Knox Service Plugin cannot be uninstalled from user devices

Environment

• Knox Service Plugin (KSP)

Overview

Users may find that the Knox Service Plugin (KSP) cannot be uninstalled from a device or deactivated as a Device admin under:

Settings > Biometrics and Security > Other security settings > Device admin apps > Knox Service Plugin.

If KSP is installed on a device and no policies have been pushed through managed configuration from the UEM’s console, the app may still be uninstallable in certain cases.

However, once any policies have been applied to the device through KSP, KSP is made a Device Admin and becomes uninstallable. This behavior is intentional because if KSP were to be removed after applying policies, the device would no longer have the ability to revoke any of the previously applied policies.

Workaround

To remove KSP from a device, it must be factory reset (for Fully Managed, Fully Managed with Work Profile, or Work Profile on Company-owned devices), or the Work Profile must be deleted.

An additional alternative is to leave KSP installed on the device but configure an empty configuration from the UEM console so that no policies are actually applied. Please ensure that the KSP debug mode is disabled so that the KSP agent is not visible on user devices.