Knox Mobile Enrollment FAQ

Knox Mobile Enrollment is an automated and streamlined EMM enrollment tool that enables you to provision thousands of devices for enterprise management, with less hassle for both IT admins and device users. With our advanced staging and security options that flex to your needs, enroll work devices safely across any network environment or fleet size. Knox Mobile Enrollment is fully integrated with Samsung devices and services for an end-to-end experience.

Knox Mobile Enrollment is a free-of-charge IT solution offered by Samsung. You can use all the features with no license key required. To access Knox Mobile Enrollment, please visit the product page, enroll, sign in (with the enroll^* and sign-in buttons at the top), and launch the Knox Mobile Enrollment console.

^* You can use Knox services once you are enrolled and your information is confirmed by Samsung.

To use Knox Mobile Enrollment, you need supported Samsung devices running Knox version 3.0 or higher, purchased from a participating reseller in the Knox Deployment Program. *Devices purchased elsewhere can be deployed in bulk by using Knox Deployment App or QR code. The correct firewall exemptions are needed to extend beyond your local and protected network domain and securely connect to the Knox Mobile Enrollment server. For more information, see Knox Mobile Enrollment firewall exceptions.

Yes. Knox Mobile Enrollment allows customers to add the certificate(s) required to enable their internal network connections.

Root and intermediate certificates can be downloaded and installed after Knox Mobile Enrollment profile creation, but prior to EMM connectivity, which may require root certificates to proceed.

The following certificate types are supported — CER, PEM, CRT, DER, and CA-BUNDLE (either inside a ZIP file or applied directly). Additionally, CA certificates are supported, not User certificates. Keep in mind, with Android 9 root and intermediate certificates are installed in the device's default keystore. With Android 10 and higher, root and intermediate certificates are installed in the VPN and App keystores as well as the device default keystore.

Yes. Knox Mobile Enrollment allows customers to add the certificate(s) required to enable their internal network connections.

Knox Mobile Enrollment supports enrolling in locally hosted EMM, so your security and performance are tightly maintained. Even in on-premise environments with intranet only, use Knox Mobile Enrollment Direct — a PC application — to enroll and configure devices remotely.

As of March 2022, Knox Mobile Enrollment supports the following platforms and operating systems:

• Knox Mobile Enrollment — Samsung Android Only (Android 8, Knox 3.0 or higher)
• Knox Mobile Enrollment Direct — A laptop or desktop computer running Windows 10 for the PC app, and Samsung Android Only (Android 11, Knox 3.7.1 or higher) for target devices

Each Knox solution, including Knox Mobile Enrollment and Knox Mobile Enrollment Direct, is supported on the latest five major Android versions (1 latest version on the first major release in the year, plus 4 previous versions).

For supported EMMs, please visit the Knox partner solutions page. You can also manually enable EMMs that are not on the list.

The following enrollment options are available to Knox Mobile Enrollment:

• Reseller uploads — Authorized Samsung resellers that are participating in the Knox Deployment Program can upload purchased device IMEIs directly onto Knox Mobile Enrollment on behalf of their customer(s). For more information on Knox Mobile Enrollment resellers, visit the Knox resellers page.
• Knox Deployment App (KDA) — The KDA is a mobile application available from the Google Play Store that is uniquely designed to help streamline the enterprise deployment of Samsung phones and tablets running an appropriate Knox version. The KDA allows an enterprise IT administrator to upload devices directly through NFC^*, Bluetooth, and Wi-Fi Direct, without the assistance of a reseller. The KDA runs on a designated primary device which is required to log in to Knox Mobile Enrollment. The target device requires a special B2B menu activated by pressing a plus sign (+) on the initial device setup screen.
• QR code — QR code gesture enrollment is an enrollment option for Android 10+ devices. The QR code enrollment process begins by pressing the plus sign (+) on the initial device setup screen. This opens a menu, which when selected, activates the device's camera in QR code recognition mode. Once a QR code is recognized, a Wi-Fi connection is made (if the proper credentials are contained within the QR code) and enrollment begins. If there are no Wi-Fi credentials within the QR code, then the user is prompted to provide them within the Wi-Fi setup screen.

^* NFC is no longer supported on Android 11 and upward

For Samsung device purchase and a simple onboarding process, see the resellers participating in the Knox Deployment Program.

Yes. Your MSP can use the Knox MSP portal to act as your proxy with Knox Mobile Enrollment features, including device bulk enrollment. Customers with the legacy Knox Mobile Enrollment offerings can also choose to migrate to the Knox MSP portal.

Knox Mobile Enrollment is available in 110 countries worldwide so that customers can have the same device enrollment experience wherever they are operating. For details, please see the list of countries where we operate.

Yes, you can enroll multiple devices from multiple locations in a single place. However, please note that currently, there are two Knox Mobile Enrollment servers globally — one server for devices in the Americas^* and a second server for the European Union (EU) and the rest of the world. Your Knox Mobile Enrollment Admin account is tied to one of these two servers based on the country selected at the time of registration.

For example, if you selected the US as your country during Knox Mobile Enrollment registration, then only devices from the Americas can be enrolled through this account. If you have devices from the EU or other parts of the world, then you will need to create a second Knox Mobile Enrollment Admin account selecting a country outside of the Americas during registration.

^* Countries in North America and Central and South America

Knox Mobile Enrollment (KME) APIs are cloud-based APIs that enable companies to integrate key Knox Mobile Enrollment capabilities into their own custom portal, providing them a single portal for managing profiles and resellers. Use cases include internal IT support portals and management consoles for customers. These APIs are RESTful and return JSON responses. For secure access, API consumers should use the Samsung Knox access token. You can see the guide on these REST APIs to identify the Mobile Device Management (MDM) solution used to manage enterprise devices.

No, a Knox Suite license is not required to create an advanced profile. When a device undergoes out-of-box enrollment and is enrolled in KME, active Knox Suite licenses, if any, are activated. In case no active Knox Suite licenses are detected before device enrollment, you can still create an advanced profile.

If an advanced profile is assigned to a device but there are no Knox Suite seats remaining in your tenant, you won't be able to use any of the advanced features that are associated with the advanced profile. Even if you successfully enroll with KME, since you don't have a Knox Suite license, it will automatically be enrolled with a regular profile instead. The device status becomes Enrolled (restricted).

The following table covers three scenarios for license assignments in Knox Mobile Enrollment advanced profiles:

If you have devices with advanced profiles applied to them, you will lose access to the advanced profile features.

After assigning a regular profile on the console, you must factory reset the device to apply the regular profile settings to the device.

Samsung provides various KBAs in the Support section of SamsungKnox.com for customers to find solutions independently. For issues that can't be solved using our digital resources, you can sign up on SamsungKnox.com to send us inquiries or create support tickets. Learn how to create support tickets.