Tenant domains

Knox Guard customers are organized into domains based on their use case. Domains provide an organized and secure way to enable specialized permissions, and allow us to recommend optimal features for your business operations.

Currently, there are four domains available in Knox Guard: Device Financing, Device Insurance, Enterprise, and Other.

Knox Guard domains

Each domain is defined by its mandatory, optional, and recommended features, tailored to its specific use case. Depending on security needs, some domains may grant access to specialized features, such as Hardened Security mode. Regardless, basic Knox Guard features are available to all domains.

Device Financing

The Device Financing domain is designed for use cases where a device is financed to an end user. This includes financial institutions or carriers that want to run installment businesses using remote locking solutions, and carriers that want to lock-in their own plans in connection with subsidies.

If you’re enrolled in the Device Financing domain, you can:

• Use various messaging and lock features to encourage installment payments.
• Restrict device usage to specific operators or SIM cards.
• Install a payment app that can run from the lock screen during service registration.
• Design diverse operational policies to encourage installment payments, such as blocking specific applications* or restricting a device’s wallpaper*.
• Optionally block Android Debug Bridge (adb) communication and access to the Developer options menu.
• Display installment service related messages to customers during Knox Guard enrollment.

Required features

When a device is added to the Device Financing domain, several features are applied by default:

• Hardened Security mode — Additional security mechanisms are applied to supported devices.
• Offline device lock — If you’re a Normal tenant, you must set the Offline device lock policy. By default, devices are configured to lock after they’ve been offline for three days. You can adjust this setting as needed.

  This feature doesn’t apply to Pay-as-you-go (PAYG) tenants.

• Block Android Enterprise provisioning — By default, Android Enterprise provisioning is restricted on all device uploads. You can configure this setting through the Actions menu on the Devices page, or by using the Knox Guard API.
• Device restart — After Knox Guard is successfully activates, the device restarts.

Devices with hardened security architecture can’t be added to a non-financing customer’s tenant if they’ve previously been enrolled in the Device Financing domain, even after device management is complete. However, they can be re-enrolled into any financing domain.

To activate Knox Guard after re-enrolling a device with hardened security architecture, device users must navigate to guard.samsungknox.com on a browser on their device.

Hardened Security mode

When financed devices enroll in Knox Guard, a unique set of security hardening mechanisms and policies are applied by default to deter hacking. This is referred to as Hardened Security mode.

Hardened Security mode is supported on devices with hardened security architecture. This includes the Samsung Galaxy S26 and all subsequent device releases¹. The Galaxy A17 LTE is also supported as an exception. This feature is mandatory for device financing customers, and can’t be reversed once applied to a device.

If you’re unsure about whether this advanced functionality is suitable for your specific use case, you can review the security mechanisms and key features in the Hardened Security mode admin guide.

Device Insurance

The Device Insurance domain is designed for companies or personal device protection providers who want to protect customer data for lost devices, and reduce compensation payouts from fraudulent insurance claims.

If you’re enrolled in the Device Insurance domain, you can:

• Remotely lock lost or stolen devices to prevent information leakage.
• Complete­­ly wipe device information on locked devices*.
• Display insurance service related messages to customers during Knox Guard enrollment.

Enterprise

The Enterprise domain is designed for customers who want to distribute corporate devices to their employees.

If you’re enrolled in the Enterprise domain, you can:

• Lock devices that haven’t been returned after employees retire.
• Complete­­ly wipe device information on lost devices to protect corporate data*.
• Send messages to employees using notifications.

Other

If you aren’t sure which domain to select, the Other tenant domain enables you to use Knox Guard for business purposes that aren’t covered by another domain.

Depending on your specific use case, a Samsung admin can separately enable the features you need.

Selecting a domain

Following their introduction in January 2026, new and existing customers are now asked to select a domain. Selecting a domain is quite simple, and can only be done once.

New customers

If you’re new to Knox Guard, you’ll be asked to select a domain at the end of the registration process.

On the Domain selection screen, read through the available options, then select the domain that best suits your business needs.

If you wish to enroll in the Device Financing domain, a few extra steps are required. For more information, see the Enroll into the Device Financing domain section.

Once you’ve confirmed your domain selection, your application is sent to the Samsung Knox team for approval. You’ll receive an email confirmation when your application is approved.

Existing customers

If you’re an existing Knox Guard customer, your tenant’s super admin will be asked to select a domain the first time they sign in to the console.

Depending on your previous tenant type, different options are available:

• Normal — Device Financing, Device Insurance, Enterprise, Other
• Pay-as-you-go (PAYG) — Device Financing

Customers with the PAYG tenant are automatically assigned the Device Financing domain. If you’re a Normal tenant, you can select between the Device Financing, Device Insurance, Enterprise, and Other domains as needed. If you select Other, you’ll use your current settings— no changes are applied.

If you’re not ready to select a domain, click Finish later on the Domain selection screen to defer this choice to a later date. You can return to this screen by clicking Finish domain selection on the banner that appears at the top of the Knox Guard console. Super admins who haven’t selected a domain yet will continue to see this pop-up every time you access the Knox Guard console, but you’ll still be able to continue to use Knox Guard as usual, even without selecting a domain.

If you wish to enroll in the Device Financing domain, a few extra steps are required.

Enroll into the Device Financing domain

When you enroll into the Device Financing domain, you’ll need to complete a few more steps.

If you’ve selected the Device Financing domain:

1. On the Financing domain setup: Hardened Security mode page, review the features offered by Hardened Security mode.

2. Enter a phone number or email address that device users can refer to for customer support. If you’ve already configured the Offline device lock policy, this field automatically completes with your customer support details.

3. Review the agreement and confirm you wish to enable Hardened Security mode on your devices. You must also select either:

   • Apply Hardened Security mode — Hardened Security mode will be enabled on all supported devices that are already in your account, as well as all future eligible device uploads.

     To apply Hardened Security mode, users will be asked to restart their device.

   • Don’t apply Hardened Security mode — Hardened Security mode won’t be applied to eligible devices that are already in your account. It’ll still apply to all future eligible device uploads. You can also choose to apply Hardened Security mode to existing eligible devices at a later date on the Policies page.

4. Click Confirm and continue.

5. On the Confirm Financing domain pop-up, click OK to confirm your choice. This action is irreversible.