Get started with Knox Mobile Enrollment

Knox Mobile Enrollment is an automated enrollment tool that helps you bulk-enroll corporate devices right out of the box. This tutorial walks you through the basics of setting up and using Knox Mobile Enrollment. By the end, you’ll have learned how to:

• Access the Knox Mobile Enrollment console.
• Add devices to your Knox account.
• Create and assign an enrollment profile to provision your devices.
• Complete enrollment on your devices.

Prerequisites

Before proceeding with this tutorial, ensure you have the following:

• Access to the Knox Admin Portal. For information on how to apply for access, see Create a Samsung account.
• Samsung devices running an appropriate Knox version. Knox solutions are supported on the last five major Android versions, including the latest version. For the most up-to-date list of devices, see Devices secured by Knox.
• The correct firewall exemptions to allow network communication with the Knox Mobile Enrollment server.
• A supported geographic location. To ensure Knox Mobile Enrollment is available in your region, see Supported locations.
• If you wish to enroll your devices into an EMM, ensure you have an EMM provider that supports Knox Mobile Enrollment. For an up-to-date list of EMMs that meet Samsung’s enterprise-grade requirements, Knox partner solutions. If your EMM solution isn’t listed, you’ll need to manually enter your EMM agent APK when creating an enrollment profile.

In addition, you may need a Knox Suite Plan. Although a license isn’t required to use Knox Mobile Enrollment, if you want to use Advanced settings, you’ll need a valid Knox Suite - Enterprise Plan license.

Step 1: Access the Knox Mobile Enrollment console

To access the Knox Mobile Enrollment console:

1. Sign in to the Knox Admin Portal.
2. Click Knox Mobile Enrollment > Dashboard in the navigation pane.

Step 2: Add devices

Once you can access the Knox Mobile Enrollment console, you can add your device IMEIs to the console. The simplest way to do this is by getting your Samsung-approved reseller to upload the devices on your behalf:

1. Register your reseller in the Knox Admin Portal.
2. Once your reseller uploads devices to the console on your behalf, you must approve them on the UPLOADS tab of the Devices page.

Step 3: Create an enrollment profile

After you’ve added devices to the console, create an enrollment profile:

1. Under Knox Mobile Enrollment, navigate to the Profiles page. You’ll be redirected to the common Enrollment profiles page.
2. On the Enrollment profiles page, click Create profile.
3. On the Create enrollment profile page, enter your basic profile information and select the EMM and Knox cloud services for which to enable out-of-box-experience (OOBE) enrollment:
   1. EMM — Select to use the enrollment profile to enroll devices to your MDM, EMM, or UEM.
      • (Optional) You can install the Knox Service Plugin app on your devices alongside your EMM. For more information, see the Knox Service Plugin guide. This setting is automatically selected as it may be required to set Samsung device policies in your EMM. You can disable this option, if required.
   2. If you also use other Knox services, select the service to install the app on your devices.
      • Knox E-FOTA — Select to use the enrollment profile to enroll devices to Knox E-FOTA. As part of OOBE, installs the Knox E-FOTA app on the device.

        To be able to manage firmware on devices using Knox E-FOTA, you’ll need to create and assign campaigns to the enrolled devices.

      • Knox Asset Intelligence — Select to use the enrollment profile to enroll devices to Knox Asset Intelliegence. As part of OOBE, installs the Knox Asset Intelligence app on the device.

        To use Knox Asset Intelligence, please ensure that your devices are enrolled into an EMM.

4. If you’ve selected EMM, configure your standard profile settings.
   • If you’re enrolling devices into an EMM, your EMM provider may require custom JSON configurations for the Device Policy Controller (DPC) app. Consult your EMM provider to obtain the required configurations, as the format may differ.
   • You can enroll devices into an EMM using a QR code. This feature isn’t available for other Knox services.
5. (Optional) Configure any advanced settings you wish to apply.
6. Review the profile:
   • Click Create profile to skip profile assignment. Select this option if you wish to assign profiles to devices at a later date, or plan on using QR code enrollment.
   • Click Create and assign to assign the newly created profile to your devices.

Step 4: Assign profiles

After you create an enrollment profile, you can assign it to your devices.

You can assign a profile:

• At the end of the profile creation process.
• At a later time, on either the Knox Mobile Enrollment or common device list. This is suitable for assigning profiles to small device fleets.
• Using bulk actions. This is recommended if you’re assigning profiles for large device fleets.

Assign a profile from the Knox Mobile Enrollment console

To assign a profile through Knox Mobile Enrollment:

1. On the Devices page, select the device(s) you wish to assign the profile to. If you’re assigning profiles to large device fleets, see Manage devices in bulk.
2. Click Actions > Configure devices to open the device details panel.
3. On the device details panel, click the Enrollment profile drop-down menu to select an existing profile you want to assign the devices to, then click SAVE.

Assign a profile from the common device list of the Knox Admin Portal

To assign a profile through the common device list:

1. On the common Devices page, select the device(s) you wish to assign the profile to. If you’re assigning profiles to large device fleets, we recommend you use bulk actions instead.
2. Click Actions > Assign enrollment profile. The common Assign enrollment profile page opens.
3. Select a profile to assign to the selected devices, then click Assign.

Once a profile is assigned, the device user can turn on and enroll the device.

Step 5: Enroll your devices

To complete enrollment, the device user simply needs to turn on the device and follow a series of on-screen instructions.

Depending on the size of your device fleet and whether or not you purchased the devices from a reseller, you can use the following enrollment methods:

• Out-of-box experience (OOBE) — Ideal for large device fleets. Suitable for enrolling reseller-uploaded devices.
• QR code — Best suited for manual enrollment of small device fleets. Suitable for devices uploaded by you or your reseller.

Enroll using Out-of-box experience (OOBE)

The out-of-box experience (OOBE) allows you to enroll your devices straight into your Knox services after unboxing or factory-resetting the device. For more information, see Out-of-box experience (OOBE).

Enroll using a QR code

Knox Mobile Enrollment allows you to enroll devices running Android 10 or higher using a QR code. To enroll a device using a QR code, make sure the Add QR code setting is enabled for your enrollment profile.

Once you finish creating the profile, a unique QR code is generated. You can either print it or download it to share with device users. For more information, see QR code.

Update a profile

You can only assign one enrollment profile to a device. To update your profile settings on a device that has already completed enrollment, you can either:

• Edit the enrollment profile, then assign it to the device again.
• Unassign the existing profile, then create and assign a new enrollment profile to the device. To streamline this process, you can duplicate an existing enrollment profile.

To apply the changes after assigning a new profile, you must factory reset the device.

Next steps

Once a user completes enrollment on their device, the device’s Status updates to Provisioned in the Devices table.

You now know how to launch Knox Mobile Enrollment and enroll devices. For more information on how to use the console, review our how-to guides or watch the how-to video. If you require assistance, you can reach out to the support team by submitting a support ticket in the Knox Admin Portal.