Policies not applying after installation on device

Environment

• Knox Service Plugin
• Android Enterprise

Overview

When installing the Knox Service Plugin app on a device, you might encounter an issue where your configured policies aren’t automatically applied after the installation completes.

Cause

To apply Knox policies to your device, Knox Service Plugin must run as a foreground app.

Due to a change in how foreground apps are managed in Android, only apps with special permissions can run in the foreground without user interaction.

For most Samsung devices, Knox Service Plugin can run in the foreground. However, for select models, it can’t run in the foreground without a one-time interaction from the device user, as it doesn’t have the necessary permissions.

The following models are affected:

Workaround

To resolve the issue, you must add the Knox Service Plugin package (com.samsung.android.knox.kpu) to the battery optimization allowlist for all affected devices in your fleet. This process exempts the Knox Service Plugin app from any foreground service restrictions.

The process for this procedure depends on your EMM. Consult your EMM’s documentation for more information.

If your EMM doesn’t support battery optimization, you can manually configure this setting on the device:

1. On your device, go to Settings.
2. Tap Apps, then select Knox Service Plugin.
3. Tap Battery, and select Unrestricted.
4. Re-apply the policies to the device. This can be done from your EMM console, or by tapping Apply latest policies in the Knox Service Plugin app if debug mode is enabled.