After writing a few blog articles last April about Android (Enterprise) management with Microsoft Intune, it`s now time to take a look at Samsung Knox Mobile Enrollment (KME). Samsung KME provides a solution which is familiar to Android Zero Touch Deployment, but (off course) fully focused on Samsung Devices;
The admin or the reseller registers the Android devices in the Samsung KME portal. The end-user switches on the (new) Android device, connects it to the internet and the Android device downloads the configuration profile from KME. In combination with Microsoft Intune, the device is enrolled in Intune after the end-user authenticates with the Azure AD credentials and receives the assigned configuration policies and applications and is ready to start using the device without the admin touching the device.
In this blog article I will describe how to setup Samsung Knox Mobile Enrollment to enroll the devices in Microsoft Intune as (Android Enterprise) Corporate-owned, Fully managed user device. I will not describe in further detail how to link your Managed Google Play account with Intune, you can read those steps in a previous article. In this example I enroll the device in Intune as Corporate-owned, Fully managed user device, the steps involved to set this up in Intune can be found here.
Setup Samsung Knox Mobile Enrollment
I assume you have already created a Samsung account, if not go to this portal and create one.
Sign-in to the Samsung Knox portal. There are a lot of options on the dashboard, but for now we are only interested in Knox Mobile Enrollment. If you haven`t already applied for KME, click Apply now.
- Check I have read and agree…
- Click Submit application
Now you need to wait until the registration for KME is approved. My approval was done within the hour, but sometimes it could take a few days and you even might be contacted by phone to discuss why you need KME.
When registration is finished, go back to the Samsung Knox portal and under Knox Mobile Enrollmend click Launch Console.
Because it`s the first time we open the KME console, we need to take some steps to setup KME.
- Click Start
- Select Server URI not required for MDM
- Click Continue
On this page we setup our first MDM Profile. With this profile we make sure our devices are enrolled in Intune as a Corporate-owned, Fully managed user device.
- Give the enrollment profile a Name
- Give the profile a Description (optional)
- Click Add support contact
- Enter your Company Name
- Enter your Company Address (optional)
- Enter Support Phone Number
- Enter Support Email Address
- Click Save
- Back at the profile page click Add MDM Applications
Here we need to enter the URL to the APK which needs to be downloaded during enrollment. For enrollment in Intune as Android Enterprise device that URL is https://aka.ms/intune_kme_deviceowner.
- Enter https://aka.ms/intune_kme_deviceowner
- Click Save
After providing the APK URL we get some more options.
- Check Enable this app as Google Device Owner
- Choose Microsoft Intune as Supported MDM
- Make you decision to Leave all system apps enabled (or remove them)
The last part of setting up our enrollment profile is to fill in the custom JSON data on the right site of the page. By filling in this configuration, we make sure our devices are directed to the correct enrollment profile in Intune. When you don`t fill in this information, your users need to scan the QR code from the corresponding Intune enrollment profile during enrollment.
The format for Intune, Android Enterprise is:
{“com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN”: “Enter Intune enrollment token string”}
Replace Enter Intune enrollment token string with the token you find in Intune above to QR Code (located under Device Enrollment, Android enrollment, Corporate-owned, Fully managed user devices).
When you use the token from a Corporate-owned, dedicated device, the device is enrolled as dedicated device.
When finished click Save profile.
On the next page you can fill in information about your reseller. This allows you reseller to register devices at Samsung Knox which you purchased and assign it a default enrollment profile. I highly advise to give your reseller these right to register your devices, so you as an admin don`t have to register the devices yourself. You can setup a reseller at a later moment.
- Click Skip
- Click Next
You are presented the Knox Mobile Enrollment dashboard. It`s now time to ask your reseller to register your purchased Samsung devices to your account. Or you can register the devices yourself as I will show you next.
Manually register devices with the Knox Deployment app
When you have existing devices which cannot be registered by a reseller to your Samsung account, you have the option to register the devices manually using the Samsung Knox Deployment app.
To get started with this process, download the app from the Google Play Store on a Android device and sign-in.
Sorry for the Dutch printscreens.
- Select the enrollment Profile we just created in the KME portal
- Click Deployment mode
We have three deployment modes; Bluetooth, NFC and Wi-Fi Direct. In my example I used NFC as I found that the easiest way. Select the Deployment mode of choice.
Click Start deployment
If you have chosen to use NFC, you only have to ‘ bump’ both devices to get the profile deployed to the device which needs to be registered. Acknowledge the enrollment on the existing Samsung device.
When the deployment is finished, switch back to the KME portal. On the Devices tab, you see the device is registered and the profile is assigned.
End-user experience
Now that everything is setup in the Samsung Knox portal and maybe you have also created a Android Enterprise configuration profile in Intune, it`s time to have a look at the end-user experience.
After connecting the device to the internet, the device will check for updates.
It will show a message the device will be setup. You have to accept the Terms and conditions and click Next.
The device setup is started.
The device is downloading the Google Play Store.
Click Accept & Continue to accept the terms of Chrome.
Now it`s time to authenticate with your Azure AD username and password.
Setting up device
Click Please click here to continue
By default the Microsoft Authenticator and Microsoft Intune apps are installed when the device is enrolled as Corporate-owned, Fully managed user device.
The last step is applying policies.
When the last step is finished, the user is sign-in to the device and enrollment is finished!
3 Comments
Hi Peter,
Thanks for this article. I am unable to get a trial for my lab started without a proper company name/URL and contact info, so I’m hoping to check with you on something. Eventually I’ll be doing a trial of KME with a client, but until then this is a mystery.
Samsung’s guide mentions that the KDA allows us to forego needing to factory reset the devices (https://docs.samsungknox.com/admin/knox-mobile-enrollment/about-kda.htm – 2nd paragraph in the “About” section). However, Microsoft Intune’s documentation says a factory reset is a must (https://docs.microsoft.com/en-us/mem/intune/enrollment/android-samsung-knox-mobile-enroll#frequently-asked-questions – 3rd FAQ). I realize with Android Enterprise device owner enrollment types (Fully Managed, Dedicated, and COPE), the usual answer is that a Factory Reset is required, since it is from the OOBE that we enter afw#setup to get started with enrollment.
So I feel like Samsung’s statement in the link above is purely referring to Android Device Administrator deployments, which we know are now legacy and Android Enterprise is the proper way to go. Just trying to find out if indeed the KDA can allow devices to enroll into Android Enterprise Fully Managed, without factory resetting. Any idea?
Thanks in advance.
Hi Jeremy,
The Android Enterprise configuration types you`re referring to, indeed require a factory reset for existing devices. So does Samsung KME for these types of managed devices. I indeed think the documentation of Samsung refers to Android Device admin.
Hello,
I have a small question about Android Knox Enrollment, checking your two enrollment guides online I see that in the old one you use MS url for the APK : “https://aka.ms/intune_kme_deviceowner”” which is also what is on MS guides, and on this guide using “https://play.google.com/managed/downloadManagingApp?identifier=setup”” e.g. :
How to easily enroll Android Corporate with Work profile devices with Microsoft Intune and Samsung Knox ME | Peter Klapwijk – In The Cloud 24-7 (inthecloud247.com)
Setup Samsung Knox Mobile Enrollment to enroll Android devices in Microsoft Intune | Peter Klapwijk – In The Cloud 24-7 (inthecloud247.com)
We are enrolling to Intune MDM, using the Company Owned Work Profile,
I have 2 questions:
What is difference between these 2 URL for APK, are there any benefits or options one has the other not?
I am asking this also in regard to the step-in enrollment when the device is installing Work Apps, I know Intune and Authenticator are installed by default but where do I add more apps “Additional Apps” as I have not seen this option in our Knox,
This might be a Microsoft Question but maybe you know, When Microsoft Authenticator gets installed during enrollment it also automatically configures an Authentication Profile do you from where is that Profile is configured from?
Thanks