Enroll a single device

With Knox Manage, you can enroll devices manually or with a token, QR code, or Zero-touch.

Enrolling general devices (Android Legacy, iOS, and Windows)

For all supported systems, you can enroll a device by sending an installation guide instructing them on how to manually install the Knox Manage agent and sign in to Knox Manage.

Before enrolling devices, admins must create a user account to register enrolled devices to it. For more information on creating user accounts, see Register a single user account.

To enroll a device in general:

1. Ask the device user to install the Knox Manage agent on the device:

   • Send an Email_Agent Installation template to send a QR code by email template. The QR code links to the Knox Manage agent. For more information, see Send templates or user notifications to users using email.

   • Send a URL or QR code by email or SMS. The URL or QR code is a link to the Knox Manage agent. For more information, see Send enrollment guides to users using email and SMS.

   • Alternatively, the device user can directly find and install the Knox Manage agent on the device’s app store.

2. The device user then launches the Knox Manage agent on the device.

3. On the login screen, the device user signs in to Knox Manage with a user ID and password. If the login succeeds, the assigned profiles, policies, and apps apply to the device.

In some cases, IT admins may need to enroll specific devices using a manual enrollment method known as Limited Enrollment. For more information on managing devices using the limited enrollment method, see Manage limited enrollment.

Enroll Android Enterprise devices

Knox Manage supports the following Android Enterprise managed device modes. The permissions and management capabilities of admins and users differ across each management type. Each management type can be enrolled differently depending upon your organization’s IT and security needs.

• Fully managed — This type allows you to completely control the entire company-owned device using Knox Manage.

• Fully managed with a work profile — This type, separates devices into two areas: the work profile and the personal profile, both of which are controlled by admins.

• Work profile on company-owned devices — This type similarly separates the device into a work profile and a personal profile. On the work profile, you have full administrative control. On the personal profile, apps and data belong to the user, so you can’t control them. However, the personal profile offers enhanced privacy protection.

• Work profile — This type allows you to control personal devices, or bring your own devices (BYOD). In this case, Knox Manage only manages the work profile on the device.

Enroll as fully managed

Enroll Android devices as fully managed for complete, administrative control over the whole device. If the device isn’t new, you must factory reset the device in advance. Select one of the following methods.

Enroll as fully managed with a work profile

Enroll the Android devices as the fully managed with a work profile type to control the separate work and personal areas. The enrollment methods are the same as those for the fully managed type, but this type can be enabled by selecting the fully managed with a work profile option when adding or modifying a user. For more information, see Register a single user account. This profile type is supported on devices running Android version 8 to 10.

Enroll as work-profile on a company-owned

Enroll devices as company-ownded with a work profile type with these methods.

Enroll as work profile

To enroll the Android device with a work profile, provide an installation guide to the users to install the Knox Manage agent on the devices. You can either send an installation guide to your users by email or SMS, or users can download the Knox Manage agent directly from their public app store.

When devices running Android 13 and higher are activated, the Knox Manage agent on the personal profiles of devices is automatically disabled and hidden on the screen. If required, device users can choose to manually uninstall the Knox Manage agent from their personal profiles by navigating to Setting > Apps > Knox Manage > Uninstall. To re-install and re-enroll the Knox Manage agent on the personal profile, enable Samsung Knox Manage in Google Play Store, or re-install it from Google Play Store.

Due to progressive privacy improvements in Android 13, after an Android 13 device is enrolled with a work profile, the Knox Manage agent requires permission from the device user to display notifications in the personal profile.

To enroll an Android device as the work profile type:

1. On the device screen, tap the installation URL address sent to users by email or SMS to download and install the Knox Manage agent on the device.

   You can also search for the Knox Manage agent from the Google Play Store to download and install it on the AE device.

2. On the device, launch the Knox Manage agent.

3. On the Sign in with your Samsung Knox Manage Account screen, enter a user ID and password, and then tap Sign In to sign in to Knox Manage.

   For devices running Android 10 or higher, tap the enrollment notification on the status bar to install the work profile manually.

4. On the Set up a work profile screen, read the Knox Manage privacy policy, and then tap Agree. The work apps with the briefcase badge icons — for apps managed by Knox Manage — show on the device.

Use a token

With this method, the device user enters the token (afw#KnoxManage) to enroll the Android device as fully managed, fully managed with a work profile, or company-owned with a work profile. The token replaces the need for user credentials, and also automatically installs and starts the Knox Manage agent.

To enroll an Android device with the afw#KnoxManage token:

1. Turn on the factory-reset device, and on the device screen, tap Start.
2. On the Connect to Wi-Fi screen, select an available Wi-Fi network, and then tap Next.
3. On the Agree to Terms and Conditions screen, read the terms and conditions, and then tap the check box next to I have read and agree to all of the above. Then, tap Agree. The device checks for updates and the updated terms and conditions are applied.
4. On the Sign in screen, for Email or phone enter afw#KnoxManage, and then tap Next.
5. On the Android Enterprise screen, tap Install to download the Knox Manage agent on the device. The Knox Manage agent is downloaded and launched automatically.
6. On the Set up your device screen of the Knox Manage agent, read the privacy policy of Knox Manage and Google, and then tap Accept & continue.
7. On the How will you use this phone? screen, depending on how the device should be managed, choose either Fully managed device or Work profile on a company-owned device. The Knox Manage agent launches automatically.
8. On the Sign in with your Samsung Knox Manage Account screen, enter a user ID and password, and then tap Sign In to sign in to Knox Manage. Depending on the profiles applied to the device, the device is enrolled as fully managed or fully managed with a work profile.

Use a QR code

Use a QR code sent by email to enroll a device. For more information on sending a QR code, see Sending enrollment guides to users using email and SMS.

To enroll an Android device with a QR code:

1. Turn on the factory-reset device, and tap the welcome screen 5 times to begin QR code enrollment. The QR Reader app is downloaded and the device camera launches to scan the QR code automatically.
2. Scan the QR code sent by email. The Knox Manage URL and tenant information included in the QR code is detected.
3. On the Connect to Wi-Fi screen, select an available Wi-Fi network, and then tap Next.
4. On the Agree to Terms and Conditions screen, read the terms and conditions, and then tap the check box next to I have read and agree to all of the above. Then, tap Agree. The Knox Manage agent launches automatically.
5. On the Sign in with your Samsung Knox Manage Account screen, enter a user ID and password, and then tap Sign In to sign in to Knox Manage. Depending on the profiles applied to the device, the device is enrolled as fully managed or fully managed with a work profile.

Configure Google account

After a device is enrolled, device users must configure a Google account on the device to be able to access Google services such as Managed Google Play. They can use their personal or enterprise email ID to configure the Google account on a device.

On fully managed devices and company-owned devices with a work profile that run Android 9 and higher, device users are shown a notification to set up the Google account. Their enterprise email ID is automatically populated on the Google sign in screen on the device. As email IDs are not case sensitive, any uppercase letters are automatically transformed to lowercase.