Configure third-party providers

Knox Manage can connect to third-party identity providers (IdPs) and directory services that manage and verify authentication information, such as user IDs. This allows identification and authentication information to sync between Knox Manage and enterprise directories, enabling users to enroll and sign into devices with their enterprise credentials.

Supported third-party identity providers

The new console currently supports the following IdPs:

• On-premises Active Directory (AD)
• Microsoft Entra ID

Add a connection

Connect to On-premises AD

To connect to an On-premises AD server:

1. Navigate to Connection and security > Identity provider, then click ADD CONNECTION.

2. Set the Connection type to On-premise AD.

3. Add a Connection name.

4. Enter the IP or host address, and the port number of your server under IP/Host.

5. Select the Encryption Type used when communicating with the AD server. Available options are None (default) and TLS for Transport Layer Security.

6. Select an authentication method to use when establishing a connection with the AD server. The options are:

   • None — There are no fields to fill out.
   • Simple — Enter the user ID and password.
   • DIGEST-MD5(SASL) — Fill out the fields with the information below.
   • CRAM-MD5(SASL) — Fill out the fields with the information below.
   • SASL realm — Enter the realm of the SASL server as a domain. This field is only available if you select DIGEST-MD5(SASL).
   • Quality of Protection — Select the extent of data protection.
     • Authentication Only — Protect data only upon authentication.
     • Authentication with integrity — Ensure integrity of all the data exchanged, as well as authentication.
     • Authentication with integrity and privacy — Ensure integrity of all data exchanges, as well as authentication through data encryption.
   • Protection Strength — Select a data protection level.
     • High — Use 128-bit encryption.
     • Medium — Use 56-bit encryption.
     • Low — Use 40-bit encryption.
   • Use mutual authentication — Select to enable validation for data exchanged between the client and the server.

7. Under User ID, enter the administrator information for accessing the directory server in any of the following formats:

   • domain/administrator ID
   • administrator_ID@domain
   • CN = administrator ID,CN = Users,C = domain,DC = com

8. Enter the Password associated with the User ID.

9. Under Connect to directory, select if you want to sync Users only, or if you want to sync Users and groups.

10. Check Schedule automatic syncs to directory to schedule automatic syncs.

    • Time zone — Set the time zone for the schedule.
    • Start date and time — Set the start date and time to sync with the directory.
    • Sync frequency — Sync Only once, or configure Daily or Weekly syncs.

11. Click NEXT to configure the user connection.

Connect to Microsoft Entra ID

To connect to your Microsoft Entra tenant, Knox Manage integrates with the Microsoft Graph API. When configured, this connection makes directory data available to Knox Manage, similar to LDAP connections.

To connect to a Microsoft Entra ID server:

1. On the Microsoft Entra ID portal, navigate to the Mobility (MDM and WIP) page and add Samsung Knox Manage as an application. Then copy your Tenant ID from the Overview page.
2. Sign into Knox Admin Portal. Navigate to Connection and security > Identity provider, then click ADD CONNECTION.
3. While adding a connection, set Connection type to MS Entra ID.
4. Add a Connection name.
5. Under Directory ID, enter the Tenant ID from your Microsoft Entra ID portal.
6. Under Connect to directory, select if you want to sync Users only, or if you want to sync Users and groups.
7. Check Schedule automatic syncs to directory to schedule automatic syncs.
   • Time zone — Set the time zone for the schedule.
   • Start date and time — Set the start date and time to sync with the directory.
   • Sync frequency — Sync Only once, or configure Daily or Weekly syncs.
8. Click NEXT to configure the user connection.

Add a user connection

Configure how Knox Manage syncs users from your identity server as follows:

1. (Only for On-premise AD connections) Enter the Base DN starting point. This is where your AD server searches for users. For optimal performance, click SELECT BASE DN and select the closest base DN to your target users.

   

2. (Only for On-premise AD connections) Configure a filter string to specify LDAP data items.

3. Under Sync target, sync specific users or all users.

   • To sync specific users, choose Select individually (recommended) from the dropdown, click SELECT USERS, then select the users you want to sync.

   You can set between 10,000 and 70,000 sync targets. The default remains at 40,000, but you can submit a ticket to change it. To submit a ticket, see Submit a support ticket.

4. (Optional) Configure Additional settings:

   • Automatically apply profile — A profile is automatically applied to a user’s device when their organization details change.
   • Delete users from Knox Manage if deleted from directory — Delete users from Knox Manage if they are deleted from the identity server directory.

5. Expand the MAPPING INFORMATION drop-down to configure user information synced from the didentity server directory to Knox Manage. Click ADD MORE to see additional fields that you can fill.

   • User ID — Enter a user ID.
   • User name — Enter the user’s user name.
   • Email — Enter the user’s email address.
   • Mobile number — Enter the user’s mobile number.
   • DN — Enter the unique name of the LDAP object.
   • Status — Enter the status of the user account.
   • UPN — Enter the User Principal Name (UPN).
   • Object Identifier — Enter the ID used to distinguish the synced user.
   • Employee number — Enter the employee’s number.
   • First name — Enter the user’s first name.
   • Middle name — Enter the user’s middle name.
   • Last name — Enter the user’s last name.
   • Display name — Enter the user’s display name.
   • Department — Enter the user’s department.
   • Administrator DN — Enter the unique name of the administrator.
   • Email user name — Enter the user’s email address that is linked to their username.
   • Contact — Enter the user’s phone number.
   • User identifier — Enter the name used to distinguish the synced user.
   • Default country code — Enter the default country code.

6. If you chose to sync both Users and groups earlier, click NEXT to configure the group connection. Otherwise, click ADD CONNECTION.

Add a group connection

Configure how Knox Manage syncs groups from your identity server directory:

1. (Only for On-premise AD connections) Enter the Base DN starting point. This is where your AD server searches for groups. For optimal performance, click SELECT BASE DN and select the closest base DN to your target groups.

2. (Only for On-premise AD connections) Configure a filter string to specify LDAP data items.
3. Under Sync target, sync specific groups or all groups.
   • To sync specific groups, choose Select individually (recommended) from the dropdown, click SELECT GROUPS, then select the groups you want to sync.

     You can set between 10,000 and 70,000 sync targets. The default remains at 40,000, but you can submit a ticket to change it. You can set between 10,000 and 70,000 sync targets. The default remains at 40,000, but you can submit a ticket to change it. To submit a ticket, see Submit a support ticket.

4. (Optional) Configure Additional settings:
   • Push profiles and apps when user added — Automatically push profile and app assignments to new group members.
   • Unassign profiles and apps when user deleted — Unassign profiles and apps from deleted group members.
   • Unassign profiles and apps when group deleted — Unassign profiles and apps from deleted groups.
   • Delete groups from Knox Manage if deleted from directory — Delete groups from Knox Manage if they are deleted on the identity server.
5. Expand MAPPING INFORMATION to configure the group information that’s synced from AD to Knox Manage.
   • Group Name — Enter a name for the group.
   • Member — Select a member for the group.
   • DN — Enter the unique name of the LDAP object.
   • Object Identifier — Enter the ID used to distinguish the synced group.
   • Group Identifier — Enter the name used to distinguish the synced group.
6. Click ADD CONNECTION.