- Platforms
- Android
- Products
- IntuneSamsung KnoxEntra ID
- Result
- A Samsung device bought from a reseller enrolls in Intune as a fully managed Android Enterprise device at first boot
Overview
Connect Samsung Knox Mobile Enrollment to Microsoft Intune, create the enrollment profile with the Intune token, add devices, and watch a Samsung phone enroll as fully managed.
Knox Mobile Enrollment (KME) is an automated, enforced enrollment method for Samsung devices that supports Android Enterprise (fully managed, dedicated and corporate-owned work profile devices). Many MDM platforms support KME, including Microsoft Intune, Omnissa Workspace ONE UEM (formerly VMware, AirWatch) and Citrix Endpoint Management. Samsung devices also support Google zero-touch enrollment; KME adds Samsung-specific options.
Like zero-touch, KME is free and available in most countries after a free registration with a work email address and a Samsung account for your company.
In this post I connect Knox Mobile Enrollment to Microsoft Intune to provision corporate-owned Android Enterprise devices automatically.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Intune Plan 1 for each user (included in Microsoft 365 E3 and E5) | Licensing |
| Knox Mobile Enrollment is free; only its advanced settings need a Knox Suite Enterprise plan | KME FAQ | |
| Admin role | Policy and Profile Manager in Intune for Android Enterprise enrollment profiles; Intune Administrator to connect Managed Google Play | Roles |
| Intune | MDM authority set to Intune and the tenant connected to Managed Google Play (with a Microsoft Entra account since August 2024) | Managed Google Play |
| An enrollment profile and token for fully managed, dedicated or corporate-owned work profile devices | Fully managedDedicatedWork profile | |
| Samsung Knox | A Knox Admin Portal account with a work email; approval can take 1 to 2 business days, in supported countries | Get startedLocations |
| Devices uploaded by a Samsung reseller, or enrolled with a QR code (Android 10 and later) | ResellersReseller program | |
| Devices | Samsung devices on the KME list; Intune needs Android 10 or later for fully managed and work profile, Android 8 or later for dedicated, Knox 3.0 or later | KME devicesSupported platforms |
Configuration
Get the Intune token first, then create the profile in the Knox portal.
| Step | Console | What you set |
|---|---|---|
| 3.1 | Intune | Android Enterprise enrollment token |
| 3.2 | Knox | Knox Mobile Enrollment service |
| 3.3 | Knox | KME profile with the Intune token |
| 3.4 | Knox | Devices from a reseller or QR code, profile assigned |
Get the enrollment token in Intune
Intune admin center
Before you configure KME in the Samsung portal, get an enrollment token in Intune for the Android Enterprise mode you want:
In 2020, with the tenant already connected to Managed Google Play, I turned on fully managed enrollment by setting Allow users to enroll corporate-owned user devices to Yes:
Update (October 2026): that toggle no longer exists. In the Intune admin center (intune.microsoft.com), go to Devices > Enrollment > Android > Android Enterprise > Enrollment Profiles and open Corporate-owned, fully managed user devices. Intune creates a Default Fully Managed Profile with its token. On the profile's Token page, Export token gives you the JSON for KME (see Set up fully managed devices).
In 2020 I copied the token from the Corporate-owned, fully managed user devices page:
Open Knox Mobile Enrollment
Samsung Knox Admin Portal
Samsung Knox has several services (KME, Knox Manage, Knox Configure, E-FOTA and more). In 2020 you launched KME from the Knox Suite dashboard:
Update (October 2026): the portal is now the Knox Admin Portal, and KME profiles are on the shared Enrollment page, PROFILES tab. Since KME 25.07, older KME profiles were migrated to enrollment profiles (see KBA-1622).
The first time you open KME, a Get Started wizard explains the first steps, such as creating a profile:
Create the enrollment profile
Samsung Knox Admin Portal
The profile sets the enrollment settings and user experience on Samsung devices:
In 2020 there were two profile types: Device Owner (Android Enterprise) and Device Admin (legacy Android). Under Device Owner profile details, I entered the profile name, picked Microsoft Intune as the MDM and selected Continue:
Update (October 2026): the profile type choice is gone (device administrator is deprecated). The wizard now has Basic info (profile name, select EMM), EMM info (company name, support contact, Select your EMM, Link to agent APK, which fills in automatically for Intune), Configure device settings and Review (see Create an enrollment profile).
Under the device settings, select Leave all system apps enabled (recommended) and enter your company name, which users see before enrollment starts.
The JSON field (called Custom JSON in 2020, now DPC extras) holds the Intune enrollment token. Microsoft treats it as required, even though the Knox portal shows it as optional:
Paste the token in this format:
{"com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "<your-enrollment-token>"}
Create the profile. For the other settings (DualDAR, QR code enrollment, root and intermediate certificates, advanced settings), see Samsung's Create an enrollment profile.
Add devices and assign the profile
Samsung Knox Admin Portal
There are two ways to add devices to Knox Mobile Enrollment:
- Automatically, through a Samsung-approved reseller that uploads the devices you buy (for the out-of-box experience)
- With QR code enrollment (Android 10 and later), which also works for devices no reseller uploaded
Devices uploaded by a reseller appear under Devices > UPLOADS, where you approve them:
You can turn on auto-approve and assign a default profile to reseller uploads (reseller preferences), so the process is fully automatic.
In 2020 I added an existing Samsung device, not bought from a reseller, with the Knox Deployment App (KDA). It appeared under Devices > ALL DEVICES:
KDA had three deployment modes (Bluetooth, NFC, Wi-Fi Direct), and you picked the profile while provisioning the device:
Update (October 2026): current KME documentation names only reseller upload and QR code enrollment, and the KDA documentation pages are gone. Samsung ended KDA for Knox Guard in November 2024 (see KBA-1348), and the KME FAQ says to use QR code enrollment for devices not bought from a reseller.
To use QR code enrollment, turn it on in the profile. Users with Android 10 or later scan the code and follow the steps on screen:
Note: this Samsung QR code is different from the QR code in the Intune admin center for Android Enterprise enrollment without KME.
User Experience
A Samsung phone connects to Wi-Fi at first boot and enrolls in Intune.
1. Select the language and tap the start arrow, then select Skip this for now on Bring your old data:
2. On Choose a Wi-Fi network, select a network and enter the password:
Note: the message says the phone is protected by the Knox Cloud Service and must connect to Wi-Fi or a mobile network to continue.
3. On Set up your device, read the Samsung Knox and Google privacy policies and tap Accept & continue:
4. After Google Play Store updates, tap Accept & continue on the Chrome welcome screen:
5. Sign in with your Microsoft Entra ID (formerly Azure AD) account:
6. The device sets up. Tap Install to install two required work apps:
- Microsoft Intune, the app for fully managed devices
- Microsoft Authenticator, for sign-in with MFA (on fully managed devices it is installed automatically and can't be removed)
7. Tap Next, then Start to register the device with Intune:
8. The Microsoft Intune app opens. Tap Sign in, enter your password and tap Register:
9. When registration finishes, you see You're ready for work!:
10. The device is now a fully managed Android Enterprise device:
In the Intune admin center (intune.microsoft.com), the device shows as corporate-owned and fully managed:
