. Their User ID, Device Name, and IMEI/MEID are shown.

  2. Go to Device on the Knox Manage console.

  3. On the Device page, select the device.

  4. Click Unenroll.

  5. On the confirmation dialog, click Offline Unenrollment Code.

  6. Click Force Unenroll. A signal is sent to the device to unenroll it.

  7. Instruct the user to enter the offline unenrollment code (from step 5) in the Knox Manage agent’s Offline Unenrollment screen. The device unenrolls.

    You can also find the unenrollment code on the Deleted Devices page. To get the code, go to Device > Deleted Devices. In the dialog that opens, search for the appropriate device. You can find the unenrollment code in the list of results.

Consider the following when unenrolling disconnected devices:

  • You can also delete installed apps from a device as it unenrolls. You can delete all internal apps on Android devices and all apps on iPhones running iOS 11 or later. To configure this, go to Setting > Configuration > Basic Configuration > Device, and set Delete App upon Unenrollment to Yes.

  • On a connected device, the Force Unenroll command functions the same as the Unenroll command.

  • On a disconnected device, the Unenroll and Force Unenroll commands are executed the next time the device connects to the Knox Manage servers, and the device is unenrolled.

  • On a disconnected Windows device, if the device unenrollment is unsuccessful, check and disconnect from all enterprise account connections on the device by going to Start > Settings > Accounts > Access work or school.

Unenroll groups of devices

When you need to unenroll devices in bulk, you can send the unenrollment command to entire device groups at once. Keep in mind that device groups and user groups are fundamentally different types, so you can’t unenroll user groups in bulk, even if there are devices associated with them.

Accidental use or misuse of this action can have severe consequences on a large number of devices at once. As a precaution, you can only unenroll one group at a time, and the Knox Manage console asks you to confirm your submission twice.

To unenroll all the devices in a group:

  1. Go to Group.
  2. Select a device group.
  3. Make sure that you selected the right device group, then click Unenroll Device. A confirmation dialog opens.
  4. (Optional) Select Unassign KME profiles and Delete devices from KME to delete the device from Knox Mobile Enrollment (KME) as well.
  5. Read the on-screen warning, then select I have read the warnings and agree to proceed with the process.
  6. Click OK to gracefully unenroll the devices or Force Unenroll to push the action through. If you choose the latter option, the console asks you to confirm again.

Allow users to unenroll their devices

If a device is connected to a network and can establish communication with the server, then users can unenroll the devices by uninstalling the agent.

To allow the user to uninstall the agent, complete the following steps:

  1. Go to Setting > Configuration > Knox Manage Agent Policy.
  2. On the Knox Manage Agent Policy page, click the Default tab. You can also add more agent policy sets by clicking add.
  3. Set the Allow Unenroll Request policy to Allow.
  4. Click Save & Apply.

This document was updated for the Knox cloud services 25.04 UAT.

On this tab

You can unenroll the devices registered in the Knox Manage server. The methods for unenrollment differ depending on the device type, and are described in the following sections.

  • To delete the work profile from Android Enterprise devices or delete Knox Manage from fully-managed devices, push the Unenroll device command to them.

  • To subsequently restart the device user’s session, send the Delete account command, then ask the user to sign in again.

When you unenroll Fully Managed or Fully Managed with Work Profile devices, the devices are factory reset. If the devices are running Android 7 to 8.1, any inserted microSD cards are also wiped.

If a factory reset is prevented by other device administration applications, such as Knox E-FOTA and Knox Configure, then the process of removing the device from Knox Manage will fail due to the requirement of a factory reset. As a result, even after successfully unenrolling the device from Knox Manage, the device will continue to show the Knox Manage authentication screen.

Unenroll connected devices

To unenroll devices that are connected to the server:

  1. Go to Device on the Knox Manage console.

  2. On the Device page, select the device you want to unenroll.

  3. Click Unenroll.

    KAI unenrollment option during device unenrollment

  4. (Optional) Select one or more of the following actions to be performed during unenrollment:

    • Unassign KME profiles — Unassigns any Knox Mobile Enrollment profiles on the device.

    • Delete devices from KME — Deletes the device from Knox Mobile Enrollment, if applicable. For information about unenrolling devices from Knox Mobile Enrollment, see Use Samsung Knox Mobile Enrollment (KME).

    • Unenroll devices from KAI — Unenrolls the device from Knox Asset Intelligence. For information about Knox Asset Intelligence license management, see Manage licenses.

    • Remove eSIM upon factory reset (Preview) — Removes eSIM information from the device (even if the eSIM wasn’t installed using Knox Manage). You will need to activate the eSIM through the carrier if you want to reuse it.

      eSIM removal only works for devices that have neither been factory reset nor unenrolled from Knox Manage since the eSIM was installed. The option will be read-only if the device doesn’t support eSIM.

  5. On the Unenroll dialog, click OK to confirm. Alternatively, click Force Unenroll to unenroll the device both from the server and the Knox Manage agent on the device, and factory reset the device.

For iOS devices that were reset or unenrolled from the Knox Manage console, device users can disable the activation lock in the Setup Assistant by entering the code in the Password field and leaving the ID field empty.

Unenroll disconnected devices

When a device is unable to communicate with the server, you can send an offline unenrollment code to the device. Then, the user can change the device’s status manually and unenroll the device.

To unenroll devices that are offline:

  1. Identify which device needs to be unenrolled. You might need to contact the device user directly. Instruct them to launch the Knox Manage agent and to go to Settings > Offline Unenrollment. Their User ID, Device Name, and IMEI/MEID are shown.

  2. Go to Device on the Knox Manage console.

  3. On the Device page, select the device.

  4. Click Unenroll.

  5. On the confirmation dialog, click Offline Unenrollment Code.

  6. Click Force Unenroll. A signal is sent to the device to unenroll it.

  7. Instruct the user to enter the offline unenrollment code (from step 5) in the Knox Manage agent’s Offline Unenrollment screen. The device unenrolls.

    You can also find the unenrollment code on the Deleted Devices page. To get the code, go to Device > Deleted Devices. In the dialog that opens, search for the appropriate device. You can find the unenrollment code in the list of results.

Consider the following when unenrolling disconnected devices:

  • You can also delete installed apps from a device as it unenrolls. You can delete all internal apps on Android devices and all apps on iPhones running iOS 11 or later. To configure this, go to Setting > Configuration > Basic Configuration > Device, and set Delete App upon Unenrollment to Yes.

  • On a connected device, the Force Unenroll command functions the same as the Unenroll command.

  • On a disconnected device, the Unenroll and Force Unenroll commands are executed the next time the device connects to the Knox Manage servers, and the device is unenrolled.

  • On a disconnected Windows device, if the device unenrollment is unsuccessful, check and disconnect from all enterprise account connections on the device by going to Start > Settings > Accounts > Access work or school.

Unenroll groups of devices

When you need to unenroll devices in bulk, you can send the unenrollment command to entire device groups at once. Keep in mind that device groups and user groups are fundamentally different types, so you can’t unenroll user groups in bulk, even if there are devices associated with them.

Accidental use or misuse of this action can have severe consequences on a large number of devices at once. As a precaution, you can only unenroll one group at a time, and the Knox Manage console asks you to confirm your submission twice.

To unenroll all the devices in a group:

  1. Go to Group.
  2. Select a device group.
  3. Make sure that you selected the right device group, then click Unenroll Device. A confirmation dialog opens.
  4. (Optional) Select Unassign KME profiles and Delete devices from KME to delete the device from Knox Mobile Enrollment (KME) as well.
  5. Read the on-screen warning, then select I have read the warnings and agree to proceed with the process.
  6. Click OK to gracefully unenroll the devices or Force Unenroll to push the action through. If you choose the latter option, the console asks you to confirm again.

Allow users to unenroll their devices

If a device is connected to a network and can establish communication with the server, then users can unenroll the devices by uninstalling the agent.

To allow the user to uninstall the agent, complete the following steps:

  1. Go to Setting > Configuration > Knox Manage Agent Policy.
  2. On the Knox Manage Agent Policy page, click the Default tab. You can also add more agent policy sets by clicking add.
  3. Set the Allow Unenroll Request policy to Allow.
  4. Click Save & Apply.

Is this page helpful?