Samsung Knox running Android Enterprise policies

Enter a domain blocklist that should not be used when registering an Exchange or email account.

• To add a domain, enter the domain name in the field, and click .
• To delete a domain, click next to the added domain name.

Enables the device to sync system time with an external server through the Network Time Protocol (NTP).

Values

• Apply — Enables NTP syncing.

Specifies the URL of the NTP server. Only available if theNetwork Time Protocol Settings policy is set to Apply.

Values

Enter a URL.

Specifies the maximum number of attempts allowed to connect to the NTP server during a polling cycle. Only available if theNetwork Time Protocol Settings policy is set to Apply.

Values

Enter the maximum number of connection attempts. The value can be 1–100.

Specifies the duration to wait before the device attempts to resync with the NTP server after the previous synchronization succeeds. When syncing begins, the device attempts to connect to the server a maximum number of times defined by theMaximum Number of Attempts policy. Only available if theNetwork Time Protocol Settings policy is set to Apply.

Values

Enter a delay between polling cycles, in hours. The value can be between 1–8760.

Specifies the duration to wait before the device attempts to resync with the NTP server after the previous synchronization fails. Only available if theNetwork Time Protocol Settings policy is set to Apply.

Values

Enter a delay between short polling cycles, in seconds. The value can be between 1–1000.

Specifies the duration to wait after a connection attempt during a polling cycle times out. Only available if theNetwork Time Protocol Settings policy is set to Apply.

Values

Enter a value, in seconds. The value can be between 0–1000 seconds.

Allows powering off the device.

Allows using the clipboard feature and sets the range.

• Allow — Allows the clipboard feature throughout the entire system.
• Disallow — Disallows the clipboard feature throughout the entire system.
• Allow within the same app — Allows using the clipboard feature only within the same application.

Enter the text for the reboot banner. You can enter up to 1000 bytes.

Allows using the hardware key on the device to update firmware.

• Disallow — Disallows updating firmware with the hardware key and performing a factory reset.

Fully Managed — Samsung Knox 1.0 and higher

Work Profile — Android 5 and higher

Allows NFC (Near Field Communication) control.

Fully Managed — Samsung Knox 1.0 and higher

Work Profile — Samsung Knox 2.4 and higher

Allows a device connection via OTG (On the Go). OTG controls only the storage items and not the non-storage items, such as a keyboard or mouse.

Allows using the Wi-Fi SSID allowlist. Devices can only connect to the Wi-Fi APs on the allowlist.

Add Wi-Fi APs to the allowlist. This policy is irrelevant to adding or deleting the Wi-Fi setting profile.

• To add a Wi-Fi AP, enter a Wi-Fi SSID and click .
• To add all Wi-Fi APs, click Add all to access the Wi-Fi list.
• To delete a Wi-Fi AP, select a Wi-Fi SSID and click .

Allows using the Wi-Fi SSID blocklist. Devices cannot connect to Wi-Fi APs on the blocklist.

Add Wi-Fi APs to the blocklist. This policy is irrelevant to adding or deleting the Wi-Fi setting profile.

• To add a Wi-Fi AP, enter a Wi-Fi SSID and click Add, .
• To add all Wi-Fi APs, click Add all, to access the Wi-Fi list.
• To delete a Wi-Fi AP, select a Wi-Fi SSID and click .

Set a minimum security level for Wi-Fi.

Select devices to allow Bluetooth connections with. Click the check boxes for Audio, File transfer, Phonebook, Headsets, or Hands-free.

Select devices to allow Bluetooth connections with. Click the check boxes for Audio, File transfer, Phonebook, Headsets, or Hands-free.

Allows the user to select whether to receive updates on the device.

• Forced use — Set to receive security updates by default.

Use the System bar which refers to the Status bar in the Notifications area at the top of the device and the Navigation bar in the Buttons area at the bottom.

For non-Samsung devices, even if you selected either Allow status bar only, or Allow navigation bar only, both the status bar and the navigation bar will be disabled.

Allows the use of Air command. Air command is a function provided on Samsung devices. Menu items appear when the user brings an S pen close to the screen.

Set to exempt applications from the battery optimization mode.

Add applications to be exempted from battery optimization mode.

• To add an application, click Add, , and then select applications in the Select Application, window.
• To delete an application, click next to the added application.

Specify whether to block an app component, such as activity, receiver, or service.

Values

• N/A
• Apply

Select an app and specify the component to block.

Allows cookies in the Android browser.

Set the proxy server address for the Android browser. Enter the value in the form of IP:port or domain:port in the fields.

Specifies the types of voice calls to block:

• Incoming — Blocks incoming voice calls only.
• Outgoing — Blocks outgoing voice calls only.

If both are selected, only emergency calls can be made or received.

Select the types of SMS/MMS messages to disable.

This policy is no longer supported through profiles. You can control SIM card locking throughdevice commands.

Input values to permit the target IP and port address. Configure the following:

1. Enter or click Add, to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).

3. Select the Network Type:

   • All,
   • Data, — Only mobile network access is enabled.
   • Wi-Fi, — Only Wi-Fi network access is enabled.

4. Select Port Range:

   • All,
   • Local, — Port access from the device is enabled.
   • Remote, — Port access from the target server is enabled.
5. Click to add.

Input values to prohibit the target IP and port address. Configure the following:

1. Enter or click Add, to search the Package Name of the application.

2. Enter the IP Address (range) and Port (range).

   • Enter a wildcard character (_) as an IP Address to prohibit the use of the bandwidth.

3. Select Network Type:

   • All,
   • Data, — Mobile network access is disabled.
   • Wi-Fi, — Wi-Fi network access is disabled.

4. Select Port Range:

   • All,
   • Local, — Port access from the device is disabled.
   • Remote, — Port access from the target server is disabled.
5. Click to add.

Input values to permit the target domain address.

1. Enter or click Add, to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).

Input values to prohibit the target domain address.

1. Enter or click Add to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).

Input values to specify the domain server address of all applications or registered applications.

1. Enter or click Add to search the Package Name of the application.
2. 2. Input DNS values.
   • DNS1, — Primary DNS.
   • DNS2, — Secondary DNS.

Allows the use of DeX mode.

• Disallow — The DeX station will not function even if a mobile device is mounted on it.

Prohibits launching the specified applications.

When this policy is enabled and applied, the icons of the blocked applications will disappear so that users cannot launch them. However, the applications are not deleted. The icons will reappear once the policy is changed or Knox Manage is disabled.

• To add an application, click Add, and then select applications in the Select Application window.
• To delete an application, click next to the added application.

Specifies the name of the APN configuration. Each configuration name must be unique.

Values

Enter a name.

Specifies the description of the APN configuration.

Values

Enter a description.

Toggles whether the device user can delete the APN.

Values

• Allow (default)
• Disallow

Specifies the name of the APN, which is comprised of the network identifier and optional operator identifier.

Values

Enter a name.

Specifies which connection services to allow for this APN.

Values

• Default — Allows all services. Also known as unspecified.
• MMS — Allows only the Multimedia Messaging Service (MMS).
• Supl — Allows only the Secure User Plane Location (SUPL) service, which is an IP-based protocol that uses GPS for device geolocation.

Specifies the MCC of the APN.

Values

Enter a 3-digit MCC.

Specifies the carrier's MNC for the APN.

Values

Enter a 2- or 3-digit MNC.

Specifies the address of the carrier's MMS server.

Values

Enter a URL.

Specifies the address of the carrier's MMS proxy server.

Values

Enter an IP or domain.

Specifies the port of the carrier's MMS proxy server.

Values

Enter a port.

Specifies the address of the carrier's wide area network (WAN) server.

Values

Enter a URL.

Specifies the address of the carrier's WAN proxy server.

Values

Enter a URL.

Specifies the port of the carrier's WAN proxy server.

Values

Enter a port.

Specifies the account username to use when connecting to the APN.

Values

Enter a username. By default, the field contains the ${UserName}, lookup item, which substitutes for the username associated with the device in Knox Manage.

Specifies the account password to use when connecting to the APN.

Values

Enter a password.

Specifies the protocol to use when authenticating with the APN.

Values

• None — Disables authentication.
• PAP — Uses the Password Authentication Protocol (PAP), which requires a username and password.
• CHAP — Uses the Challenge-Handshake Authentication Protocol (CHAP), which implements challenge messages to validate identities.
• PAP or CHAP — Uses either the PAP or CHAP method, depending on which is available.

Makes this the priority APN configuration on the device.

Values

Select to enable.