Samsung Knox bulk enrollment

To enroll multiple Samsung Knox devices into Endpoint Management (or any mobile device manager) without manually configuring each device, use Knox Mobile Enrollment. The enrollment occurs upon first-time use or after a factory reset. Admins can also pass user names and passwords directly to the device, so users don’t need to enter any information upon enrollment.

Note:

The setup for Knox Mobile Enrollment is not related to the Endpoint Management Knox container. For more information on Knox Mobile Enrollment, see the Knox Mobile Enrollment Admin Guide.

Prerequisites for Knox Mobile Enrollment

  • Endpoint Management must be configured (including licenses and certificates) and running.
  • Secure Hub APK file. You upload the file when setting up Knox Mobile Enrollment.
  • For a list of KME requirements, see the Knox Mobile Enrollment Introduction.

To download the Secure Hub APK file

  1. Log in to the Citrix download site and go to the Citrix Endpoint Management downloads.

  2. Go to Mobile productivity apps and MDX Toolkit and choose your edition.

  3. Download the Citrix Secure Hub for Android file.

Configure firewall exceptions

To access Knox Mobile Enrollment, configure the following firewall exceptions. Some of these firewall exceptions are required for all devices and some are specific the device’s geographical region.

Device Region URL Port Destination
All https://gslb.secb2b.com 443 Global load balancer for Knox Mobile Enrollment initiation
All https://gslb.secb2b.com 80 Global load balancer for Knox Mobile Enrollment initiation on some limited legacy devices
All umc-cdn.secb2b.com 443 Samsung agent update servers
All bulkenrollment.s3.amazonaws.com 80 Knox Mobile Enrollment customer EULAs
All eula.secb2b.com 443 Knox Mobile Enrollment customer EULAs
All us-be-api-mssl.samsungknox.com 443 Samsung servers for IMEI verification
United States https://us-segd-api.secb2b.com 443 Samsung Enterprise Gateway for US region
Europe https://eu-segd-api.secb2b.com 443 Samsung Enterprise Gateway for European region
China https://china-segd-api.secb2b.com 443 Samsung Enterprise Gateway for China region

Note:

You can find a full list of firewall exceptions in the Knox Mobile Enrollment Admin Guide.

Getting access to Knox Mobile Enrollment

Follow Samsung documentation to get access to Knox Mobile Enrollment at Get started with KME.

Setting up Knox Mobile Enrollment

After you get access to Knox Mobile Enrollment, log in to the Knox portal.

The enrollment process follows these general steps.

  1. Create an MDM profile with your MDM console information and settings.

    The MDM profile indicates to your devices how to connect to your MDM.

  2. Add devices to your MDM profile.

    You can either upload a CSV file with device information or install and use the Knox deployment app from Google Play.

  3. Samsung alerts you when device ownership is verified.

  4. Provide users with MDM credentials. Instruct them to connect to the Internet using Wi-Fi and to accept the prompt to enroll their device.

To create an MDM profile

Follow the steps outlined in Samsung documentation on Profile Configuration.

When you encounter the following fields or steps, configure them as described:

  • Pick your MDM: Select Citrix from the menu. Only for device owner profiles.
  • MDM Agent APK: Only for device owner profiles. Type the Secure Hub APK download URL. For example:

    https://example.com/zdm/securehub.apk

    https://pmdm.mycorp-inc.net/zdm/securehub.apk

    The APK file can reside on any server that the devices can access during enrollment. During the enrollment, a device downloads Secure Hub from that URL, installs Secure Hub, and then opens Secure Hub with the custom JSON data described next.

    The capitalization of the .apk file name must match the URL you enter. For example, if the file name is all lowercase, it must also be all lowercase in the URL.

  • MDM Server URI: Do not specify an MDM server URI. Endpoint Management does not use the Samsung MDM protocol.
  • Custom JSON Data: enter the Endpoint Management server address, user name, and password in the format: {"serverURL": "URL", "xm_username":"Username", "xm_password":"Password"}

    Examples:

    {"serverURL":"https://example.com/zdm", "xm_username":"userN", "xm_password":"password1234"} {"serverURL":"https://pmdm.mycorp-inc.net/zdm", "xm_username":"james.cork", "xm_password":"aDin20_1fa"}

    You can also enter custom JSON for zero-touch enrollment for Android Enterprise.

         {
             "android.app.extra.PROVISIONING_ADMIN_EXTRAS_BUNDLE":
             {
                 "serverURL":"URL","xm_username":"username","xm_password":"password"
             }
         }
    

When a device starts bulk enrollment, the device uses the profile data. First, the device downloads Secure Hub from the given URL, installs Secure Hub, and opens Secure Hub with the custom JSON data as parameter. Secure Hub already has the Endpoint Management address, so Secure Hub doesn’t need to prompt for it. Enrollment occurs automatically, since the JSON file provides credentials as well.

Further configuration

See the following Samsung documentation pages for more information on configuration:

To enroll devices running a Knox API earlier than version 2.4

On devices that have Knox API earlier than version 2.4, bulk enrollment does not work out of the box. Therefore, users must initiate enrollment by going to a Samsung site to download the new Mobile Enrollment client and start the enrollment.

The downloaded enrollment client uses the same MDM profile and APKs configured in the Knox Bulk enrollment portal for the Knox 2.4/2.4.1 devices.

Users typically follow these steps:

  1. Turn on the device and connect to Wi-Fi. If the Mobile Enrollment doesn’t start or Wi-Fi is not available, do the following:

    1. Go to Samsung Knox Mobile Enrollment.

    2. Tap the Next button to enroll devices with mobile data.

  2. When the prompt Enroll with Knox appears, tap Continue.

  3. Read the EULAs (if available). Tap Next.

  4. If prompted, enter the User ID and Password provided by the IT administrator.

At this point, the user credentials are validated and their device is enrolled in your organization’s enterprise IT environment.

Enable and disable biometric authentication for Samsung devices

Endpoint Management allows you to enable and disable biometric authentication (fingerprint and iris scan authentication) for Samsung devices without requiring any action from users. If you disable biometric authentication in Endpoint Management, users and third-party apps cannot enable the feature.

  1. In the Endpoint Management console, click Configure > Device Policies. The Device Policies page appears.

  2. Click Add. The Add New Policy page appears.

  3. Click Passcode. The Passcode Policy information page appears.

  4. In the Policy Information pane, enter the following information:

    • Policy Name: Type a descriptive name for the policy.
    • Description: Optionally, type a description of the policy.
  5. Click Next. The Platforms page appears.

  6. Under Platforms, select Android or Samsung Knox.

  7. Set Configure biometric authentication to ON.

  8. If you selected Android, under Samsung SAFE, select Allow fingerprint or Allow Iris or both.

    The Configure biometric authentication option