- Welcome
- Basics
- Device apps
- Overview
- Knox licenses
- Knox SDK
- Overview
- About the SDK
- What's new
- What's new
- Migrations
- Android 11
- Android Enterprise
- Device admin deprecation
- DA deprecation and Samsung
- DA deprecation and VMware
- FAQs
- FAQ Index
- What is DA Deprecation?
- What is being deprecated with device admin?
- What is API level 29, as it relates to DA deprecation?
- What is the impact of DA deprecation to Knox?
- As a Knox partner, what do I need to do?
- What happens to DA apps when upgraded to Android Q?
- When can I safely upgrade to Android Q?
- What if a device already has Android Q?
- Can my DA app coexist with a UEM app running as DO?
- Are there changes to Knox Configure due to DA deprecation?
- Can I use my DA app alongside Knox Configure?
- Does KME still support device enrollment using DA?
- As DA is not in Android Q, can I enroll via KME to Work Profile?
- Get started
- Sample app tutorials
- Features
- Independent Software Vendors
- ML Developers
- Introduction
- Whitepaper
- Model Protection APIs
- Protect ML model
- ML Encryption Tool
- Knox ML Encryption Tool Revision
- FAQs
- Are there any additional steps for Linux to give execute permissions to conversion tool?
- Do I to change my app to run the encrypted model?
- Where are the encrypted files saved?
- Which devices support Knox for Model Protection?
- Which ML file types are supported by Knox for Model Protection?
- Which operating systems (OS) support Knox ML Model Conversion Tool?
- Independent Software Vendors (DA)
- MDM Providers
- System Integrators
- VPN Providers
- Storage Providers
- API Reference
- Tools
- FAQs
- FAQ Index
- General
- What is the Samsung Knox SDK?
- Where can I obtain a white paper for Samsung Knox?
- What versions of Android support the Knox SDK?
- How can I check if my device firmware is an engineering or commercial build?
- How can I access the binaries before they are released?
- What is a deprecated API method?
- What kind of support is offered after an API is deprecated?
- Why were the API classes deprecated?
- What are the features by default set to hidden/disabled in ProKiosk mode?
- What are credentials?
- What is Knox TIMA CCM?
- Is Knox supported on other platforms, such as windows?
- Which hardware control features can be managed inside Knox Workspace, using the Knox SDK?
- Why do a few Knox SDK APIs not work on some devices?
- Can Google Play used to deploy Knox apps?
- Can I use managed configurations for Samsung Knox features?
- Can a third-party app use the Knox SDK to get LDAP information?
- How do I enable users to select a 3rd party keyboard?
- How does my device's serial number change with Knox 3.2.1?
- If I don’t use the UCM APIs of the Knox SDK, what are my options for credential storage?
- What are the changes in Samsung Calendar data sharing in Knox SDK 3.8?
- What are the alternative Google APIs for Samsung Knox Wi-fi deprecation?
- Installation
- How do I use an SDK packaged as an Eclipse IDE add-on with the Android Studio IDE?
- Is it possible to install an app silently on a device using Knox SDK?
- Why am I still able to download an app even though I have added it to blacklist with the method addAppPackageNameToBlackList(), from the Knox SDK?
- How can an app find out which apps are installed in and outside a container, using the Knox SDK?
- How can an app block the installation of a non-trusted app, using the Knox SDK?
- What does "Security policy prevents installation of this application" mean?
- Can I prevent an end user from installing certificates, with the Knox SDK?
- Does API method installApplication(String packageName) download apps from the play store and install them silently?
- Does the API method setApplicationUninstallationDisabled disable the uninstallation of apps inside the container, when using the Knox SDK?
- Why is the installCertificate API method not successfully installing a certificate on my device?
- Licensing
- How do I use license keys?
- What is the KPE Premium license key and why should I use it?
- What is the backwards compatible key?
- When do I need to use the backwards compatible key?
- Do I need to associate my app with a backwards compatible key?
- How have license key names changed?
- Which keys can be used in combination with each other?
- What is automatic license seat release?
- What are license permissions?
- What is the difference between Standard and Premium permissions?
- How do I declare permissions?
- Deprecated licenses
- Operations
- Are the Knox SDK browser policies applicable to Chrome as well?
- How can an enterprise disable roaming access over an enterprise APN, using the Knox SDK?
- Can an app using the Knox SDK clear an email signature?
- Can I add system or pre-installed app packages, using the Knox SDK, to the notification blacklist?
- Can I use Google push notifications inside a Knox Workspace container?
- Can I use SDP for an app that is outside the Knox container?
- Can multi-window mode be disabled through blocklisting, using the Knox SDK?
- Does my launcher app need a special intent to work in Kiosk mode?
- Does the API method enforceMultifactorAuthentication(), in the Knox SDK, come into effect immediately?
- How can I disable GPS on the device using the Knox SDK?
- How can I move an app from the user's personal mode to the Knox container using an API in the Knox SDK?
- How does the Knox API method EmailPolicy.setAllowEmailForwarding work?
- How does the Knox SDK method, setAllowChangeDataSyncPolicy(), sync contacts with the container so they are visible on the personal side?
- How do I disable the USB port except for charging, using the Knox SDK?
- How do I use the Knox SDK to allow or block phone numbers?
- How do I use the SDK to prevent launching the screen saver when an app is running?
- Is an APN validated when I use the Knox SDK to add it to a device?
- Is it possible to block application access to data while roaming, using the Knox SDK?
- Is there a limit to the number of applications that can be blocked or allowed using the Knox SDK?
- Is there any way to create IMAP, POP, or Exchange accounts in the emulator?
- What does the RCPPolicy.NOTIFICATIONS argument do in the API method setAllowChangeDataSyncPolicy?
- What Keystores can I use?
- What kind of phone numbers are allowed after setting setEmergencyCallOnly(true) in the Knox SDK?
- What secure hardware can I use with the UCM APIs to store credentials?
- What should I do if I find API errors?
- Why are app shortcuts not showing up in Kiosk mode for the Knox SDK?
- Why are Knox Customization policies still active on my device even after my app is uninstalled?
- Why can't you enable the camera inside a container when it is blocked in the personal space?
- Why does the allowOTAUpgrade API method, in the Knox SDK, have no effect when allowFirmwareRecovery() is set to false?
- Why does the API method call setEnableApplication(), using the Knox SDK, disable the app?
- Why does the createVpnProfile method, in the Knox SDK, fail when a Profile name has whitespace?
- Why does the SDK return a NullPointerException when I access the SMS/MMS content URI?
- Why is video recording also blocked when I use the Knox SDK to block audio recording?
- Standard features
- Can I force a device to update to the latest firmware?
- Can multi-window mode be disabled through blacklisting, using the Knox SDK?
- Does the API method setApplicationUninstallationDisabled disable the uninstallation of apps inside the container, when using the Knox SDK?
- What is the difference between hideStatusBar() and hideSystemBar() in the Knox SDK?
- What Knox SDK API methods are available to manage device firmware?
- Why do a few Knox SDK APIs not work on some devices?
- Will the legacy ELM and KLM keys still work with the Knox Platform for Enterprise (KPE) key?
- Premium features
- Customization
- Security
- As a developer, how can I access the device root key?
- Can an app prevent access to specific networks, using the Knox SDK?
- Can fingerprint be used as a substitute for other forms of screen unlock methods, when using the Knox SDK?
- Can I use the Knox SDK to disable the "Unlock Via Google" password unlock option?
- Can I use the Knox SDK to encrypt the SD card?
- Can I use the Knox SDK to modify the fingerprint passcode requirements?
- Does a Knox container enforce authentication by default?
- Do the SDP APIs support a security standard?
- How can I ensure that certificates are stored in the TIMA KeyStore, using the Knox SDK?
- How does SDP secure the cryptographic keys used for data encryption?
- How do you programmatically unlock the container after the maximum amount of failed attempts, using the Knox SDK?
- What does "Security policy prevents installation of this application" mean?
- What is the maximum length allowed for a Wi-Fi SSID, when using the Knox SDK?
- What is the scope of the setPasswordVisibilityEnabled() API method, in the Knox SDK?
- When I call the Knox SDK API method setExternalStorageEncryption, why doesn't the device prompt the user to encrypt?
- Why are HTTPS requests bypassing global proxy settings in the Knox SDK?
- Why doesn't the Knox method "isActivePasswordSufficient" check for forbidden strings?
- Why do I see "Cannot safely connect to server" when I create an email account using SSL??
- Why is my timeout of 15 minutes not working for the resetContainerPassword() method, using the Knox SDK?
- Why is the Knox API method setMaximumTimeToLock() not showing the time I configured?
- SDP
- UCM
- VPN
- VPN Provider
- Does the Knox framework store any type of data passed during profile creation?
- Do I need a license to use the Knox VPN SDK?
- How can I verify if the VPN connection that is starting belongs to the Knox profile or the default Android VPN profile?
- How do I add all apps inside AND outside the container to a VPN profile?
- How is the Knox container affected by VPN On-Premise Bypass?
- How should the network state change be handled by the VPN Client Integration?
- If the framework takes the responsibility of starting the VPN connection, and since it is MDM-controlled, how will the user be able to connect to the VPN if a time-out or networking error occurs?
- Under what circumstances does the framework trigger the start connection?
- What API do I use to create a On-Premise Bypass VPN profile?
- What is VPN On-Premise Bypass?
- When should the various Android VPN service APIs be called?
- Workspace
- Samsung DeX
- Containers
- How does an app detect if a container was created using the Knox SDK?
- How do I install the MDM agent inside the Knox container?
- I have created a "container only mode" container and I am locked inside, using the Knox SDK. How do I exit?
- Why do I get error KnoxContainerManager.ERROR_INTERNAL_ERROR(-1014) while creating a container?
- KBAs
- Knox POS SDK
- Knox Tizen SDK
- Overview
- About the SDK
- What's new
- Get started
- Tutorials
- API Reference
- Sample Apps
- FAQs
- FAQ Index
- General
- How is Tizen related to Knox?
- Which devices support the Knox Tizen SDK for Wearables?
- What version of the Tizen SDK should I install before installing the Samsung Knox Tizen SDK for Wearables?
- Should I install any extension SDK before installing the Samsung Knox Tizen SDK for Wearables?
- What are the modes in which you can use the Samsung wearable device?
- What are the supported Wi-Fi security types?
- How do I get the attestation blob?
- What is a nonce and why is it valid for a short time period?
- What is ProKiosk mode?
- Licensing
- Samsung India Identity SDK
- Overview
- About the SDK
- What's new
- Get started
- Features
- API Reference
- Sample Apps
- FAQs
- FAQ Index
- General
- Installation
- Licensing
- Usage
- How do I verify if my device supports Samsung India Identity SDK?
- Should I capture the IRIS image of one or both eyes?
- When do I use the UIDAI Staging server and UIDAI Production server?
- What are the URLs that need to be whitelisted for enterprise-managed devices using the Samsung India Identity SDK APIs?
- Who is impacted by the upgrade of the biometric public devices to registered devices?
- Is there any hardware change required to upgrade the public devices to registered devices?
- What are the application (APK) changes required to upgrade the public devices to registered devices?
- Web services
- Managed configurations
- Introduction
- Deploy managed configurations
- FAQs
- FAQ Index
- What are managed configurations?
- Why should I use managed configurations?
- How do managed configurations work?
- Can I use managed configurations for Samsung Knox features?
- What is a managed configurations XML schema file?
- Which Samsung apps support managed configurations?
- How do I deploy managed configurations on an MDM console?
- Where can I get the XML schemas for Samsung apps that support managed configurations?
- Is there sample code showing how an MDM web console can deploy an iframe that renders a managed configurations XML schema?
- What email app is preloaded on Samsung devices?
- Knox Service Plugin
- Samsung Email
Manage COM and CL Workspaces
Create a container
To create a Knox container, you only need to call one API as follows.
KnoxContainerManager.createContainer("knox-b2b");
There are different types of containers you can create, depending on your needs. To change the container type, replace the knox-b2b
string with your required container type.
When you push the container, the user must complete a series of steps on the phone to complete to process.
Remove a container
To remove a Knox container do as follows.
EnterpriseContainerManager.removeContainer(containerId, new RemoteStatusCallback());
Choose the container UI layout
You can customize the "knox-b2b"
UI to appear as a folder containing apps or as a desktop with app launcher icons.
To do this, use setContainerLayout
, which accepts the layout types:
CONTAINER_LAYOUT_TYPE_FOLDER
CONTAINER_LAYOUT_TYPE_CLASSIC
To prevent end users from changing this UI layout through the Knox Settings menu, use allowLayoutSwitching(boolean allow)
.
Handle container error messages
Register a broadcast receiver.
By default, the container creation process does not provide any error messages. To see error messages, you must create a broadcast receiver and receive INTENT_CONTAINER_CREATION_STATUS
through a toast message.
This call returns the CREATION_STATUS_CODE
, which you can use to determine the type of error you are receiving.

public class SampleContainerReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { String action = intent.getAction(); if (action.equals(KnoxContainerManager.INTENT_CONTAINER_CREATION_STATUS)) { Bundle extras = intent.getExtras(); int statusCode = extras.getInt(KnoxContainerManager.CONTAINER_CREATION_STATUS_CODE); if (statusCode > 0) { Toast.makeText(context, context.getString(R.string.created_container, statusCode), Toast.LENGTH_LONG).show(); } else { switch (statusCode) { case KnoxContainerManager.ERROR_FILESYSTEM_ERROR: Toast.makeText(context, context.getString(R.string.error_filesystem), Toast.LENGTH_LONG).show(); break; case KnoxContainerManager.ERROR_NO_ADMIN_APK: Toast.makeText(context, context.getString(R.string.error_no_admin_apk), Toast.LENGTH_LONG).show(); break; case KnoxContainerManager.ERROR_MAX_LIMIT_REACHED: Toast.makeText(context, context.getString(R.string.error_max_limit_reached), Toast.LENGTH_LONG).show(); break; case KnoxContainerManager.ERROR_INTERNAL_ERROR: Toast.makeText(context, context.getString(R.string.error_internal), Toast.LENGTH_LONG).show(); break; case KnoxContainerManager.CONTAINER_CREATION_IN_PROGRESS: Toast.makeText(context, context.getString(R.string.error_creation_in_progress), Toast.LENGTH_LONG).show(); break; case KnoxContainerManager.ERROR_CREATION_CANCELLED: Toast.makeText(context, context.getString(R.string.container_cancelled), Toast.LENGTH_LONG).show(); break; default: Toast.makeText(context, context.getString(R.string.unknown_error), Toast.LENGTH_LONG).show(); break; } } } } }
Examples
Create a container with custom settings
Here is a sample use case that creates a Knox container and sets up an email account.
- Create Knox container.
- Create the EnterpriseKnoxManager and Knox Container Manager objects.
- Call emailAccountPolicy.addNewAccount with required configurations.
KnoxContainerManager.createContainer("knox-b2b"); EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(ctx); KnoxContainerManager kcm = ekm.getKnoxContainerManager(KnoxContainerManager.getContainers().get(0)); EmailAccountPolicy emailAccountPolicy = kcm.getEmailAccountPolicy() emailAccountPolicy.addNewAccount(new EmailAccount( "testemail@gmail.com","pop3","pop.gmail.com", 995, "testemail@gmail.com", null,"smtp", "smtp.gmail.com",465, "testemail@gmail.com",null));
Create COM container with default settings
This sample use case creates a COM container with the default settings.
- Create a Knox container using the Container Only Mode.
- Call hideSystemBar() to hide the system bar.
KnoxContainerManager.createContainer("knox-b2b-com"); KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance().getKnoxContainerManager(context, containerid); KioskMode kMode = kcm.getKioskMode(); kMode.hideSystemBar(true);
Clone a COM container
You can also create and customize a container with the clone method. When you clone a container, you select one of the default container types and then add your desired features to it. For example, you may want to change the default password length from 8 characters to 4, or add some custom apps upon creation.
- Create a new
KnoxConfigurationType
. - Install the Calendar and Contacts apps:
- Hide the system bar:
- Create the custom COM container:
- Disable an app such that it is not visible on the launcher:
- Install an app from SD card:
- Install an app that is already downloaded or sideloaded onto the device:
KnoxConfigurationType typeobj = KnoxContainerManager.getConfigurationTypeByName("knox-b2b-com"); KnoxConfigurationType newType = typeobj.clone("custom-b2b-com"); List<String> appList = new ArrayList<String>(); appList.add("com.android.calendar"); appList.add("com.android.contacts"); newType.setAppInstallationList(appList); if(newType instanceOf ContainerModeConfigurationType){ newType.setHideSystemBar(true); } KnoxContainerManager.addConfigurationType(Context, newType); KnoxContainerManager.createContainer("custom-b2b-com"); KnoxContainerManager kcm = EnterpriseKnoxManager.getInstance().getKnoxContainerManager(context, containerid); ApplicationPolicy aPolicy = mcm.getApplicationPolicy(); aPolicy.setDisableApplication("<app package name>"); KnoxContainerManager mcm = EnterpriseKnoxManager.getInstance().getKnoxContainerManager(context, containerid); ApplicationPolicy aPolicy = mcm.getApplicationPolicy(); aPolicy.installApplication("/mnt/sdcard/test.apk", true/false); KnoxContainerManager mcm = EnterpriseKnoxManager.getInstance().getKnoxContainerManager(context, containerid); ApplicationPolicy aPolicy = mcm.getApplicationPolicy(); aPolicy.installApplication("package name");