Knox Mobile Enrollment 1.34 release notes

Allow Work Profile (PO) creation in KME via MDM selection

This feature addresses admin requests to create a KME supported PO profile (work profile) with supported MDMs.

With this release, you can now choose what type of out-of-box Android Enterprise enrollment to use. Previously, KME only supported fully managed devices via Device Owner (DO) mode, but with this release KME is also supporting out-of-box work profile creation via the Profile Owner (PO) mode, as long as it is supported by the MDM. This is accomplished by adding a profile option to “Let MDM choose” what kind of enrollment to use. This is a new feature introduced in Android 10, and not all MDMs currently support it.

When configuring Android Enterprise profile settings, an admin is now presented the option of setting MDM INFORMATION to Force Device Owner enrollment.

When Force Device Owner enrollment checkbox is selected, an admin is displayed the Android Enterprise profile settings screen with settings for a DO profile. However, if the Force DO enrollment checkbox is not selected the admin is displayed the Android Enterprise profile settings screen (if running Android 10 or later) to let the MDM optionally enroll as a PO (Profile Owner).

Profiles created before the KCS 1.34 release are set to Force Device Owner enrollment. The default setting for any newly created profile will also have this value.

For information on configuring an Android Enterprise KME profile, go to: create profiles.

On-premises Intranet hosted MDM APK support

Often the most time consuming parts of device enrollment is downloading the MDM APK over the public Internet. With this release you can now host and download the APK from inside your own Intranet. Besides speeding up device enrollment, you can also host private MDM APKs that are not publically available.

With this release, a This MDM APK is locally hosted on an Intranet server checkbox has been added to the Android Enterprise profile details screen to provide an alternative to an externally hosted MDM agent APK. Select this option to use an APK resource from within a local company Intranet. This option is disabled by default.

If the Publically available MDM APK option is selected, then a text box displays. Enter the URL of a publically accessible version of the exact same MDM APK you are hosting within your local company Intranet. By default, Samsung recommends a location based on the MDM name you may have previously selected, but this can be overwritten.

If there is no publically available exact match, then select Privately available MDM APK and provide the required information associated with the Intranet hosted MDM APK. This is used for validation during device enrollment, and also to display on the Managed Provisioning screen.

The Admin component name is expressed as “package name/class name”. For example, com.airwatch.androidagent/com.airwatch.agent.DeviceAdministratorReceiver for the Workspace ONE UEM.

The Admin package signature checksum is the Base64 encoded SHA-256 hash of the MDM APK signature, which is URL friendly. You can get this value from your MDM. Go here for information on the EXTRA_PROVISIONING_DEVICE_ADMIN_SIGNATURE_CHECKSUM. Alternatively, you can use utilities such as Keytool on Linux to get this value. Go here for additional information.

The MDM app name is the name of the app displayed on the Managed Provisioning screen.

The App icon is the icon displayed next to the MDM app name. The minimum size is 48 x 48 pixels, and the file format needs to be a PNG file.

To use this information to create an enrollment profile, go to: create profiles.

What's new pop-up messaging

This release introduces a pop-message with new descriptive text of the new features introduced with the KCS 1.34 release. This will help familiarize admins and users with the latest functionality to assist with enrollment and deployment.

Consolidated KnoxSuite service on-boarding

This feature addresses KnoxSuite admin requests to use a single consolidated onboarding process instead of separate onboarding flows for services such as KME and Knox Manage (KM). Currently, when a user selects the Try Knox Suite button, on the Knox Portal Dashboard, they must apply for a requested service separately. Samsung Admin approvals are also separate per requested service.

With this release, when a service such as KM is already approved for a specific customer, that customer's KME request is also approved automatically. However, if that customer's KM onboarding request is still not approved or pending, then the KME request is not approved until the Samsung Admin approves the original KM onboarding request. This helps keep Knox Suite requests aligned and reduces confusing onboarding duplication across supported services.