Set up the Knox Remote Support agent with an EMM or Knox Manage

Before you launch a remote support session on a device, you must set up the Knox Remote Support agent and install to the device. You can set up and install the agent with Knox Manage or another EMM.

Install and enable the Knox Remote Support agent

From the Knox Admin Portal

If you’re using Knox Remote Support from the Knox Admin Portal, you can:

• Ask the device user to install the Knox Remote Support agent from the Google Play Store. If you choose this method, you won’t be able to automatically start or ask users to start a remote session.
• Set up and deploy the Knox Remote Support agent through a EMM. To do so, you need to set up managed configurations for the agent in your Emm. See the section below for more information.

Set up managed configurations

When you install Knox Remote Support through a UEM, you must set up the managed configuration to ensure that the agent is properly deployed to devices. Before you start, go to the Knox Remote Support console. Then, click your username in the top-right corner and copy the Secret Key. You’ll need to enter this key later.

Then, configure the below managed configuration:

1. In your UEM console, add Knox Remote Support to Managed Google Play.

2. Go to the managed app configuration for Knox Remote Support. Then, for Secret Key, paste the key you copied earlier.

3. Set the following policies for the device:

   Policy	Value	Required?
   Automatically install the Knox Remote Support agent	True	Required
   Automatically run the agent after installation	True	Required
   Prevent device users from deleting the agent	True	Optional

4. Save your policies and deploy them to the devices.

Once the agent is installed on the device, you can see it on the Knox Remote Support Device page.

From Knox Manage

If you’re using Knox Remote Support from the Knox Manage console, you have two options:

• Ask the device user to install the Knox Remote Support agent from the Google Play Store. This option may be helpful if devices are set up as the work profile on company-owned management type. Users can install the agent in the personal profile, allowing you to troubleshoot the entire device, instead of just the work profile.

• Add the agent as a Managed Google Play app. When you assign it to the device, configure the following settings on the Assign Application page:

After the Knox Remote Support agent is installed, the device user is prompted to grant Knox Remote Support permission to send notifications. The device user must provide consent to these permissions to use Knox Remote Support, including for use of Automatically start option for starting remote sessions.

• On Samsung devices, device users are prompted only once to grant permissions to the Knox Remote Support agent after it’s installed.
• On non-Samsung and DeX mode devices, device users are prompted to grant permissions to the Knox Remote Support agent at the start of each Knox Remote Support session.

Additional set up

There are a few additional policies you must configure to ensure full functionality of Knox Remote Support.

Set the Knox Service Plugin policy

For devices set up as the work profile or work profile on company-owned, you must configure some Knox Service Plugin policies. Otherwise, the remote device’s screen is not relayed and shown in the viewer, which displays a blank screen instead.

1. Go to your UEM console and edit the policies for your device.

2. Set the following policies depending on the device’s platform and enrollment type:

   • To view and control the work profile:

     Policy	Value
     Knox Service Plugin > Work Profile Policies (Profile Owner) > Enable work profile Policies	True
     Knox Service Plugin > Work Profile Policies (Profile Owner) > Advanced Restriction Policies in work profile (Premium) > Allow remote control	True

   • To view and control the personal profile:

     Policy	Value
     Knox Service Plugin > Device-wide policies… > Enable device policy controls	True
     Knox Service Plugin > Device-wide policies… > Advanced Restriction policies (Premium) > Allow remote control	True

Automatically grant app permissions to the Knox Remote Support agent

If you want to automatically start remote support sessions on your devices, you need to set certain policies to bypass the prompt asking device users to manually grant permissions.

If you’re a Knox Manage user:

1. In a profile, set the Runtime permission for all apps policy to Prompt. See the respective original console and new console pages for more information on profiles.
2. In the app dialog, search for and select Knox Remote Support (com.sds.emm.sers).
3. On the App permissions page, Grant the following:
   • read phone status and identity
   • android.permission.READ_PHONE_NUMBERS
   • post notifications (for Android 13 and higher)
4. Save your profile and assign it to devices.

If you’re a UEM user, grant the following app runtime permissions to the Knox Remote Support agent:

• read phone status and identity
• android.permission.READ_PHONE_NUMBERS
• post notifications (for Android 13 and higher)

Resolve errors for Android Enterprise devices

In some cases, Android Enterprise devices might display error notifications related to device admin notifications, and Knox Remote Support might fail to launch. If this behavior occurs after setting the Knox Service Plugin policies, then you should enable the following additional Knox Service Plugin policies to resolve the issue:

1. Go to your UEM console and edit the policies for your device.

   • If you’re a Knox Manage user, go to Profile, then click the name of the device’s profile. Then, click Modify Policy > Samsung Knox.

2. Under Knox Service Plugin > Device-wide policies… > Device Admin allowlisting, set the following policies:

   Policy	Value
   Enable device admin controls	True
   Allowlisted DAs	Add an admin named Knox Remote Support