- Basics
- The Knox Ecosystem
- White Paper
- Samsung Knox Portal
- Knox Cloud Services
- General Knox Support
- Knox Licenses
- For IT admins
- Knox Admin Portal
- Knox Suite
- Knox Platform for Enterprise
- Introduction
- How-to videos
- Before you begin
- Get started with UEMs
- Introduction
- Blackberry UEM
- Citrix Endpoint Management
- FAMOC
- IBM MaaS360
- Microsoft Intune
- MobileIron Cloud
- MobileIron Core
- Samsung Knox Manage
- SOTI MobiControl
- VMware Workspace ONE UEM
- Knox Service Plugin
- Release notes
- Migrate to Android 11
- FAQs
- Troubleshoot
- KBAs
- Knox Mobile Enrollment
- Knox Configure
- Mobile
- Wearables
- Shared Device
- FAQ
- KBAs
- Knox Capture
- Introduction
- How it works
- How-to videos
- IT admins: Get started
- Getting started with Knox Capture
- Step 1: Launch Knox Capture
- Step 2: Create a scanning profile
- Step 3: Select apps and activities
- Step 4: Configure the scanner
- Step 5: Set keystroke output rules
- Step 6: Test apps in your configuration
- Step 7: Share your configuration
- Step 8: Deploy Knox Capture in Managed mode
- End users: Get started
- Features
- Release notes
- FAQ
- KBAs
- Troubleshoot
- Knox Asset Intelligence
- Knox Manage
- Introduction
- How-to videos
- Get started
- Video: Getting started with Knox Manage
- Integration with Managed Service Provider
- Access Knox Manage
- Configure basic environments
- Create user accounts
- Create groups
- Create organization
- Set up devices and profiles
- Set up Knox Manage deployment with a Knox Suite license
- Manage Chromebooks
- Manage Android devices with the Android Management API
- Manage Shared iPads
- Configure
- Licenses
- Organization
- Users
- Sync user information
- Groups
- Devices
- Content
- Applications
- Profile
- Knox E-FOTA
- Certificates
- Advanced settings
- Monitor
- Kiosk devices
- Knox Remote Support
- Active Directory
- Microsoft Exchange
- Mobile Admin
- Appendix
- Release notes
- Features
- FAQ
- KBAs
- Knox E-FOTA
- Introduction
- How-to videos
- Get started
- Features
- EMM integration
- Appendix
- Release notes
- FAQ
- KBAs
- Troubleshoot
- Knox E-FOTA On-Premises
- Legacy Knox E-FOTA products
- Knox Guard
- Introduction
- How-to video
- Get started
- Using Knox Guard
- Dashboard
- Manage devices
- Device management
- Accept or reject devices
- Upload devices
- Delete devices
- Complete device management
- Send notifications
- Enable or disable SIM control
- Download devices as CSV
- View device log
- View device deletion log
- Start and stop blinking reminder
- Lock and unlock devices
- Update lock message
- Send relock timestamp
- Turn on/off relock reminder
- Manage policies
- Manage licenses
- Manage resellers
- Manage admins and roles
- Activity log
- Knox Deployment App
- Release notes
- FAQ
- KBAs
- Support
- Samsung Care+ for Business
- For Knox Partners
- Knox Deployment Program
- Knox MSP Program
Knox Mobile Enrollment (KME) streamlines the initial setup and enrollment of corporate-owned and employee-owned devices.
KME is the recommended tool when an enterprise requires bulk device enrollment with little configuration variance amongst the devices deployed.
Audience
This document is intended for:
- IT Admins — Admins create profiles with the device settings, restrictions, apps, and other content to deploy to groups of devices. After devices are successfully enrolled into the enterprise, they receive the KC device profile via a Wi-Fi or mobile data connection.
- Resellers — Resellers bulk upload devices on behalf of requesting customers.
Try the solution
Use KME to add new enrollment profiles, edit existing profiles and delete obsolete profiles as required as devices enroll in KME or require update. This guide also describes how to invite and manage admins, as well as assign required roles and permissions needed enroll and manage devices.
START TUTORIALPrerequisites
To use Knox Mobile Enrollment, you need:
- A Samsung account. For more information, go to: Create your Samsung accounts.
- A Knox Portal account. For more information, go to: Create your Samsung accounts.
- Samsung Knox devices running an appropriate Knox version.
- A MDM provider supporting the Knox Mobile Enrollment program
- The correct firewall exemptions needed to extend beyond your local and protected network domain and securely connect to the Knox Mobile Enrollment server. For more information, go to: Firewall exceptions.
- A KME supported browser (Google Chrome, Microsoft Edge, Mozilla Firefox)
- Permission to access Knox Mobile Enrollment features
For information on the growing list of KME supported countries, go to: KME country availability.
About KME
Once an enterprise acquires its devices, their IT administrator utilizes Samsung’s Reseller Portal to upload user credentials. To mass deploy devices to end user employees, the IT administrator loads MDM configuration(s) to KME and assigns a profile to either a single or group of devices. For an overview and diagram of the KME workflow, go to Knox Mobile Enrollment workflow.
Samsung's KME provides the following device enrollment benefits:
- Automated configuration — Manually tracking hundreds or thousands of devices and removing them from
their box for configuration can be a consumptive process with little perceived return on investment. With
Knox Mobile Enrollment, the entire process is streamlined. Once a purchase order is placed through an
approved reseller or carrier, the reseller uploads the devices’ unique International Mobile Equipment
Identity numbers (IMEIs) and serial numbers to the reseller portal.
- No hassles for employees — Enrolling devices with an MDM typically requires employees, once they receive the devices, to connect them to the MDM solution. This process typically involves navigating to a website and downloading the MDM software to the device. This process often creates problems, resulting in IT teams having to spend time guiding frustrated employees through the process. With Knox Mobile Enrollment, employees do not have to do a thing. As soon as they receive their device and power it on, the device automatically installs the required software and applies the security settings and configurations provisioned by the enterprise via the MDM client.
- Mobile security management — With Samsung Knox, the integrity of the entire device is protected from hardware to the application layer. With Knox Mobile Enrollment, IT admins can set security policies without physically touching the device. This makes it easy to protect company data by preventing employee updates potentially jeopardizing device security. IT admins can retain total device control and can prevent employees from installing apps and removing existing apps. IT admins can also disable high-bandwidth video streaming or automatic app updates, and can wipe company data if a device is lost or stolen.
New KME users who initially login to the KME console can also utilize the get started carousel and auto tour to understand the central functions of the KME console and access tooltips to better navigate the KME console. For more information, go to: Get started carousel and auto tour.
Samsung KME overview video
KME workflow
Enterprise IT admins purchase devices from carriers, resellers, or distributors and provide their unique customer IDs. The devices are validated for correctness by their sellers in KME, and shipped to end users who open the box and boot their device.
Refer to the following describing the KME process flow activities within the illustration above:
- An IT Admin and Reseller/Carrier create accounts in KME and RP respectively. They then exchange their IDs within KME using the Customer ID and Reseller ID.
- The Enterprise IT Admin purchases devices from their Reseller/Carrier.
- The Reseller uploads the list of purchased device IDs to the Reseller Portal.
- The device ID list is shared between the Reseller Portal and KME.
- The IT Admin is notified by email that their Reseller/Carrier has uploaded their devices.
- The IT Admin approves the device upload. Approvals can be made automatically for trusted Resellers/Carriers.
-
The IT Admin configures the devices by assigning them to a MDM profile and optionally adding username/password information to each device. Devices can be automatically assigned to a profile.
KME portal enrollment
An enterprise IT administrator with authority to enroll devices on behalf of their business registers for a KME account from the Samsung Knox portal. As soon as Samsung validates the KME account, the IT administrator can review employee enrollment status to ensure each submitted device is assigned to its correct enterprise end user resource and configuration profile. Submitted devices can be edited or removed from the enrollment portal at any time by the IT administrator. The IT administrator can optionally submit additional devices with the creation and upload of a CSV file containing the device IMEI, MEID or serial number, username and password, and additional MDM permitted data. Once users activate and connect a device to a stable Wi-Fi, they can submit the device for enrollment. If a stable Wi-Fi connection is problematic, an alternative enrollment resource is available to the IT administrator at Samsung KNOX Mobile Enrollment (https://me.samsungknox.com/).
Once registered within the KME console, a device’s profile enrollment status is available under a separate tab to assess whether enrollment is pending, rejected, ready, activated or rejected. MDM configuration profiles can be edited, deleted or added at any time. The KME portal utilizes an additional tab to register device resellers. Reseller registration allows Samsung to verify device ownership and prevent unauthorized enrollment, as only authorized Samsung resellers can be registered.
Lastly, reseller verified devices are shipped to end users who open the box and boot their device to complete enrollment. If needed, the KME portal utilizes an additional device user’s tab to edit, delete, add, or import user credentials into their intended device’s CSV file.
For information on KME supported countries, go to: KME country availability.
Enrollment options
The following enrollment options are available to KME:
- Reseller uploads — Authorized Samsung resellers can upload purchased device IMEIs directly into KME on behalf of their customer(s). For more information on KME resellers, go to: Resellers.
- Knox Deployment App (KDA) — The KDA is a mobile application available from the Google Play Store that is uniquely designed to help streamline the enterprise deployment of Samsung phones and tablets running an appropriate Knox version. The KDA allows an enterprise IT administrator to upload devices directly, without the assistance of a reseller. The KDA runs on a designated primary device which is required to login to KME. The target device requires a special B2B menu activated via a plus-sign (+) gesture on the initial device setup screen. The following KDA enrollment options are available, and display on the target device B2B menu:
- NFC — With Near Field Communication (NFC) enrollments, the target device (on which the special B2B menu has been launched) is “bumped” (held closely together) with another smartphone device with Knox Deployment App running and scanning in NFC mode. The dedicated primary NFC device displays available profiles, and end user device enrollment begins once an IT admin selects a profile. The NFC enrollment option is not available to tablet devices.
- Bluetooth — An IT admin can install the KDA on a dedicated admin/primary smartphone or tablet device, and select existing KME profiles. If the target device (on which the special B2B menu has been launched) is within proximity of the primary device, the user device connects to the admin device wirelessly via Bluetooth without a PIN or password requirement.
- Wi-Fi Direct — Wi-Fi Direct supported devices can connect directly to each other via a WLAN, without joining a traditional wireless network or Wi-Fi hotspot. Once enabled, a designated primary device automatically scans for other supported Wi-Fi direct target devices. Once discovered, target devices (on which the special B2B menu has been launched) can be selected for enrollment data transfer.
- QR code — QR code gesture enrollment is a new enrollment option for Android 10 devices. A QR code is a unique matrix style barcode containing information in JSON format used for enrollment. The QR code enrollment process begins with a device plus-sign (+) gesture on the initial device setup screen. This opens a menu, which when selected, activates the device's camera in QR code recognition mode. Once a QR code is recognized, a Wi-Fi connection is made (if the proper credentials are contained within the QR code) and enrollment begins. If there are no Wi-Fi credentials within the QR code, then the user is prompted to provide them within the Wi-Fi setup screen. For information on creating a QR code for device enrollment, go to: Create profiles.
KME-DO with KC
Samsung has now completed work for supporting KC + KME + Android Enterprise Managed device mode to increase opportunities for KC. KC can be launched from a KME enrolled device, by either selecting the device’s back key, or from a displayed device notification.
Customer ID
To obtain your Customer ID, hover over your initials on the top, right-hand side, the screen. This information may be required when supplying information to your reseller for a variety of reasons.