How to re-enroll devices in Knox Guard

Environment

• Knox Guard
• Devices with hardened security architecture¹

Overview

When you no longer need to use Knox Guard to secure a device, you can complete device management. This removes all applied policies, deactivates the Knox Guard client, and stops device tracking and oversight. However, in situations where you need to secure these devices again, you can re-activate Knox Guard as needed.

To activate Knox Guard on a device again, you must complete specific steps based on the device’s previous enrollment history; depending on the domain the device was originally enrolled in, restrictions may apply. This article provides the guidelines and procedures for registering and activating devices previously enrolled in Knox Guard.

Device enrollment guidelines

Starting with 26.01, customers can select a domain for their account. When a device with hardened security architecture¹ is enrolled in the Device Financing domain, Hardened Security mode is applied to the device by default. As a result, certain restrictions can apply when you attempt to enroll these devices into Knox Guard again.

• Devices with hardened security architecture¹ can’t be added to a non-financing domain if they’ve previously been enrolled in the Device Financing domain, even after device management is complete.
• Once you enroll a device into the Device Financing domain, you can add the device only to this domain in the future.

As such, you are free to re-enroll devices across all other domains, as long as the devices haven’t been previously enrolled in the Device Financing domain. This includes devices added to legacy tenants without a domain.

How to activate devices previously enrolled in Knox Guard

Activate Knox Guard on financing devices

To activate Knox Guard on a device that’s been re-enrolled in the Device Financing domain:

1. Add the device to your Knox Guard account. If the device was previously enrolled by a different Knox Guard customer, ensure it’s been removed from their account.

2. Accept the device in Knox Guard console. The device’s status changes to Activating.

3. To enroll the device, the device user must navigate to guard.samsungknox.com on a browser on the device. If activation is successful, the device’s status changes to Active in the Knox Guard console.

   Enrolling devices through a URL requires additional permissions. Contact your Samsung admin to obtain the appropriate permissions for your tenant.

Activate Knox Guard on non-financing devices

To activate Knox Guard on any non-financing device that’s been enrolled again:

1. Add the device to your Knox Guard account. If the device was previously enrolled by a different Knox Guard customer, ensure it’s been removed from their account.

2. Accept the device in Knox Guard console. The device’s status changes to Activating.

3. Factory reset the device. When the device boots up and connects to a network, Knox Guard activation automatically begins.

   You can also enroll a non-financing device by navigating to guard.samsungknox.com on a browser on the device. However, enrolling devices through a URL requires additional permissions. Contact your Samsung admin to obtain the appropriate permissions for your tenant.

Additional information

If you’re having trouble activating Knox Guard enrollment on your device, see How to activate a device in Knox Guard.