- Basics
- The Knox Ecosystem
- White Paper
- Samsung Knox Portal
- Knox Cloud Services
- General Knox Support
- Knox Licenses
- For IT admins
- Knox Admin Portal
- Knox Suite
- Knox Platform for Enterprise
- Introduction
- How-to videos
- Before you begin
- Get started with UEMs
- Introduction
- Blackberry UEM
- Citrix Endpoint Management
- FAMOC
- IBM MaaS360
- Microsoft Intune
- MobileIron Cloud
- MobileIron Core
- Samsung Knox Manage
- SOTI MobiControl
- VMware Workspace ONE UEM
- Knox Service Plugin
- Release notes
- Migrate to Android 11
- FAQs
- Troubleshoot
- KBAs
- Knox Mobile Enrollment
- Knox Configure
- Mobile
- Wearables
- Shared Device
- FAQ
- KBAs
- Knox Capture
- Introduction
- How it works
- How-to videos
- IT admins: Get started
- Getting started with Knox Capture
- Step 1: Launch Knox Capture
- Step 2: Create a scanning profile
- Step 3: Select apps and activities
- Step 4: Configure the scanner
- Step 5: Set keystroke output rules
- Step 6: Test apps in your configuration
- Step 7: Share your configuration
- Step 8: Deploy Knox Capture in Managed mode
- End users: Get started
- Features
- Release notes
- FAQ
- KBAs
- Troubleshoot
- Knox Asset Intelligence
- Knox Manage
- Introduction
- How-to videos
- Get started
- Video: Getting started with Knox Manage
- Integration with Managed Service Provider
- Access Knox Manage
- Configure basic environments
- Create user accounts
- Create groups
- Create organization
- Set up devices and profiles
- Set up Knox Manage deployment with a Knox Suite license
- Manage Chromebooks
- Manage Android devices with the Android Management API
- Manage Shared iPads
- Configure
- Licenses
- Organization
- Users
- Sync user information
- Groups
- Devices
- Content
- Applications
- Profile
- Knox E-FOTA
- Certificates
- Advanced settings
- Monitor
- Kiosk devices
- Knox Remote Support
- Active Directory
- Microsoft Exchange
- Mobile Admin
- Appendix
- Release notes
- Features
- FAQ
- KBAs
- Knox E-FOTA
- Introduction
- How-to videos
- Get started
- Features
- EMM integration
- Appendix
- Release notes
- FAQ
- KBAs
- Troubleshoot
- Knox E-FOTA On-Premises
- Legacy Knox E-FOTA products
- Knox Guard
- Introduction
- How-to video
- Get started
- Using Knox Guard
- Dashboard
- Manage devices
- Device management
- Accept or reject devices
- Upload devices
- Delete devices
- Complete device management
- Send notifications
- Enable or disable SIM control
- Download devices as CSV
- View device log
- View device deletion log
- Start and stop blinking reminder
- Lock and unlock devices
- Update lock message
- Send relock timestamp
- Turn on/off relock reminder
- Manage policies
- Manage licenses
- Manage resellers
- Manage admins and roles
- Activity log
- Knox Deployment App
- Release notes
- FAQ
- KBAs
- Support
- Samsung Care+ for Business
- For Knox Partners
- Knox Deployment Program
- Knox MSP Program
Role-based access control (RBAC)
Role-based access control (RBAC) allows customer (tenant) admins responsible for account creation (Super Admin) to assign more refined role permissions to individual admins as their enterprise requirements dictate. Though KME utilizes admin roles unique to the KME service, a Super Admin cuts across all services.
With RBAC, existing customers have their administrators migrated automatically. Administrators with their own unique set of permissions (manage administrators, delete devices etc.) are assigned new roles that map to their current permissions. If needed, new roles beyond what the migrated admins are currently assigned, can be created based on a list of permissions unique for each service.
Migrate existing admins to RBAC
KME has different permissions available to its administrators. Every combination of service permissions is mapped to a different role. The role names are generic by default, but can be modified based on your organization’s naming requirements.
For example, a KME admin with the ability to invite other admins will be mapped to “KME Role 1”. Or a KME Admin with the ability to both (i) delete and (ii) un-assign profiles from devices will be mapped to “KME Role 2”.
Create a role and assign permissions
Each Knox Cloud Service, including KME, has different permissions that can be combined and assigned a role.
Once the required Role name is defined, specific permissions can be selected by category as needed for the particular role. New administrator roles receive some basic permissions by default, but additional permissions require assignment for individual roles. Keep in mind, a role must be first created before an administrator can be invited to that role.
Invite a user to be an administrator with a defined role
Existing users require an invitation to become an administrator. However, as noted previously, a role must first be created that can be assigned to the administrator. A different Invite administrator screen could display stating that before an administrator can be invited a role must be first created and available for assignment.
Ensure appropriate roles and permissions are created and available before proceeding with an administrator invitation.
Once an appropriate role is available, provide the name and Email address serving as the administrator’s contact resource, then select the Role assignment for this specific administrator.
View roles
Once roles are created and assigned to administrators, they can be reviewed to assess whether the role name requires modification or its permissions need refinement.
If needed, more than one administrator can be assigned the same role. The number of administrators assigned a particular role displays as a numeric link that can selected to view the names of the assigned administrators.
User interface customization for particular roles
The KME console is customized for each role, depending on the permissions granted. For example, an Admin without Administration Privileges will not display “Administrators & Roles” in the left-hand navigation menu.