Knox Mobile Enrollment frequently asked questions

Knox Mobile Enrollment is an automated and streamlined EMM enrollment tool that enables you to provision thousands of devices for enterprise management, with less hassle for both IT admins and device users. With our advanced staging and security options that flex to your needs, enroll work devices safely across any network environment or fleet size. Knox Mobile Enrollment is fully integrated with Samsung devices and services for an end-to-end experience.

Knox Mobile Enrollment is a free solution offered by Samsung and can be used without a license. Knox Mobile Enrollment profiles with standard settings allow you to configure EMM enrollment parameters and set up basic features for device enrollment.

Furthermore, turning on advanced settings provides additional device control and security. For more information, see Advanced profile settings.

¹ You can use Knox services once you are enrolled and your information is confirmed by Samsung.

Find out what you need to get started with Knox Mobile Enrollment.

Yes. Knox Mobile Enrollment allows customers to add a certificate to enable their internal network connections.

Root or intermediate certificates can be downloaded and installed after creating a Knox Mobile Enrollment profile, but prior to EMM connectivity, which may require root certificates to proceed.

The following certificate types are supported — CER, PEM, CRT, DER, and CA-BUNDLE (either inside a ZIP file or applied directly). Additionally, CA certificates are supported, not User certificates. Keep in mind, with Android 9 root and intermediate certificates are installed in the device’s default keystore. With Android 10 and higher, root and intermediate certificates are installed in the VPN and App keystores as well as the device default keystore.

Yes, Knox Mobile Enrollment supports enrolling in locally hosted EMM, so your security and performance are tightly maintained. Even in on-premise environments with intranet, use Knox Mobile Enrollment Direct — a PC application — to enroll and configure devices remotely.

Knox Mobile Enrollment cloud and Knox Mobile Enrollment Direct support only Samsung Android devices.

For the most up-to-date list of devices that Knox Mobile Enrollment supports, see Devices secured by Knox.

For supported EMMs, please visit the Knox partner solutions page. See Standard profile settings to learn how you can manually enable EMMs that aren’t on the list.

The following enrollment options are available to Knox Mobile Enrollment:

• Reseller uploads — Authorized Samsung resellers can directly upload purchased device IMEIs to Knox Mobile Enrollment on behalf of their customer(s). For more information on Knox Mobile Enrollment resellers, visit the Knox resellers page.
• Knox Deployment App (KDA) — KDA is an app available on Google Play that is uniquely designed to help streamline the enterprise deployment of Samsung phones and tablets running an appropriate Knox version. The KDA allows an enterprise IT admin to upload devices directly through Bluetooth and Wi-Fi Direct, without the assistance of a reseller. KDA runs on a designated primary device which is required to sign in to Knox Mobile Enrollment. The target device requires a special B2B menu activated by drawing a plus sign (+) gesture on the initial device setup screen.
• QR code — QR code gesture enrollment is an enrollment option for devices running Android 10 or higher. The QR code enrollment process begins by drawing a plus sign (+) gesture on the initial device setup screen. This opens a menu, which when selected, activates the device’s camera in QR code recognition mode. Once a QR code is recognized, a Wi-Fi connection is made (if the proper credentials are contained within the QR code) and enrollment begins. If there are no Wi-Fi credentials within the QR code, then the user is prompted to provide them within the Wi-Fi setup screen.

For Samsung device purchases and a simple onboarding process, see the resellers participating in the Knox Deployment Program.

Yes. Your MSP can use the Knox MSP portal to act as your proxy with Knox Mobile Enrollment features, including device bulk enrollment. Customers with the legacy Knox Mobile Enrollment offerings can also choose to migrate to the Knox MSP portal.

Knox Mobile Enrollment is available in 110 countries worldwide so that customers can have the same device enrollment experience wherever they are operating. For details, please see the list of countries where we operate.

Yes, you can enroll multiple devices from multiple locations in a single place. However, please note that currently, there are two Knox Mobile Enrollment servers globally — one server for devices in the Americas ³ and a second server for the European Union (EU) and the rest of the world. Your Knox Mobile Enrollment admin account is tied to one of these two servers based on the country selected at the time of registration.

For example, if you selected the US as your country during Knox Mobile Enrollment registration, then only devices from the Americas can be enrolled through this account. If you have devices from the EU or other parts of the world, then you will need to create a second Knox Mobile Enrollment admin account selecting a country outside of the Americas during registration.

³ Countries in North America and Central and South America.

Knox Mobile Enrollment (KME) APIs are cloud-based APIs that enable companies to integrate key Knox Mobile Enrollment capabilities into their own custom portal, providing them a single portal for managing profiles and resellers. Use cases include internal IT support portals and management consoles for customers. These APIs are RESTful and return JSON responses. For secure access, API consumers should use the Samsung Knox access token. You can see the guide on these REST APIs to identify the Mobile Device Management (MDM) solution used to manage enterprise devices.

Technically, a Knox Suite license is not required to create a profile with advanced settings. When a device undergoes out-of-box enrollment and is enrolled in Knox Mobile Enrollment, active Knox Suite licenses, if any, are activated. In case no active Knox Suite licenses are detected before device enrollment, you can still create an advanced profile.

If a profile with advanced settings turned on is assigned to a device but there are no Knox Suite seats remaining in your tenant, you won’t be able to use any of the advanced settings . Even if you successfully enroll with Knox Mobile Enrollment, since you don’t have a Knox Suite license, it will automatically be enrolled with standard profile instead. The device status becomes Enrolled (restricted).

The following table covers three scenarios for license assignments in Knox Mobile Enrollment advanced profiles:

If you have profiles with advanced settings turned on, you will lose access to the advanced settings once your Knox Suite license expires. Contact your local Knox reseller to renew your license.

After assigning a regular profile on the console, you must factory reset the device to apply the regular profile settings to the device.

Samsung provides various KBAs in the Support section of SamsungKnox.com for customers to find solutions independently. For issues that can’t be solved using our digital resources, you can sign up on SamsungKnox.com to send us inquiries or create support tickets. Learn how to create support tickets.