Knox Workspace (Android Legacy) policies

Allows using the screen capture function in the Knox Workspace.

• Allow within the same app — The clipboard function can only be used within the same application.

Set to use the email domain allowlist setting.

• To add a domain, enter the domain name in the field, and click .
• To delete a domain, click next to the added domain name.

Allows remote control within the Knox Workspace using Remote Support.Remote Support should be installed in the general area.

Allows the controls for Microphone use in the Knox Workspace.

Allows using the camera in the Knox Workspace.

• Disallow is the default value.

1. Enter the Package Name.

2. Select the Vendor ID.

   • Only 4-digit, hexadecimal characters can be entered.
   • Multiple inputs should be separated by commas.
   • Only the product ID for the selected vendor can be entered.
3. Enter the Product ID.
4. Click to add, or click to delete.

• Use — Allows the choice to use an enterprise ID to sign in.
• Forced use — Forces the use of an enterprise ID to sign in.

Select a file to install inside the Knox Workspace for enterprise ID authentication.

Manage the applications to use for FIDO authentication.

• Pattern — Set the password using a pattern or any other password with a higher degree of complexity, such as Numeric , Alphanumeric , or Complex options.
• Numeric — The password must consist of a 4 digit number or be more complex. The screen can be locked using the Numeric , Alphanumeric , and Complex types of passwords.
• Alphanumeric — Both letters and numbers must be included. The screen can be locked using with the Alphanumeric and Complex types of passwords.
• Complex — Set so that the passwords must include alphanumeric and special characters.

• Lock Knox Workspace — When the set number of password attempts has been reached, the Knox Workspace is locked.
• Wipe Knox Workspace — When the set number of password attempts has been reached, the Knox Workspace is deleted.

Set the minimum length of the password. If the Minimum strength is set to Pattern, at least more than one stroke is required. In the case of Complex, it must be equal to or greater than the sum of the Minimum number of letters and Minimum number of non-letters. The value can be between 4 - 16 characters for Numeric or Alphanumeric. The value can be between 6 - 16 characters for Complex.

• To add a word, enter the word in the field and click .
• To delete a word, click next to the added word.

Allows Smartcard Browser Authentication within the internet browser.When the policy is allowed, the Bluetooth security mode is applied while the device is connected to the smart card reader and will not accept other Bluetooth connections.

Allows the use of two-step authentication.

• Use — Forces the screen lock to release via fingerprint or iris recognition.
• Do not use — Disables the two-step authentication settings via your fingerprint or iris recognition.

• Trust Agent — Set whether to use the Knox Quick Access on the lock screen.

• To add an application, click Add, and then select applications in the Select Application window.
• To add all applications, click Add all.
• To delete an application, click next to the added application.

• To add an application, click Add, and then select applications in the Select Application window.
• To add all applications, click Add all.
• To delete an application, click next to the added application.

• To add an application, click Add, and then select applications in the Select Application window.
• To delete an application, click next to the added application.

• To add an app, click Add, and then select apps on the Select Application screen.
• To delete an app, click next to the added app.

• To add an app, click Add, and then select apps in the Select Application screen.
• To delete an app, click next to the added app.

• To add an application, click Add , and then select applications on the Select Application screen.
• To delete an application, click next to the added application.

• Entire application — Applications in the Knox Workspace can access TIMA CCM.
• Allowlist Application — Only the added applications on the allowlist can access TIMA CCM.

• To add an application, click Add, and then select applications on the Select Application screen.
• To delete an application, click next to the added application.

• To add an application, click Add, and then select applications in the Select Application window.
• To delete an application, click next to the added application.

• To add an application, click Add, and then select applications in the Select Application window.
• To delete an application, click next to the added application.

• To add an application, click Add, and then select applications in the Select Application window.
• To delete an application, click next to the added application.

• To add an application, click Add, and then select applications in the Select Application window.
• To delete an application, click next to the added application.

• To add an application, click Add, and then select applications in the Select Application window.
• To add all applications, click Add all.
• To delete an application, click next to the added application.

• To add an application, click Add, and then select applications in the Select Application window.
• To add all applications, click Add all.
• To delete an application, click next to the added application.

• To add an app, click Add, and then select apps in the Select Application window.
• To delete an app, click next to the added app.

Set the proxy server address for the Android browser in the Knox Workspace.Enter the value in the form of IP:port or domain:port in the fields.

Select and configure the firewall type to use in Knox Workspace.

• All Packages — Input values for Permission policy and Prohibition policy.

  Android 10 and higher devices are not supported.

• By Application — Input values for Permission policy (IP), Prohibition policy (IP), Permitted policy (Domain), Prohibited policy (Domain), and DNS setting.

Input values to permit access through the firewall.

1. Enter a Host Pattern and Port.

2. Select a Network Type:

   • All
   • Data — Only mobile network access is enabled.
   • Wi-Fi — Only Wi-Fi network access is enabled.

3. Select Port Range:

   • All
   • Local — Port access from the device is enabled.
   • Remote — Port access from the target server is enabled.
4. Click to add.

1. Enter a Host Pattern and Port.
2. Select Network Type:
   • All
   • Data — Only mobile network access is disabled.
   • Wi-Fi — Only Wi-Fi network access is disabled.
3. Select Port Range:
   • All
   • Local — Port access from the device is disabled.
   • Remote — Port access from the target server is disabled.
4. Click to add.

Input values to permit the target IP and port address. Configure the following:

1. Enter or click Add to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).
3. Select the Network Type:
   • All
   • Data — Only mobile network access is enable.
   • Wi-Fi — Only Wi-Fi network access is enable.

4. Select Port Range:

   • All
   • Local — Port access from the device is enable.
   • Remote — Port access from the target server is enable.
5. Click to add.

Input values to prohibit the target IP and port address. Configure the following:

1. Enter or click Add to search the Package Name of the application.

2. Enter the IP Address (range) and Port (range).

   • Enter a wildcard character (_) as an IP Address to prohibit the use of the bandwidth.

3. Select Network Type:

   • All
   • Data — Mobile network access is disable.
   • Wi-Fi — Wi-Fi network access is disable.

4. Select Port Range:

   • All
   • Local — Port access from the device is disable.
   • Remote — Port access from the target server is disable.
5. Click to add.

Input values to permit the target domain address.

1. Enter or click Add to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).

Consider the following:

• Before setting this policy, disable all domains by entering a wildcard character (_) to the Prohibited policy (Domain) ranges.
• Use a wildcard character (_) to allow the use of a specific domain. The character must be placed before or after the domain name. For example, _android.com / www.samsung_

Input values to prohibit the target domain address.

1. Enter or click Add to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).

Input values to specify the domain server address of all applications or registered applications.

1. Enter or click Add to search the Package Name of the application.

2. Input DNS values.

   • DNS1 — Primary DNS.
   • DNS2 — Secondary DNS.

Allows moving applications from the general area to the Knox Workspace.

• Allow Import — Allows to import the calendar data of the general area to the Knox Workspace.
• Allow Export — Allow to export the calendar data of the Knox Workspace to the general area.

• Allow Import — Allows to import the calendar data of the general area to the Knox Workspace.
• Allow Export — Allows to export the calendar data of the Knox Workspace to the general area.

Allows to configure the Exchange settings.

Select to choose a connector from the User Information Connector list.

Select the interval period to sync the past emails.

Register an external certificate on the Knox Manage server for each network setting, and then verify each network setting using that certificate. All users share this one certificate for each network setting.

• Certificate — Select a certificate to use from the User Certificate list.

• User certificate Connector — Select a connector to use from the User certificate Connector list.

• Issuing external CA — Select an external CA to use from the Issuing external CA list.

Set to use SSL for email encryption.

Mutes email notifications.

Select the default value of the email body size.

Select a connector from the user information connector.

• Enable Notification — Activates email notification.
• Enable "Always notify by vibrate mode" — Notifies the user of new emails with a vibration.
• Disable Notification — Deactivates email notification.

Select a VPN vendor among F5, Juniper, Cisco, and User defined. Input fields vary depending on the selected VPN vendor name.

Select an entering method for Knox VPN information.

• Manual Input — Allowed for all VPN vendors except for User defined. For more information, see Configuring a Knox VPN profile manually.
• Upload profile — Allowed for all VPN vendors.

Select an input method for entering certificate information.

• EMM Management Certificate — Register an external certificate on the Knox Manage server for each network setting, and then verify each network setting using that certificate.
• Connector interworking — Verifies network settings using the user information obtained by applying the filter set for the connector. To verify the network settings on the device, you should set the Service Type as Profile Configuration (Certification) when you register a connector in Advanced > System Integration > Directory Connector. To learn more about how to add a directory connector, see Connect to AD/LDAP.

When you search for a user using the filter set for the connector, the user certificate (.p12 or .pfx) corresponding to the obtained user information is applied along with a profile, allowing you to use this certificate to verify the user.

• Issuing external CA — Register a certificate obtained from an external certificate authority to Advanced > Certificate > Certificate Template. Then, you register a certificate template for each network setting, and verify it as a user certificate. To learn more about how to add an external certificate, see Adding external certificates.

• Not Applicable — Disables authentication.
• Certificate-based Authentication — Uses certificates for authentication in the Knox VPN setting.
• CAC-based Authentication — Uses two-factor authentication provided by CAC (Common Access Card).

• By Application — Click Add next to The VPN applied package name per app and select applications, and then click Save.
• All Packages — All applications in the General area are subject to a VPN.

Select an input method for entering certificate information.

• EMM Management Certificate — Register an external certificate on the Knox Manage server for each network setting, and then verify each network setting using that certificate.

  All users share this one certificate for each network setting. Navigate to Advanced > Certificate > External Certificate to register network settings for each purpose.

• Connector interworking — Verifies network settings using the user information obtained by applying the filter set for the connector. To verify the network settings on the device, you should set the Service Type as Profile Configuration (Certification) when you register a connector in Advanced > System Integration > Directory Connector. To learn more about how to add a directory connector, see Connect to AD/LDAP.

When you search for a user using the filter set for the connector, the user certificate (.p12 or .pfx) corresponding to the obtained user information is applied along with a profile, allowing you to use this certificate to verify the user.

• Issuing external CA — Register a certificate obtained from an external certificate authority to Advanced > Certificate > Certificate Template. Then, you register a certificate template for each network setting, and verify it as a user certificate. To learn more about how to add an external certificate, see Adding external certificates.

• CA certificate — Select a certificate to use from the CA certificate list. Among the certificates registered in Advanced > Certificate > External Certificate, those with the Purpose set as CA Cert and the Type set as Root will appear on the list.
• User certificate — Select a certificate to use from the User Certificate list. Among the certificates registered in Advanced > Certificate > External Certificate, those with the Purpose set as CA Cert and the Type set as User will appear on the list.