WEBVTT
Kind: captions
Language: en

00:00:05.800 --> 00:00:09.800
Welcome to the Knox video training series

00:00:09.800 --> 00:00:13.800
In this video, we’ll show you how to register  and configure authentication of certificate

00:00:13.800 --> 00:00:16.733
it for Samsung Email application through Knox Manage

00:00:17.766 --> 00:00:23.032
Before we start configuring the certificate authentication we first need to have following

00:00:23.033 --> 00:00:26.166
instruction and configure in the company: 

00:00:26.400 --> 00:00:27.166
 Exchange Server

00:00:28.400 --> 00:00:29.400
 Active Directory

00:00:29.400 --> 00:00:31.866
Certificate Authority

00:00:31.866 --> 00:00:35.766
and Knox Manage server side we need to have Knox Platform for Enterprise License

00:00:35.766 --> 00:00:38.599
and configure integration with Android Enterprise

00:00:39.566 --> 00:00:43.566
In order to authenticate Samsung email application with certificates from Knox Manage,

00:00:43.566 --> 00:00:45.432
we need to:

00:00:45.433 --> 00:00:47.699
Register a certificate authority

00:00:47.700 --> 00:00:50.266
Add a certificate template

00:00:50.266 --> 00:00:52.666
Configure Samsung Email app

00:00:52.666 --> 00:00:55.699
Create your Android Enterprise policy profile

00:00:55.700 --> 00:01:00.233
and finally, assign and apply those policies to Samsung Email app

00:01:00.233 --> 00:01:01.899
Let’s get started!

00:01:02.133 --> 00:01:05.299
Let’s begin by adding a Certificate Authority.

00:01:05.300 --> 00:01:10.700
 Go to the Knox.com dashboard and launch the Knox Manage Admin portal.

00:01:10.700 --> 00:01:16.266
From the left navigation, click Advanced > Certificate Authority (CA), 

00:01:16.266 --> 00:01:17.799
then click Add

00:01:17.800 --> 00:01:23.466
Enter the CA Name. In our example we’ll create a CA called “CompanyCA”

00:01:23.933 --> 00:01:27.933
Then, on CA Type select the type of your CA Server.

00:01:28.300 --> 00:01:31.166
In this example, it’s ADCS

00:01:31.566 --> 00:01:35.132
Then, enter your server host information.

00:01:35.133 --> 00:01:38.333
For the Key Algorithm, select RSA.

00:01:38.333 --> 00:01:42.099
You can leave the setting of the Key Length to 2048. 

00:01:43.366 --> 00:01:47.366
Enter an authorized user name, password and domain.

00:01:47.766 --> 00:01:49.832
After filling in the required fields,

00:01:49.833 --> 00:01:53.433
click the Test Connection button to check if everything’s right.

00:01:53.666 --> 00:01:56.299
If your configuration is correct you will see

00:01:56.300 --> 00:02:00.300
the following confirmation message: Test Completed. – Select a CA.

00:02:01.100 --> 00:02:06.700
In the Managing CA field, the corresponding SSL certificate automatically shows.

00:02:07.200 --> 00:02:09.633
After clicking Save & Register Template,

00:02:09.633 --> 00:02:12.333
we’re done with registering Certificate Authority

00:02:12.666 --> 00:02:15.966
Let’s move on to add a Certificate template.

00:02:15.966 --> 00:02:22.199
Enter the Template Name. In this example, let’s call it “CompanyMail”

00:02:22.200 --> 00:02:25.333
For Platform, select Android.

00:02:25.333 --> 00:02:30.633
Then select CA server. Here, we are using “CompanyCA”.

00:02:31.000 --> 00:02:36.000
Enter CA Template Name. Yes, we are using CompanyMail

00:02:36.400 --> 00:02:39.566
For the Subject Name, enter CN={Email}

00:02:39.566 --> 00:02:40.966
For the Subject Name, enter CN={Email}

00:02:43.600 --> 00:02:47.866
Then on Certificate Usage select Exchange

00:02:49.433 --> 00:02:53.599
Finally on SAN Type select Email Address and enter {Email} 

00:02:53.600 --> 00:02:57.000
and click the + button.

00:02:58.400 --> 00:03:01.133
When that is done, click Save.

00:03:01.133 --> 00:03:03.766
As certificate has been setup, 

00:03:03.766 --> 00:03:07.766
we can start configuring Samsung email application using Managed Configuration.

00:03:08.400 --> 00:03:11.866
In the left navigation, select Application. 

00:03:11.866 --> 00:03:16.532
Then, on the page that opens click Add.

00:03:16.533 --> 00:03:21.466
After you assign the app to the appropriate group click Set Configuration.

00:03:25.366 --> 00:03:28.599
For Email address field, use the Lookup button

00:03:28.600 --> 00:03:32.300
and find the item Email in the list and click on the name. 

00:03:32.300 --> 00:03:36.833
An appropriate variable will be inserted in the email address field.

00:03:36.833 --> 00:03:42.133
Do the same for User name field, under the list the item User ID.

00:03:42.133 --> 00:03:47.366
In EAS domain field, as with the first two fields, use the Lookup button .

00:03:47.366 --> 00:03:51.366
 and find position Email Domain in the list.

00:03:51.566 --> 00:03:55.466
Enter appropriate values Exchange server name.

00:03:56.433 --> 00:03:59.933
For the field CBA certificate alias enter the name

00:03:59.933 --> 00:04:03.933
of the prepared certificate template.

00:04:06.700 --> 00:04:09.366
We will quickly a create personalize the account name by using valabous 

00:04:09.366 --> 00:04:13.166
first name and last name for this.

00:04:15.400 --> 00:04:19.600
Finally, click Save to finish the app configuration.

00:04:19.600 --> 00:04:23.600
As a final step in create profile configure more policies

00:04:23.600 --> 00:04:25.733
 to your Samsung Email app.

00:04:25.733 --> 00:04:28.399
Let’s start with setting up your profile.

00:04:28.400 --> 00:04:31.100
In the left navigation, click Profile,

00:04:31.100 --> 00:04:33.633
then Add button to create a new profile.

00:04:33.633 --> 00:04:37.133
Remember to create a profile depending on your activation mode. 

00:04:37.633 --> 00:04:42.533
In this example, the mode is Fully Managed Android Enterprise profile.

00:04:42.533 --> 00:04:46.099
When you are done, click Save & Set Policy.

00:04:46.333 --> 00:04:51.533
For example, we'll set a policy that restricts user from making changes to their account.

00:04:51.533 --> 00:04:55.933
Under the Android Enterprise profile menu, click System. 

00:04:55.933 --> 00:04:59.933
Select Disallow in Account Modification.

00:05:01.900 --> 00:05:04.200
The Samsung Email app, when launched,

00:05:04.200 --> 00:05:08.200
by default requires user permission to access memory and contacts. 

00:05:08.200 --> 00:05:12.200
The App Permission setting can grant such permissions automatically.

00:05:12.200 --> 00:05:15.166
You just need to set your permissions to Grant

00:05:16.066 --> 00:05:19.099
To associate this device profile with the certificate

00:05:19.100 --> 00:05:21.733
we’ve registered, click Certificate.

00:05:22.033 --> 00:05:24.533
Enter the name in Configuration ID, 

00:05:24.533 --> 00:05:27.366
then next to Install area set the location 

00:05:27.366 --> 00:05:29.399
where the certificate should be installed.

00:05:29.400 --> 00:05:33.400
For our example, this location is Device.

00:05:33.400 --> 00:05:36.066
For the User Certificate Input method,

00:05:36.066 --> 00:05:38.532
use the Issuing external CA, 

00:05:38.533 --> 00:05:43.633
then in Issuing external CA (Alias) choose the appropriate certificate.

00:05:43.900 --> 00:05:47.266
In our case, this value is CompanyMail.

00:05:47.266 --> 00:05:50.099
The last step is to add an application.

00:05:50.100 --> 00:05:51.633
which the certificate is assigned to.

00:05:51.633 --> 00:05:55.299
Next to the Apps with Delegated Certificate Management field,

00:05:55.300 --> 00:05:57.033
click Add.

00:05:57.366 --> 00:06:00.366
In our example it is the Samsung Email app.

00:06:00.533 --> 00:06:05.766
The final piece of setup is to add the Samsung app to the Device Admin list.

00:06:06.166 --> 00:06:09.932
This setting will allow us to run email account despite blocking the function of adding

00:06:09.933 --> 00:06:11.566
accounts on the device.

00:06:11.800 --> 00:06:16.400
To do this, you need to use the Knox Service Plugin configuration.

00:06:16.400 --> 00:06:19.733
Go to Knox Service Plugin and Device-wide policies, 

00:06:19.733 --> 00:06:19.766
change Enable device policy controls to True

00:06:19.766 --> 00:06:27.732
Find Device Admin allowlisting and again change to True

00:06:27.733 --> 00:06:30.699
for Enable device admin controls.

00:06:31.133 --> 00:06:36.466
Click Add for Allowilisted Das to select Samsung Email app from the list application.

00:06:38.233 --> 00:06:39.866
Click Save & Assign,

00:06:39.866 --> 00:06:44.232
then select EmailCert and click Assign & Apply,

00:06:44.233 --> 00:06:51.366
Apply to finish the profile configuration.

00:06:53.866 --> 00:06:57.866
At this stage, we’ve finished configuring settings for Certificate Authentication

00:06:57.866 --> 00:06:59.799
of the Samsung Email app. 

00:06:59.800 --> 00:07:01.500
When the certificate is pushed,

00:07:01.500 --> 00:07:04.400
user can download it in Knox Manage on the device.

00:07:04.466 --> 00:07:06.932
Then, the Samsung Email app will continue  been installed

00:07:06.933 --> 00:07:09.033
and configured on the device.

00:08:24.233 --> 00:08:26.466
For more information on Knox Manage 

00:08:26.466 --> 00:08:28.799
visit on Knox Admin Guide

00:08:28.800 --> 00:08:30.933
https://docs.samsungknox.com

00:08:31.333 --> 00:08:32.899
Thank for watching!