Knox Manage 25.04 admin guide (original console)

Android Enterprise policies

Lock Screen

APN

Phone

Wear OS policies

System

Lock Screen

Knox Browser

iOS policies

System

List of environment settings

App & Support

Application

Knox Manage App Store

Support

Kiosk Wizard menu items

This section describes menu items in the Kiosk Wizard.

Single App Mode menu items

The following menu items are available for Single App Mode:

• Name — Enter a name for the kiosk that represents its intended use.
• Package Name — The autogenerated kiosk package name.
• Orientation & Grid — Sets the screen orientation for the Kiosk Launcher as Landscape, Portrait, or Auto Rotate. This setting doesn’t apply to the kiosk’s screen or the apps on the screen.
• Allowlisted Apps Settings — Lets you whitelist specific apps so that they can be run in the kiosk device, even if they are not included in the single- or multi-app kiosk component list.
• Device Setting — Allows selecting one or more device settings to be used in Kiosk mode, such as Wi-Fi, Hotspot, Time Zone, and so on. Each setting corresponds to a Settings menu item on the kiosk device.

• Component – Lets you browse components, and drag-and-drop them to the Preview screen. Additionally, you can use Add System Application to add a system app.

Multi Apps Mode menu items

The following menu items are available for Multi Apps Mode:

• Name — Enter a name for the kiosk that represents its intended use.
• Package Name — The autogenerated kiosk package name.
• Orientation & Grid — Sets the screen orientation as Landscape, Portrait, or Auto Rotate. This setting doesn’t apply to the kiosk’s screen or on-screen apps.
• Allowlisted Apps Settings — Lets you whitelist specific apps so that they can be run in the kiosk device, even if they are not included in the single- or multi-app kiosk component list.

• Wallpaper — Lets you select up to five background wallpaper images for the kiosk. You can also specify a margin color, keep the original wallpaper size, and choose to randomly display available wallpapers.
• Under Advance Setting:
  • Screen Composition – Lets you enable the Status Bar, Logo, or both. Furthermore, you can specify the bar and text colors for the Status Bar.
  • Icon Size – Lets you resize icons by a specific percentage to optimize how much visual space they occupy (defaults to 70% of icon size, maximum 100%). You can also choose to show or hide the icon text, specify a background color, and apply a shadow effect.

• Point Color – Lets you apply a point color for icons and page indicators.
• Screen Lock – Allows setting a 4-digit password, or a 6-10 digit or Alphanumeric password for the kiosk device screen lock. The default value is Disabled, implying no screen lock password is applied.

• Rearrange – Allows kiosk users to rearrange icons on their devices (disabled by default).

• Device Setting — Allows selecting one or more device settings to be used in Kiosk mode, such as Wi-Fi, Hotspot, Time Zone, and so on. Each setting corresponds to a Settings menu item on the kiosk device.

• Page Rotation – Allows kiosk users to return to the first page after viewing the last page in the kiosk (disallowed by default).

• Effect – The screen transition effect for kiosk pages. Available effects are Slide (default), Card, Box, Bulldoze, and Corner.

• Component – Lets you browse components, and drag-and-drop them to the Preview screen. You can also use Add System Application to add a system app.

Android Enterprise device commands

Knox Manage

iOS device commands

Device

Video - Synchronize users and groups with Active Directory in Knox Manage

The following video describes how to sync users and groups with Active Directory.

< YouTube link for embedded video >

Shared Android device quickstart

Device user check-in

When the shared device is enrolled and deployed, it shows the check-in screen if there is no active user session. A device user starts a session by checking in with their Knox Manage account credentials.

• Samsung devices used as shared devices are automatically activated when a user first checks in.
• For non-Samsung devices, the device user must activate the device by manually running the Knox Manage agent when they first check in to the device. The device user can launch the Knox Manage app or tap the Knox Manage notification to run the agent.

When the device user has finished their activities, they can end their session by tapping Check Out in the Knox notification.

• If it’s a Temporary shared device, the app and user data on the device is erased.
• On Persistent shared devices:
  • Apps common to staging users and device users are cached, and are available to device users when they check in.
  • User-specific apps are automatically downloaded and installed when the appropriate device user checks in.

(Connection name changes – slide 26)

Not posting the updated sections here as it will bloat the Word document – requirement is to update the following terminology (before → after):

• Microsoft Entra ID (Graph API) → Microsoft Entra ID
• Okta (SCIM) → Okta
• Ping Identity (SCIM) → Ping Identity

Will update the following pages:

• https://docs.samsungknox.com/admin/knox-manage/configure/identity-and-directory/connection-overview/
• https://docs.samsungknox.com/admin/knox-manage/configure/identity-and-directory/connect-to-microsoft-entra-id/
• https://docs.samsungknox.com/admin/knox-manage/configure/identity-and-directory/connect-to-okta/
• https://docs.samsungknox.com/admin/knox-manage/configure/identity-and-directory/connect-to-ping-identity/
• https://docs.samsungknox.com/admin/knox-manage/release-notes/23-12/ (need to remove screenshot)

Add a report

You can create a new report using report queries, which retrieve and aggregate data from the Knox Manage database based on predefined criteria. Alternatively, you can add a report based on an existing report and tweak it as required.

Create a new report

To create a new report using report queries, complete the following steps:

1. Navigate to Advanced > Report.

2. On the Report page, click Add.

3. On the Add Report screen:

   • Report Name — Enter the report name.
   • Report ID — Enter the ID for the new report.
   • Description — Enter a brief description for the report.
   • Chart — Select a chart type to visualize the report.
   • Legend — Specify where the legend should appear relative to the chart (if you selected a chart type).
   • Report Queries — Select from a list of existing queries.

4. Click Add next to Output Fields. The Add Output Field dialog appears, showing available fields based on your report query selection. For a list of output fields in each report query, see Default reports and report queries.
5. Configure output fields as needed. The Data Type value of the field dictates what properties you can modify.
   • String fields let you update values for Output Name (display name of the field) and Chart Setting (whether or not the field will appear as a chart category) values.
   • Number fields let you update values for Output Name (display name of the field), Output Format (the number display format), Summary Type (the numeric value to display on the chart – sum, average, maximum or minimum), and Chart Setting (whether or not the field will appear as a chart category).
   • Date fields let you update values for Output Name (display name of the field), Output Format (the date display format), and Chart Setting (whether or not the field will appear as a chart category).

6. Based on your report query selection, relevant input fields are listed in the Input Value table. Proceed to enter input values under the Input Value column.
7. Click View to preview your report before saving.
8. Click Save, then in the Save Report dialog click OK.

Add a report based on an existing report

To copy an existing report to create a new report:

1. Navigate to Advanced > Report.
2. On the Report page, select the report you want to copy and click Copy.
3. On the Copy Report page, enter a new Report Name and Report ID.
4. Modify other fields and settings as needed.
5. Click Save, then in the Save Report dialog click OK.

View details of a device

Network tab

The Network tab displays network status details, such as the device’s current Wi-Fi status and SIM information.

Default reports and report queries

Report queries

You can make your own reports using the following queries included in Knox Manage.

Register user accounts in bulk

Registration template spreadsheet

The spreadsheet is an XLSX file and contains three sheets:

• The Guide sheet describes the requirements of each editable cell in detail.
• The User sheet defines the user account and details you want to add.
• The UserTag sheet defines any tags you want to attach to existing accounts. If you enter tags for the same user in both the User and UserTag sheets, the UserTag sheet’s entry takes precedence.
• The AdditionalInfo sheet lets you register users using additional details, such as User ID, Department, Site, user defined fields, and so on.

Unenroll devices

Unenroll connected devices

To unenroll devices that are connected to the server:

1. Go to Device on the Knox Manage console.
2. On the Device page, select the device you want to unenroll.
3. Click Unenroll.
4. (Optional) Select one or more of the following actions to be performed during unenrollment:
   • Unassign KME profiles — Unassigns any Knox Mobile Enrollment profiles on the device.
   • Delete devices from KME — Deletes the device from Knox Mobile Enrollment, if applicable. For information about unenrolling devices from Knox Mobile Enrollment, see Use Samsung Knox Mobile Enrollment (KME).
   • Unenroll devices from KAI — Unenrolls the device from Knox Asset Intelligence. For information about Knox Asset Intelligence license management, see Manage licenses.
   • Remove eSIM upon factory reset (Preview) — Removes eSIM information from the device (even if the eSIM wasn’t installed using Knox Manage). You will need to activate the eSIM through the carrier if you want to reuse it.
5. On the Unenroll dialog, click OK to confirm. Alternatively, click Force Unenroll to unenroll the device both from the server and the Knox Manage agent on the device, and factory reset the device.

(Policy name changes – slide 39)

_Not posting the updated tables here as it will bloat the Word document – just have to update the following _AE policy terminology (before → after):

• Microphone → Use Microphone
• Recording → Record with Microphone
• S Voice → Use S Voice
• Volume Adjustment → Adjust Volume
• Voice Call (except Samsung Device) → Make Voice Calls on Non-Samsung Devices
• SMS (except Samsung Device) → Send Text Messages on Non-Samsung Devices
• Cell Broadcast Setting → Emergency Alerts
• Airplane mode → Turn on Airplane Mode
• Tethering Setting → Share Internet Connection Using Tethering
• Bluetooth Share → Send and Receive Files through Bluetooth
• Printing → Use Printer
• Network Reset → Reset Mobile Data Usage
• Mobile Network Setting → Configure Mobile Network Settings
• Autofill Service → Auto-Completion in Browser
• Play Integrity (SafetyNet Attestation) → Check Devices through Play Integrity
• Verification Interval (days) → Set Time Period Between Checks
• Verification Failure Policy (During Enrollment) → Take Action if Device Fails Check during Enrollment
• Verification Failure Policy (After Enrollment) → Take Action if Device Fails Check after Enrollment
• Verify Apps Using Google Play Protect → App Verification Using Google Play Protect
• App Auto Update → Automatic App Updates
• URL Control Type → Add URLs to Allowlist or Blocklist
• URL Control List → URLs
• Hide URL → Hide URL Address Bar
• Link URL to Other Apps → Web Intents
• File Download → Download Files
• Bookmark → Add Bookmarks
• File Upload → Upload Files
• Cookies → Store Cookies
• Text Copy → Copy Text
• Force Enable Zoom → Force Page Zoom
• Ratio → Default Ratio
• Screen on when Plugged in → Turn Screen on when Plugged in

Configure alerts

Configure emails for audit alerts

Knox Manage can send emails to your admins whenever an audit alert is triggered. This feature enables admins to conveniently monitor device status changes outside of the Knox Manage console.

To configure emails for audit alerts:

1. Go to History > Alert. The Alert page opens.
2. Click Alert Mailing Settings, then configure the parameters of the emails for alerts:
   • Alert Mailing Settings — Enable sending emails for alerts.
   • Period — Define a start and end date during which emails for alerts are enabled.
   • Frequency — Specify how often to send the emails. After you select a frequency, choose when to send the emails:
     • Hourly — Select the number of hours after which to send the alert. Available values are 1, 2, 3, 4, 6, 8, and 12 hours. The email delivery time for a tenant is calculated from midnight.
     • Daily — Select which hour in the day.
     • Weekly — Select which days of the week and at which hour in a day.
     • Monthly — Select which days in the month and at which hour in a day.
   • Knox Manage Admin — Click Select to pick the admins who will receive the emails.
   • Email Address — If you need to send emails to recipients who aren’t attached to accounts in your tenant, click Add and enter their addresses.
   • Target Events — Select one or more event types to trigger emails:
     • New enrolled devices
     • Unenrolled devices
     • Disconnected devices
     • Devices within geofencing area
     • Devices outside the geofencing area
     • Devices with the day & time event profiles applied (in)
     • Devices with the day & time event profiles unapplied (out)
     • Devices with the SIM change event profiles applied (in)
     • Devices with the SIM change event profiles unapplied (out)
     • Devices with the Wi-Fi SSID event profiles applied (in)
     • Devices with the Wi-Fi SSID event profiles unapplied (out)
     • Devices with the roaming event profiles applied (in)
     • Devices with the roaming event profiles unapplied (out)
     • Devices re-enrolled after Factory Reset
     • Factory reset devices
     • Devices with policy violation
     • Devices with profile pushed
     • Current location collected devices
     • Powered off devices
     • Rebooted devices
     • Devices whose apps has been installed or updated
     • Devices whose apps have been run
     • Devices whose apps have been uninstalled
     • Devices whose app data have been deleted
     • Devices receiving push notifications
     • Devices with changed licenses
     • Devices with updated licenses
     • Devices with the Knox Manage agent updated
     • Devices that have exited Kiosk mode
3. (Optional) Click Select more events to select and add other audit events. All audit events are available for use as target events.
4. Click Save to save the configuration.

Download the audit log

Follow the steps below to download the audit log (all rows currently showing in the Audit Log page) as an Excel file.

1. Navigate to History > Audit Log.
2. The Audit Log page opens. To filter audit log entries, selecting or entering values in the following fields, then click Search. You can reset filters by clicking Reset.
   • User ID
   • Device Name
   • Result
   • Log Date & Time
   • Audit Type
   • Event Category
   • Event
3. Click Download.
4. Click OK in the Export to Excel window. You can select the following issues to include additional process information or log data in the download file – however, this will increase both the download file size and the file generation time – so we recommend leaving these options unchecked unless the additional information or log data is really needed.
   • Includes additional process information: Request History, Result Code, Result History
   • Includes additional log data

5. The Download dialog appears. The zipped audit log file is listed under My Download.
6. Click the Download button to download the zipped file to your default download directory.

Register a group

You can add a manual group (which is static) or a dynamic group (which auto-updates group memberships and assignments based on pre-set criteria).

Add a manual group

1. Go to Group on the navigation pane.
2. On the Group page, click Add.
3. On the Add Group page, enter the following user information:
   • Name — Enter a group name.
   • Type — Select one of the following group types.
     • User — A group of user accounts.
     • Device — A group of enrolled devices.
   • Membership Type — Select Manual.
   • Sub-Administrator — Click Select, then select a sub-administrator for the group in the Select Sub-Administrator dialog, and click OK.

4. On the All Users or All Devices list (depending on your selected Type), select user IDs or device names to include them in the group. Selected users or devices appear under Selected User or Selected Device, correspondingly.
   • You can use the search bar in the All Users or All Devices area to find records matching your search criteria.
   • You can further refine your device selections in the Selected Device area: Click Select via Filter, select filters that you want to apply, then click OK.
5. Save your new group by doing one of the following:
   • If you want to save the group without assigning anything to it, click Save, then in the Save Group dialog click OK.
   • Alternatively, click Save & Assign, then in the Save & Assign dialog select Application (to assign apps), Profile (to assign profiles), or Content (to assign content files). Click Next to proceed with assignment flow.

Add a dynamic group

1. Go to Group on the navigation pane.
2. On the Group page, click Add.
3. On the Add Group page, enter the following user information:

a) Name — Enter a group name.

b) Type — Select one of the following group types.

• User — A group of user accounts.
• Device — A group of enrolled devices.

c) Membership Type — Select Dynamic (Preview).

d) Sub-Administrator — Click Select, then select a sub-administrator for the group in the Select Sub-Administrator dialog, and click OK.

4. Under Group Rules (Preview):

a) For Group Assignment:

• If you want profiles and apps to be dynamically assigned to new group members, select When a user or device is added, the profiles and applications assigned to the group will be pushed to the user or device.
• If you want profiles and apps to be dynamically removed from departing group members, select When a user or device is removed, the profiles and applications of the group will be unassigned from the user or device.

b) In the Rule Builder, you can create rules to dynamically add users or devices (based on your selected Type) to your group. You can create rules using one of the following options: Make rules via Filter, Rule Configuration, or Rule Syntax.

• The Make rules via Filter button brings up the Make rules via Filter dialog. You can use user or device attribute fields at the top of the dialog to search for matching users or devices. Click Apply rules to create corresponding rule syntax (which appears in the Rule Syntax field).
• Rule Configuration lets you select attributes, operators, and values to create rules. To use this option, Rule Builder Type must be set to Configuration. Click the + icon to add more rules (up to a maximum of five), and use the And/Or selector to create complex rules.

• The Rule Syntax field lets you write rules in MVFLEX Expression Language (MVEL) syntax (up to 1,000 characters). To use this option, Rule Builder Type must be set to Syntax.

5. Once you’ve added at least one rule, you can use the Validation area to inspect which users or devices fulfill rule criteria.

a) Click Select to bring up the Select User or Select device dialog, select from existing records, and click Add.

• You can use the search bar to find specific user or device records.
• To further refine your device selections, click Select via Filter, select filters that you want to apply, then click OK.

b) The Validate button becomes active, and selected records appear below it. Click the button.

c) Status values appear, indicating the rule evaluation status for each row. Click on the corresponding View Details link for further information.

d) If needed, proceed to tweak your rules (step 4b), then revalidate against selected records (steps 5a and 5b).

6. To save your new dynamic group, click Save, then in the Save Group dialog click OK.

View group details

Tab: Application

The Application tab shows the apps assigned to the group. The following function buttons are available:

Minimum requirements and supported languages

Minimum requirements

The following table describes minimum requirements for using Knox Manage.

Not posting the updated tables here as it will bloat the Word document – just have to update the supported versions in a table (before → after):

• Android 10 and higher → Android 11 and higher
• iOS 15 and higher → iOS 16 and higher
• iPadOS 15 and higher → iPadOS 16 and higher