Samsung Knox E-FOTA One for OS Updates Management with Intune

Platforms

Android

Products

IntuneSamsung KnoxEntra ID

Result

Samsung devices enroll in Knox E-FOTA from Intune and install only the firmware you pick, on your schedule

Overview

Control which Android firmware your Samsung devices run: sync Intune groups to Knox E-FOTA, push the client with Knox Service Plugin and roll out updates with campaigns.

Samsung Knox E-FOTA (Enterprise Firmware Over-The-Air) controls which Android OS version Samsung devices run. With Knox E-FOTA, devices get their updates from a Samsung business-to-business (B2B) FOTA server instead of the consumer one.

You choose the exact OS version to install, make sure the latest security patches reach devices on a schedule, and hold updates back to test them before they go to users in production.

About half a year earlier I wrote about Samsung Knox Mobile Enrollment (KME) with Microsoft Intune, see that post here. This time I tried Knox E-FOTA (then called Knox E-FOTA One, on a 90-day trial), connected to the Intune tenant that manages my Samsung test devices.

Prerequisites

Before you start, check that you have the following.

The Knox E-FOTA trial and the licence in the console:

Configuration

Register an app in Microsoft Entra ID, connect Knox E-FOTA to Intune, deploy the client, then create a campaign.

Step	Console	What you set
3.1	Entra	App registration for Knox E-FOTA
3.2	Knox	Intune connection and synced device groups
3.3	Intune	Knox E-FOTA client with Knox Service Plugin
3.4	Knox	Firmware campaign and its schedule

Register an app in Microsoft Entra ID

Microsoft Entra admin center

Sign in to the Microsoft Entra admin center and go to App registrations > New registration (see Register an application):

Enter a name (for example Knox E-FOTA) and select the supported account type Accounts in this organizational directory only (single tenant):

Select Register, then copy the Application (client) ID and the Directory (tenant) ID:

Go to Certificates & secrets and create a New client secret for the app:

Enter a description (for example Client Secret for Knox E-FOTA) and an expiry:

Update (October 2026): the Never option shown above is gone. Samsung now tells you to select 24 months, so put a reminder in your calendar to renew the secret (see Prerequisites for connecting to Microsoft Intune).

Copy the secret Value right away, because it's shown only once. You need it in step 2.

Finally, add API permissions for Microsoft Graph:

Add these Microsoft Graph application permissions (Samsung's current list, two more than I used in 2021):

Device.Read.All
User.Read.All
Group.Read.All
GroupMember.Read.All
DeviceManagementManagedDevices.Read.All

Then select Grant admin consent for your organization. The status changes to Granted (see Grant tenant-wide admin consent):

Connect the Knox E-FOTA console to Intune

Samsung Knox Admin Portal

First make sure you have Microsoft Entra ID groups (dynamic device groups) that collect your Samsung devices. In my test I have two groups to sync from Intune:

• Samsung Galaxy A10 devices
• Samsung Galaxy A8 devices

Dynamic membership rules give you the granularity you need, for example all Samsung Galaxy A10 devices:

(device.deviceManufacturer -eq "samsung") and (device.deviceModel -eq "SM-A105FN")

Next, open Knox E-FOTA from the Samsung Knox Admin Portal:

Accept the Terms and Conditions on the first launch:

Service activation can take several days. For me it happened the same day, probably because I already had a Samsung account with other services like KME:

Connect EMM syncs devices from Intune:

Note: I followed Samsung's guide Add device groups from Microsoft Intune.

Enter the details from step 1:

• Application (client) ID
• Directory (tenant) ID
• Client secret value

If the connection works, you see your Microsoft Entra ID groups. Select only the groups you need and select Add E-FOTA Groups. Knox E-FOTA syncs the groups from Intune every 24 hours (in 2021 it was every 6 hours), and you can also select Sync now (see About EMM groups):

Note: when a device is in a synced group, it's registered with Samsung's B2B FOTA server, which handles its firmware updates from then on.

After the sync, the devices show up in the console as Not enrolled:

Before devices can enroll in Knox E-FOTA, assign licenses to the synced groups:

Without a license, devices can't activate with the client app:

When that's done, the devices are ready to enroll and their status is Enrollment pending:

Note: for the meaning of each status, see Manage devices.

Deploy the Knox E-FOTA client with Knox Service Plugin

Intune admin center

Devices enroll in Knox E-FOTA when the Knox E-FOTA client app is installed and launched on them. There are a few ways to install it (see Install and launch the Knox E-FOTA client):

• New devices from OOBE (Android 9 or later): the client installs and launches automatically during setup, configured with Knox enrollment profiles.
• Devices already enrolled in Intune: Knox Service Plugin (KSP) with an OEMConfig profile from Intune downloads and launches the client for the user, so the device enrolls automatically. You can also push the client through managed Google Play.

Before you create the OEMConfig profile, approve the Knox Service Plugin app in managed Google Play so it syncs to Intune (see Set up KSP with a UEM).

This is the policy for the Knox E-FOTA client:

Select Knox Service Plugin as the OEMConfig app:

Under Device-wide policies (Device Owner), set:

• Enable device policy controls: True
• Firmware update (FOTA) policy: Configure

Select Next and set:

• Enable firmware controls: True
• Enable E-FOTA client installation & launch: True

Assign this OEMConfig policy to the Samsung device groups that have Knox E-FOTA licenses.

The enrollment status in Knox E-FOTA changes to Enrolled, but the devices still need a configuration, called a campaign.

Create a campaign and assign it

Samsung Knox Admin Portal

A campaign is the policy with the Knox E-FOTA settings. Go to Campaigns and select Create Campaign:

Note: Samsung's steps are in Create a campaign.

Configure these settings:

• Basic info
• Schedule (campaign period, firmware download and installation period)
• Network and speed (for example Wi-Fi only, or any network)
• Device condition (battery level needed for the installation)
• Factory reset (blocks factory reset on the device)
• Support contact details

Under EMM groups, assign the campaign to a group synced from Intune:

The testing section below also shows what a device looks like before a campaign is assigned.

Result

Finally, check the enrollment and the campaign on a Samsung device.

I tested on a Samsung Galaxy A10 (Android 10) that Intune already managed as an Android Enterprise fully managed device.

Right after the OEMConfig policy arrived, the user was asked to activate the Knox license, and enrollment in Knox E-FOTA started:

Note: if the device has no Knox E-FOTA license, the step that downloads and applies the policy fails before the privacy policy screen.

No campaign was assigned to this device yet, so it says Enrolled and not Campaign active:

The Knox E-FOTA console shows the two active devices that got the OEMConfig policy and installed the client app:

After I assigned the campaign to the group, the status on the phone changed to Campaign active:

The Knox E-FOTA admin fully controls the firmware on the device: select the version you want in the campaign and push it to the device:

Note: it can take up to 24 hours before Select from firmware list appears: