- Welcome
- Basics
- Device apps
- Overview
- SDK Licenses
- Knox SDK
- Overview
- About the SDK
- What's new
- What's new
- Migrations
- Android 11
- Android Enterprise
- Device admin deprecation
- DA deprecation and Samsung
- DA deprecation and VMware
- FAQs
- FAQ Index
- What is DA Deprecation?
- What is being deprecated with device admin?
- What is API level 29, as it relates to DA deprecation?
- What is the impact of DA deprecation to Knox?
- As a Knox partner, what do I need to do?
- What happens to DA apps when upgraded to Android Q?
- When can I safely upgrade to Android Q?
- What if a device already has Android Q?
- Can my DA app coexist with a UEM app running as DO?
- Are there changes to Knox Configure due to DA deprecation?
- Can I use my DA app alongside Knox Configure?
- Does KME still support device enrollment using DA?
- As DA is not in Android Q, can I enroll via KME to Work Profile?
- Get started
- Sample app tutorials
- Features
- Independent Software Vendors
- ML Developers
- Introduction
- Whitepaper
- Model Protection APIs
- Protect ML model
- ML Encryption Tool
- FAQs
- Are there any additional steps for Linux to give execute permissions to conversion tool?
- Do I to change my app to run the encrypted model?
- Where are the encrypted files saved?
- Which devices support Knox AI for Model Protection?
- Which ML file types are supported by Knox AI for Model Protection?
- Which operating systems (OS) support Knox AI ML Model Conversion Tool?
- Independent Software Vendors (DA)
- MDM Providers
- System Integrators
- VPN Providers
- Storage Providers
- API Reference
- Tools
- FAQs
- FAQ Index
- General
- What is the Samsung Knox SDK?
- Where can I obtain a white paper for Samsung Knox?
- What versions of Android support the Knox SDK?
- How can I check if my device firmware is an engineering or commercial build?
- How can I access the binaries before they are released?
- What is a deprecated API method?
- What are the features by default set to hidden/disabled in ProKiosk mode?
- What are credentials?
- What is Knox TIMA CCM?
- Is Knox supported on other platforms, such as windows?
- Which hardware control features can be managed inside Knox Workspace, using the Knox SDK?
- Why do a few Knox SDK APIs not work on some devices?
- Can Google Play used to deploy Knox apps?
- Can I use managed configurations for Samsung Knox features?
- Can a third-party app use the Knox SDK to get LDAP information?
- How do I enable users to select a 3rd party keyboard?
- How does my device's serial number change with Knox 3.2.1?
- If I don’t use the UCM APIs of the Knox SDK, what are my options for credential storage?
- Installation
- How do I use an SDK packaged as an Eclipse IDE add-on with the Android Studio IDE?
- Is it possible to install an app silently on a device using Knox SDK?
- Why am I still able to download an app even though I have added it to blacklist with the method addAppPackageNameToBlackList(), from the Knox SDK?
- How can an app find out which apps are installed in and outside a container, using the Knox SDK?
- How can an app block the installation of a non-trusted app, using the Knox SDK?
- What does "Security policy prevents installation of this application" mean?
- Can I prevent an end user from installing certificates, with the Knox SDK?
- Does API method installApplication(String packageName) download apps from the play store and install them silently?
- Does the API method setApplicationUninstallationDisabled disable the uninstallation of apps inside the container, when using the Knox SDK?
- Why is the installCertificate API method not successfully installing a certificate on my device?
- Licensing
- How do I use license keys?
- What is the KPE Premium license key and why should I use it?
- What is the backwards compatible key?
- When do I need to use the backwards compatible key?
- Do I need to associate my app with a backwards compatible key?
- How have license key names changed?
- Which keys can be used in combination with each other?
- What is automatic license seat release?
- What are license permissions?
- What is the difference between Standard and Premium permissions?
- How do I declare permissions?
- Deprecated licenses
- Operations
- Are the Knox SDK browser policies applicable to Chrome as well?
- How can an enterprise disable roaming access over an enterprise APN, using the Knox SDK?
- Can an app using the Knox SDK clear an email signature?
- Can I add system or pre-installed app packages, using the Knox SDK, to the notification blacklist?
- Can I use Google push notifications inside a Knox Workspace container?
- Can I use SDP for an app that is outside the Knox container?
- Can multi-window mode be disabled through blocklisting, using the Knox SDK?
- Does my launcher app need a special intent to work in Kiosk mode?
- Does the API method enforceMultifactorAuthentication(), in the Knox SDK, come into effect immediately?
- How can I disable GPS on the device using the Knox SDK?
- How can I move an app from the user's personal mode to the Knox container using an API in the Knox SDK?
- How does the Knox API method EmailPolicy.setAllowEmailForwarding work?
- How does the Knox SDK method, setAllowChangeDataSyncPolicy(), sync contacts with the container so they are visible on the personal side?
- How do I disable the USB port except for charging, using the Knox SDK?
- How do I use the Knox SDK to allow or block phone numbers?
- How do I use the SDK to prevent launching the screen saver when an app is running?
- Is an APN validated when I use the Knox SDK to add it to a device?
- Is it possible to block application access to data while roaming, using the Knox SDK?
- Is there a limit to the number of applications that can be blocked or allowed using the Knox SDK?
- Is there any way to create IMAP, POP, or Exchange accounts in the emulator?
- What does the RCPPolicy.NOTIFICATIONS argument do in the API method setAllowChangeDataSyncPolicy?
- What Keystores can I use?
- What kind of phone numbers are allowed after setting setEmergencyCallOnly(true) in the Knox SDK?
- What secure hardware can I use with the UCM APIs to store credentials?
- What should I do if I find API errors?
- Why are app shortcuts not showing up in Kiosk mode for the Knox SDK?
- Why are Knox Customization policies still active on my device even after my app is uninstalled?
- Why can't you enable the camera inside a container when it is blocked in the personal space?
- Why does the allowOTAUpgrade API method, in the Knox SDK, have no effect when allowFirmwareRecovery() is set to false?
- Why does the API method call setEnableApplication(), using the Knox SDK, disable the app?
- Why does the createVpnProfile method, in the Knox SDK, fail when a Profile name has whitespace?
- Why does the SDK return a NullPointerException when I access the SMS/MMS content URI?
- Why is video recording also blocked when I use the Knox SDK to block audio recording?
- Standard features
- Can I force a device to update to the latest firmware?
- Can multi-window mode be disabled through blacklisting, using the Knox SDK?
- Does the API method setApplicationUninstallationDisabled disable the uninstallation of apps inside the container, when using the Knox SDK?
- What is the difference between hideStatusBar() and hideSystemBar() in the Knox SDK?
- What Knox SDK API methods are available to manage device firmware?
- Why do a few Knox SDK APIs not work on some devices?
- Will the legacy ELM and KLM keys still work with the Knox Platform for Enterprise (KPE) key?
- Premium features
- Customization
- Security
- As a developer, how can I access the device root key?
- Can an app prevent access to specific networks, using the Knox SDK?
- Can fingerprint be used as a substitute for other forms of screen unlock methods, when using the Knox SDK?
- Can I use the Knox SDK to disable the "Unlock Via Google" password unlock option?
- Can I use the Knox SDK to encrypt the SD card?
- Can I use the Knox SDK to modify the fingerprint passcode requirements?
- Does a Knox container enforce authentication by default?
- Do the SDP APIs support a security standard?
- How can I ensure that certificates are stored in the TIMA KeyStore, using the Knox SDK?
- How does SDP secure the cryptographic keys used for data encryption?
- How do you programmatically unlock the container after the maximum amount of failed attempts, using the Knox SDK?
- What does "Security policy prevents installation of this application" mean?
- What is the maximum length allowed for a Wi-Fi SSID, when using the Knox SDK?
- What is the scope of the setPasswordVisibilityEnabled() API method, in the Knox SDK?
- When I call the Knox SDK API method setExternalStorageEncryption, why doesn't the device prompt the user to encrypt?
- Why are HTTPS requests bypassing global proxy settings in the Knox SDK?
- Why doesn't the Knox method "isActivePasswordSufficient" check for forbidden strings?
- Why do I see "Cannot safely connect to server" when I create an email account using SSL??
- Why is my timeout of 15 minutes not working for the resetContainerPassword() method, using the Knox SDK?
- Why is the Knox API method setMaximumTimeToLock() not showing the time I configured?
- SDP
- UCM
- VPN
- VPN Provider
- Does the Knox framework store any type of data passed during profile creation?
- Do I need a license to use the Knox VPN SDK?
- How can I verify if the VPN connection that is starting belongs to the Knox profile or the default Android VPN profile?
- How do I add all apps inside AND outside the container to a VPN profile?
- How is the Knox container affected by VPN On-Premise Bypass?
- How should the network state change be handled by the VPN Client Integration?
- If the framework takes the responsibility of starting the VPN connection, and since it is MDM-controlled, how will the user be able to connect to the VPN if a time-out or networking error occurs?
- Under what circumstances does the framework trigger the start connection?
- What API do I use to create a On-Premise Bypass VPN profile?
- What is VPN On-Premise Bypass?
- When should the various Android VPN service APIs be called?
- Workspace
- Samsung DeX
- Containers
- How does an app detect if a container was created using the Knox SDK?
- How do I install the MDM agent inside the Knox container?
- I have created a "container only mode" container and I am locked inside, using the Knox SDK. How do I exit?
- Why do I get error KnoxContainerManager.ERROR_INTERNAL_ERROR(-1014) while creating a container?
- KBAs
- Knox Tizen SDK
- Overview
- About the SDK
- What's new
- Get started
- Tutorials
- API Reference
- Sample Apps
- FAQs
- FAQ Index
- General
- How is Tizen related to Knox?
- Which devices support the Knox Tizen SDK for Wearables?
- What version of the Tizen SDK should I install before installing the Samsung Knox Tizen SDK for Wearables?
- Should I install any extension SDK before installing the Samsung Knox Tizen SDK for Wearables?
- What are the modes in which you can use the Samsung wearable device?
- What are the supported Wi-Fi security types?
- How do I get the attestation blob?
- What is a nonce and why is it valid for a short time period?
- What is ProKiosk mode?
- Licensing
- Samsung India Identity SDK
- Overview
- About the SDK
- What's new
- Get started
- Features
- API Reference
- Sample Apps
- FAQs
- FAQ Index
- General
- Installation
- Licensing
- Usage
- How do I verify if my device supports Samsung India Identity SDK?
- Should I capture the IRIS image of one or both eyes?
- When do I use the UIDAI Staging server and UIDAI Production server?
- What are the URLs that need to be whitelisted for enterprise-managed devices using the Samsung India Identity SDK APIs?
- Who is impacted by the upgrade of the biometric public devices to registered devices?
- Is there any hardware change required to upgrade the public devices to registered devices?
- What are the application (APK) changes required to upgrade the public devices to registered devices?
- Web services
- Overview
- Cloud Authentication
- Knox Deployment Program
- Knox Mobile Enrollment
- Knox Configure
- Knox Manage
- Knox Attestation
- Knox E-FOTA
- Overview
- About Knox E-FOTA
- What's new
- Get started
- Tutorial
- API Reference
- FAQs
- FAQ Index
- General
- What is Knox Enterprise FOTA (E-FOTA)?
- What are the main features of Knox E-FOTA?
- What industries benefit from Knox E-FOTA?
- Why do enterprise customers need Knox E-FOTA?
- What benefits do MDM developers get from Knox E-FOTA?
- What Samsung devices support Knox E-FOTA?
- Is there a server dedicated to Knox E-FOTA?
- If I sent a request in JSON for Knox E-FOTA, will I receive a JSON return instead of XML?
- Can I use Knox E-FOTA v1 APIs in combination with Knox E-FOTA v2 APIs?
- What is the main difference between FOTA and Knox E-FOTA?
- What types of firmware updates does Knox E-FOTA manage?
- With FOTA, can you skip a firmware version and upgrade to the subsequent version?
- Can I use Knox E-FOTA to set the highest firmware version allowed on multiple devices?
- Does Knox E-FOTA support firmware downgrades?
- Do customers need to have a contract with Samsung to use a site license for Knox E-FOTA?
- How can the FOTA server identify devices that use Knox E-FOTA?
- What are the device requirements for a Knox E-FOTA update?
- Are there any restrictions on what firmware can be downloaded using Knox E-FOTA?
- How can I get release notes for Samsung firmware releases?
- What if a firmware update is performed on a device that has a higher firmware version than the update?
- Is there a way to avoid incurring mobile charges when using Knox E-FOTA?
- What licenses are required to use Knox E-FOTA?
- Can carrier devices use Knox E-FOTA?
- Installation
- Usage
- If I don’t use Knox E-FOTA, what are my options for managing firmware?
- When using Knox E-FOTA, what if a device already has a firmware version higher than the version that we need to update to?
- When using Knox E-FOTA, does a forced firmware update still ask the device user to agree to the update?
- Where can I get release notes for each Samsung firmware version?
- Appendix
- Managed configurations
- Introduction
- Deploy managed configurations
- FAQs
- FAQ Index
- What are managed configurations?
- Why should I use managed configurations?
- How do managed configurations work?
- Can I use managed configurations for Samsung Knox features?
- What is a managed configurations XML schema file?
- Which Samsung apps support managed configurations?
- How do I deploy managed configurations on an MDM console?
- Where can I get the XML schemas for Samsung apps that support managed configurations?
- Is there sample code showing how an MDM web console can deploy an iframe that renders a managed configurations XML schema?
- What email app is preloaded on Samsung devices?
- Knox Service Plugin
- Samsung Email
Samsung DeX and Knox
The Knox SDK provides information on how to use APIs to control Knox-enabled devices running in Samsung DeX.
About Samsung DeX
Samsung DeX is a new user experience that extends the functionality of your Android device to a desktop environment. Simply connect a compatible device to an HDMI monitor with the Samsung DeX Station or DeX pad, and it automatically launches.
Here is an illustration of this process when launched.
DeX APIs
Note, you must be using Knox 3.1 or greater to access the Samsung DeX APIs. Knox 3.0 and below do not have the Samsung DeX APIs built into the framework.
Class | Description |
DexManager | This class provides APIs to control the desktop mode (Dex) |
See the Samsung DeX overview for a full list of the APIs.
Knox 3.3
The Knox 3.3 SDK provides 4 new features to the Samsung DeX device: auto start, on-screen keyboard, open app on DeX display, and set custom wallpaper.
Prerequisites
All devices using these features must have the following minimum requirements:
- Knox v3.3
- Samsung HDMI to USB-C, DeX Pad, and DeX Station
Use the APIs
-
Automatically switch to Samsung Dual mode when a DeX device is connected
- setHDMIAutoEnterState
- getHDMIAutoEnterState
If this API is set to
FALSE
, Screen Mirroring is the default start up mode; orTRUE
and Dual Mode is enabled by default. To use DeX mode, the user can swipe down from the notification panel to turn their device into a keyboard or mouse. -
Show the on-screen keyboard on a device or tablet, even when the physical keyboard is being used in DeX dual mode.
- getShowIMEWithHardKeyboard
- setShowIMEWithHardKeyboard
-
Provide the menu option for users to automatically open the last app they were using when starting or exiting Samsung DeX. This will help the user to continue using an app when docking and undocking a device.
- allowAutoOpenLastApp
- isAutoOpenLastAppAllowed
Parameter
allowAutoOpenLastApp(True); allowAutoOpenLastApp(False); Result In this case, this method supersedes setForegroundModePackageList
and the apps’ behavior is dependent on how the user toggles this allowed setting feature.In the settings, this feature will appear greyed out, and the device user will be blocked from enabling it. To enable this feature, set the apps using the setForegroundModePackageList
API.Note: This API has a dependency on the setForegroundModePackageList API. For more information on foreground vs background apps on Samsung DeX, see the Samsung DeX developer guide. -
Set wallpaper for Samsung DeX while in dual mode.
- setWallpaper
This API supports the any format supported by the BitmapRegionDecoder.
Knox 3.2
Knox 3.2 adds the following new DeX APIs:
setHomeAlignment
: This API allows IT Admins to modify the way apps are aligned in DeX mode. For example, you can align apps in a preferred order. This functionality is perfect for organizations that want to set up numerous identical workstations throughout their organization.addURLShortcut
– This API allows IT Admins to add a browser shortcut with a specific URL on the DeX home screen. This functionality is useful for enterprises that require users to access a URL frequently – for example, an internal Intranet network. A customized icon can also be displayed.
Knox 3.1
You use DeX APIs in the Knox 3.1 SDK to control features such as:
- Enable/disable Samsung DeX Mode
- Set Dex mode screen time out configuration
- allow/disallow screen time out change
- Enforce Ethernet only (block cellular data and WIFI)
- Check if a device is docked on the DeX station
- Disable apps in Dex mode
- Add/Remove application shortcut in Dex mode home screen
- Change Dex loading screen
- Use Ethernet MAC address with device dependent
Example business use case
Adopting Samsung DeX and controlling it with the Knox SDK allows you to capture a larger target audience. For example, you can add in features that further secure a banking app, such as controlling the screen timeout and enforcing a secure Ethernet data connection when the employee is plugged into the dock at work.
Examples
Enable or disable Samsung DeX
You can enable or disable Samsung DeX with a single API: setDexDisabled.
- Create the
object.EnterpriseDeviceManager
- Create the
DeXManager
object - Call
setDeXDisabled
totrue
orfalse
. This API requires the permissioncom.samsung.android.knox.permission.KNOX_DEX.
//create the EnterpriseDeviceManager and DeXManager objects EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context); DexManager mDexManager = edm.getDexManager(); // disable DeX mode mDexManager.setDexDisabled(false);
Allow screen timeout change and then set default time out to 20 minutes
- Create the
object.EnterpriseDeviceManager
- Create the
DeXManager
object - Call
allowScreenTimeoutChange
and set screen out time to true or false.
//create the EnterpriseDeviceManager and DeXManager objects EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context); DexManager mDexManager = edm.getDexManager(); // enable screentimeout mode mDexManager.allowScreenTimeoutChange(true); //set screen timeout in seconds CustomDeviceManager cdm = CustomDeviceManager.getInstance(); DexManager kcdm = cdm.getDexManager(); kcdm.setScreenTimeout(1200);
Set loading logo
- Create the
object.CustomDeviceManager
- Create the
DeXManager
object - Load in the custom boot image. This must be a png.
- Call
setLoadingLogo
with the file path. this API requires the permissioncom.samsung.android.knox.permission.KNOX_CUSTOM_DEX.
//create the Custom Device Manager and DeXManager objects CustomDeviceManager cdm = CustomDeviceManager.getInstance(); DexManager kcdm = cdm.getDexManager(); //Load in image and call setLoadingLogo ParcelFileDescriptor logoFD = ParcelFileDescriptor.open(new File(logoFile), ParcelFileDescriptor.MODE_READ_ONLY); kcdm.setLoadingLogo(logoFD);
Add app shortcut in DeX mode home screen
- Create the
object.CustomDeviceManager
- Create the
DeXManager
object. - Get the package name.
- Call
addShortcut
Pass in the x and y position of the shortcut and the component.com.samsung.android.knox.permission.KNOX_CUSTOM_DEX.
//create the Custom Device Manager and DeXManager objects CustomDeviceManager cdm = CustomDeviceManager.getInstance(); DexManager kcdm = cdm.getDexManager(); //get package name and call addShortcut with app x and y coordinates ComponentName component = new ComponentName("com.android.chrome", "com.google.android.apps.chrome.Main"); kcdm.addShortcut(0, 0, component);
Enforce Ethernet only
- Create the
object.EnterpriseDeviceManager
- Create the
DeXManager
object. - Call
enforceEthernetOnly
and set to true or false. This API requires the permissioncom.samsung.android.knox.permission.KNOX_DEX.
//create the EnterpriseDeviceManager and DeXManager objects EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context); DexManager mDexManager = edm.getDexManager(); // enforce Ethernet only mDexManager.enforceEthernetOnly(true);
App align
- Create the
object.CustomDeviceManager
- Create the
DeXManager
object. - Call
setHomeAlignment
- Specify the align type
- Custom order = VALUE_ORDER_CUSTOM
- Name(A-Z) = VALUE_ORDER_ALPHABETICAL
- Type =VALUE_ORDER_TYPE
CustomDeviceManager cdm = CustomDeviceManager.getInstance(); DexManager kcdm = cdm.getDexManager(); int mode = CustomDeviceManager.ALPHABETIC_GRID; kcdm.setHomeAlignment(mode);
Add URL shortcut to DeX home screen
- Create the
object.CustomDeviceManager
- Create the
DeXManager
object. - Call
addShortcut
and pass in the required parameters.
Parameters | Descriptions |
x | The x position of the URL shortcut. |
y | The y position of the URL shortcut. |
title | The Title of the URL shortcut. |
url | The URL address of the URL shortcut. |
component | The specific component to launch the URL shortcut. |
try { CustomDeviceManager cdm = CustomDeviceManager.getInstance(); DeXManager kcdm = cdm.getDeXManager(); String url = "http://www.naver.com"; ComponentName component = new ComponentName("com.android.chrome", "com.google.android.apps.chrome.Main"); kcdm.addURLShortcut(0, 0, "shortcut", url, component); } catch (SecurityException e) { Log.w(TAG, "SecurityException:" + e); }