Knox Platform for Enterprise 3.11 release notes

Changes to Knox SDK access

With Knox 3.11, we’re introducing changes to Knox SDK access to prioritize enterprise use cases, and to better secure the privacy and data of Samsung Galaxy device users. With the release of Android 15, apps must run as the Android Enterprise Device Owner (DO) of a fully-managed device, or the Profile Owner (PO) of a work profile to access the full range of features provided by Knox SDK.

• Managed devices — Apps running as the Device Owner or Profile Owner can continue to access the full range of Knox SDK features.

• Unmanaged devices — Apps running purely in Device Administrator (DA) mode are not allowed to access select Knox SDK methods.

To see which Knox SDK methods are being restricted with Android 15 (Knox 3.11), please refer to Restricted API methods.

This release also introduces restrictions to remote control features included in the RemoteDesktop and RemoteInjection classes. These features will only be accessible to apps running as the DO or PO, or apps running within a DO or PO-managed environment, with authorization from the IT admin to access remote control features.

The following table shows the different levels of Knox SDK access available to apps of various management modes with Android 15 (Knox 3.11).

^*Only within a DO/PO environment, with the IT admin’s permission.

Enhancement to Work profile screenshots

Previously, screenshots taken within the Work profile are saved to the Work profile by default, but it was possible for IT admins to configure work screenshots to be saved in the personal profile with Knox SDK policies.

With Android 15, we’re removing the RESTRICTION_PROPERTY_SCREENCAPTURE_SAVE_TO_OWNER property from the ProfilePolicy class in Knox SDK. This prevents Work profile screenshots from being saved to the personal profile, further securing your enterprise data assets.

Knox Service Plugin exclusive

The following features are only available through Knox Service Plugin. Please refer to upcoming Knox Service Plugin releases after the release of Knox 3.11 for details about these features.

Improvements to SIM management

Knox 3.11 provides enhanced SIM control for your enterprise devices. You can use the following features to better manage dual-SIM devices for your enterprise, while ensuring that they follow your organization’s network and security policies.

• Set number of allowed SIMs:
  • Allow up to 2 physical SIMs
  • Allow up to 2 eSIMs
• Only allow SIMs with a specific MCC/MNC
• Configure the SIM settings UI:
  • Prevent device users from accessing SIM slots
  • Prevent device users from activating eSIMs with QR codes or URLs

Enhanced control over Galaxy AI features

With Knox 3.11, you can disable specific Galaxy AI features on Knox Service Plugin. This extra level of granularity allows you to use select Galaxy AI features for productivity while blocking other features to comply with your organization’s security policies.

Enhanced Samsung keyboard configuration

Previously, you could hide third-party apps on the Samsung keyboard to restrict the use of these apps on the keyboard.

With Knox 3.11, you can now completely disable third-party apps on the Samsung keyboard. While disabled, keyboard apps can’t be enabled or used by device users, and are cut off from any network communication. This feature further secures your devices, preventing unauthorized apps from accessing your enterprise data assets.

New deep settings configurations

Knox 3.11 introduces several deep settings configurations, providing a wider range of control over device settings.

• Configure Motions and gestures > Lift to wake.
• Configure adaptive or standard Motion smoothness.
• Prevent modification of the brightness slider in device settings.