App update controls policy preventing Knox Service Plugin from updating

Environment

• Knox Manage
• Knox Service Plugin

Overview

With Knox Service Plugin, users can control specific app updates to a device with Application management policies > App update controls. After configuring App update controls, users may encounter a situation where the Knox Service Plugin app is unable to update on the device. Any additional policy or schema updates for Knox Service Plugin also can’t be applied.

Cause

The App update controls policy includes List of apps, a list of specific apps to be controlled by the policy. By default, the Knox Service Plugin app is not included in the allowlist when Allow update for specified apps only is selected.

When the Knox Service Plugin schema structure is updated, an app update is required to support the new structure. If the Knox Service Plugin app is not included in the allowlist, then the app can’t update to apply the new schema.

Workaround

If the Knox Service Plugin app can’t update, device users must factory reset and re-enroll the device. Before re-enrollment, the Knox Service Plugin package must be added to the allowlist:

1. On the Knox Manage console, go to Profile.

2. Create a new profile or modify an existing profile.

3. Click Samsung Knox > Knox Service Plugin, then set the following policies under Device-wide policies:

   • Enable device policy controls — True
   • Application management policies > Enable application management controls — True
   • Application management policies > App update controls > Application update policy — Allow update for specified apps only
   • Application management policies > App update controls > List of apps — Add the Knox Service Plugin app ( com.samsung.android.knox.kpu )

The Knox Service Plugin package will be added to the allowlist by default in Knox Service Plugin 1.3.91.