# Samsung Knox Mobile Enrollment

Knox Mobile Enrollment is an enrollment method that streamlines the enrollment of Samsung Knox devices into MDM solutions. It allows admins to enroll the Samsung devices out-of-the-box by performing a one-time setup. In addition to automating device enrollment, Samsung Knox Mobile Enrollment facilitates the apps, documents and profiles to be distributed to the device upon enrollment to simplify device provisioning.

Only devices purchased from authorized resellers can be enrolled using Samsung Knox Mobile Enrollment.

**Note:** BYOD Samsung devices (profile owner devices) can be enrolled using [Invite enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_enrollment_by_email_invite.html) and [Self enrollment](https://www.manageengine.com/mobile-device-management/help/enrollment/mdm_byod.html).

[![ ](https://www.manageengine.com/mobile-device-management/help/images/Samsung_knox_enrollment_video_thumbnail.png)](https://www.manageengine.com/mobile-device-management/demo/samsung-knox-enrollment-with-mdm-video.html)

**We have made your job simpler!**

Learn how to perform out-of-the-box Samsung Knox Mobile Enrollment using MDM, **in under 5 minutes** through [this demo video](https://www.manageengine.com/mobile-device-management/demo/samsung-knox-enrollment-with-mdm-video.html).

There are 4 stages in Knox Device Enrollment, they are:

- [Creating a Knox Account](#Creating_Knox_Account)
- [Integrating with MDM](#integrating)
- [Adding Devices](#adding)
- [User Assignment](#assign)

## Creating Knox Account

A Knox account is required to leverage Samsung Knox enrollment for enrolling Samsung devices into MDM. To create a Samsung Knox account, refer [this](https://www2.samsungknox.com/en/user/register/kme).

## Integrating with MDM

After creating the Knox enrollment, follow the steps given below to integrate MDM with the Knox enrollment portal to initiate enrollment:

1. On the [Samsung Knox Enrollment portal](https://central.samsungknox.com/), login with your Knox account credentials.
2. Click on **Profiles** under the Knox Mobile Enrollment tab and select **Create Profile**.
3. Select **Android Enterprise** as the profile type. This will ensure the devices enrolled using Knox Enrollment are automatically provisioned as Device Owner. **Device Admin** is the legacy management method and hence it is recommended to select **Android Enterprise** as the profile type.
4. Specify the name of the profile, select **ManageEngine** as the MDM.
5. Specify the server to which the devices should be added upon enrollment under **MDM Server URI**.
6. On the KME portal, under MDM Agent APK, specify the link to download the agent app on devices automatically after enrollment. You can choose to install the latest ME MDM app version publicly available in the Play Store or the stable app version hosted in our server.
7. Navigate to **Enrollment -> Knox Mobile Enrollment** and select the **Management Type**.  
   **Full Device Management:** Admin has full control over the device.  
   **Workspace Management:** Admin can manage only the corporate apps and data by creating a separate work container on the device.
8. Copy the text available beside **Custom JSON data** and paste it on the Knox portal.
9. You can also enable **Dual DAR** for improved security. Additional licenses must be purchased to enable Dual DAR.
10. Under the **Enrollment screens** section, enable both:  
    **"Show all Android Enterprise setup screens"** and **"Show setup wizard after EMM enrollment"**.  
    This prompts the user to enable **Location Accuracy Services** during setup to improve the precision of location-based features.
11. Click on **Next** and then **Create** to complete the integration.

## Adding Devices

**Devices purchased from verified Resellers:**

Admins can automate the device upload by entering the **Reseller Details** and provide the resellers with their **Customer ID**. This will allow the resellers to assign the devices purchased from them directly to the organization's account. Follow the steps given below to add the reseller details:

1. Click on the **Resellers** tab on the Knox Mobile Enrollment portal.
2. Click on **Register Reseller** and enter the Reseller ID. Click on **Look Up** to select the reseller associated to the specified Reseller ID.
3. Any devices added by these resellers need to be approved. You can choose to automatically approve and assign specific profiles to these devices by checking **Automatically approve all devices uploaded by this reseller** and selecting the required profile.
4. Click on **Save** to save the reseller details and configured settings.

If you have not selected auto-approval of devices, the devices will be available in **Device -> Uploads**. You can download the device list as a CSV file and specify the profiles to be associated to the devices and upload it back on the Knox Mobile Enrollment console.

**Devices which are not purchased from verified Resellers:**

The [Knox Deployment App](https://docs.samsungknox.com/admin/knox-configure/how-to-guides/about-the-knox-deployment-app/) provides the flexible option to IT admins needing to enroll end-user devices without having a reseller. The Knox Deployment App is a mobile application available from the Google Play Store that is uniquely designed to help streamline the enterprise deployment of Samsung phones and tablets running Knox 2.8 or higher.  
**Note:** The Knox Deployment App does not support the enrollment of Samsung devices without Knox.

1. Configure a [profile](https://www.manageengine.com/mobile-device-management/help/enrollment/knox_mobile_device_management.html#integrating:~:text=refer%20this.-,Integrating%20with%20MDM,-After%20creating%20the) in KME portal for forwarding devices to our MDM.
2. Install this Knox Deployment App on an administrator's Android device. Login using the Knox admin account, and configure the Knox Deployment App to use the profile created in KME portal.
3. Choose a deployment mode: [NFC](https://docs.samsungknox.com/admin/knox-configure/how-to-guides/about-the-knox-deployment-app/#nfc-deployment), [Bluetooth](https://docs.samsungknox.com/admin/knox-configure/how-to-guides/about-the-knox-deployment-app/#bluetooth-deployment), and [Wi-Fi Direct](https://docs.samsungknox.com/admin/knox-configure/how-to-guides/about-the-knox-deployment-app/#wi-fi-direct-deployment).
4. **NFC:** You bump this admin's device with the devices that need to be enrolled, and they'll get the profile and enrollment is complete.
5. **Bluetooth/Wi-Fi Direct:** Set an expiry time, and any device that connects to this admin's device and goes to the URL specified in the Knox Deployment App can get the profile, and enrollment is complete.

**Note:**

Logging into the Knox Deployment App adds the Samsung account in the device settings. If there are any other Samsung accounts already present, then they have to remove it. However, this case is not applicable for the admin's device.

## User Assignment

After the devices are added to the MDM server, they'll be available in **Enrollment -> Knox Mobile Enrollment**. Admins can complete the enrollment by assigning these devices to users either individually or in bulk using the CSV file. You can also automate user assignment by enabling the users to enter their directory service credentials upon device activation. You can optionally select a [Group](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_creating_groups.html) to which the devices will be added upon enrollment. This will help automate the distribution of apps, documents and profiles to devices.

To assign users, follow the steps given below:

- On the MDM server, click on **Enrollment** from the top menu and select **Knox Mobile Enrollment**, from the left pane.
- All the devices enrolled via Knox Enrollment but yet to be assigned users are listed here.
- You can assign users on a device-to-device basis, by clicking on the **Assign User** option present under **Action**. You can also assign users in bulk, by clicking on the **Assign Users** button present above the table and uploading a **CSV file**, based on the specifications given [here](https://www.manageengine.com/mobile-device-management/help/enrollment/knox_mobile_device_management.html#csv).

### Automate User Assignment

- To automate user assignment, select **User** for the option **Device to be activated by**.
- If you haven't configured a directory service, you will be prompted to [configure directory services](https://www.manageengine.com/mobile-device-management/help/configuring_mobile_device_manager/mdm_integrate_active_directory.html). Mobile Device Manager Plus supports multiple directory services:
  - Active Directory
  - Entra ID (formerly Azure AD)
  - G Suite
  - Okta

If you are using MDM Cloud, [Zoho Accounts](https://www.manageengine.com/mobile-device-management/help/configuring_mdmp_cloud/integrating_active_directory_with_mdm/integrate_microsoft_on_premises_ad.html) is the default directory service used for authentication. You can also choose to configure Active Directory or Entra ID (formerly [Azure AD](https://www.manageengine.com/mobile-device-management/help/configuring_mdmp_cloud/mdm_integrate_azure_active_directory_ad.html)) for authentication.

### Sample CSV Format

```
USER_NAME,DOMAIN_NAME,EMAIL_ADDRESS,PLATFORM_TYPE,OWNED_BY,GROUP_NAME,UDID
ANDREW,,andrew@mobiledevicemanagerplus.com,iOS,Personal,IOS_Group,00f0ba8f7a6c41cca9cc5fd6b7ee666b
```

**Note:**

1. The CSV file should contain the following fields: User Name, Domain Name, Email Address, Platform Type, Owned By, Group Name and UDID.
2. UDID is applicable only for iOS devices.
3. The fields User Name, Email Address and Platform Type are mandatory. All the other fields are optional. If not provided, default values are taken.
4. The default values for various non-mandatory fields are:  
   Domain Name -- MDM  
   Owned By -- Corporate  
   Group Name -- Default Group for given Owned By & Platform Type.
5. The first line of the CSV is the column header and the columns can be in any order.
6. Blank column values should be comma separated.
7. If the column value contains a comma, it should be specified within quotes.

## Removing devices from Knox Mobile Enrollment

One of the major benefits for IT admins in enrolling devices using Samsung Knox Mobile Enrollment is that users cannot remove the ME MDM app from Samsung devices to unmanage them. If the organization needs to remove MDM from Samsung devices enrolled using Knox Mobile Enrollment, they can be removed from the Samsung Knox portal.

Follow the steps given below to remove devices enrolled using Samsung Knox Mobile Enrollment:

1. Login to the Samsung Knox portal.
2. Select [Samsung Knox Mobile Enrollment](https://www.samsungknox.com/en/solutions/it-solutions/knox-mobile-enrollment) and click on **Devices**.
3. Select the device and click on **Actions**.
4. If you select the **Clear profile** option, the profiles imposed on the device will be removed. The device will not be enrolled under MDM management after this.
5. If you select the **Delete device** option, the device details will be erased from the Samsung Knox portal.

If the devices need to be enrolled again through Knox Mobile Enrollment, the reseller needs to be informed to add the devices again to the Knox portal.

To retire a device completely, it needs to be manually removed from the Samsung Knox portal as well.