Close Menu
Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Facebook X (Twitter) Instagram
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    • Home
    • Intune
    • Windows
      • Modern Workplace
    • macOS
    • Android
    • iOS
    • Automation
      • Logic Apps
      • Intune Monitoring
      • GitHub
    • Security
      • Passwordless
      • Security
    • Speaking
    • About me
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Home»Android»How to easily enroll Android Corporate with Work profile devices with Microsoft Intune and Samsung Knox ME
    Android

    How to easily enroll Android Corporate with Work profile devices with Microsoft Intune and Samsung Knox ME

    Peter KlapwijkBy Peter KlapwijkMarch 13, 2021Updated:March 13, 202185 Mins Read

    Since last year Microsoft Intune supports Android Enterprise corporate-owned devices with a work profile, also known as Corporate-owned, personally enabled (COPE) devices (at the moment of writing still in preview in Intune). This is the equivalent of the personally owned devices with work profile for the BYOD scenario, but this management option is for corporate-owned devices. The full device is managed with Intune, but personal and corporate apps and data are separated.

    Android COPE with Intune can be combined with Samsung Knox Mobile Enrollment (KME) for easy deployment of the corporate-owned devices. With Samsung KME, vendors register the purchased Android devices in the Samsung portal. Here the IT admin creates an MDM profile, in this case for Intune, and assigns the profile to the devices. When the user starts the device out of the box, it checks in to the Samsung services, receives the settings to enroll the device in the MDM, and starts an easy enrollment process.

    In this article, I describe how the configuration is done with Microsoft Intune and Samsung Knox. And we also have a look at the end-experience.

    Registration of a device can also be done manually as I described in this previous article.

    In this article, I only describe the enrollment part for Android COPE. If you want to read a more in-depth article on COPE, read this article.

    Create COPE enrollment profile

    For this article, I assume you have already connected your Google Play account with Microsoft Intune.

    We first create an Android COPE enrollment profile, to get an enrollment token, which we need later in our Samsung KME enrollment profile.

    • Sign-in to the Endpoint Manager admin center
    • Browse to Devices – Android
    • Browse to Android enrollment
    • Click on Corporate-owned devices with work profile
    • Click Create profile
    • Give the enrollment profile a Name
    • Enter a Description(Optional)
    • Click Next
    • Review the information
    • Click Create

    Open the Token tab after the profile is created.
    The token we find here is needed later when we create the MDM profile in the Samsung portal.

    Setup Samsung Knox Mobile Enrollment

    To use Samsung Knox Mobile Enrollment we need to create an account, this can be done on this site.

    Sign-in to the Samsung Knox portal.
    There are several Knox solutions, but we are now interested in Knox Mobile Enrollment.
    Click Launch under KME.

    1. Check I have read and agree…
    2. Click Submit application

    Now the waiting starts to get your account approved. It might take a couple of hours before your account is approved and sometimes it even might takes days.

    When registration is finished, sign-in again to the Knox portal. When you launch the KME portal, answer the question to get started.

    • Browse to the MDM Profiles tab
    • Click Create profile on the right
    • Select Android Enterprise as profile type
    1. Give the enrollment profile a Name
    2. Give the profile a Description (optional)
    3. Choose Force Device Owner enrollment
    4. Pick Microsoft Intune as MDM provider
    5. The MDM Agent APK URL is pre-filled
    6. Click Continue
    • Enter this custom JSON
    {"com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN":"Enter Intune enrollment token string"}

    Replace Enter Intune enrollment token string with the token from the Android COPE profile as created in Intune.

    • Make your choice for the System applications
    • Enter the Company Name
    • Click Create

    If you want your vendor (reseller) to register your Samsung devices in Knox, this can be done on the Reseller tab.
    When you register a reseller, you can also assign a default profile to these registered devices.

    Everything is in-place to start our first enrollment.

    End-user experience

    Enrollment with Samsung Knox Mobile Enrollment is done out of the box or after a factory reset. As soon as an internet connection is detected, the Knox Enrollment Service is updated.

    Click Accept & Continue.

    The enrollment is started.

    The user is informed the device isn’t private.
    Click Next.

    A Work profile is created.

    Click Done.

    Enter your username and password for authentication.

    Setting up device….

    The following screens might differ, based on (compliance) settings applied to the device.

    First, we need to set a screen lock.
    Click Set up.

    Enter a PIN code as screen lock.

    Next, we need to enable secure startup for device encryption.
    Click Start.

    Select Secure startup.

    Select Require PIN when device turns on.
    Click Apply.

    Next, the work apps are installed.
    Click Install.

    When the apps are installed, click Next.

    Time to register the device.
    Click Set up.

    Click Sign in.

    Enter your password and click Sign in.

    Click Register.

    Click Done.

    To set up the personal section of the device, for example to install apps, you’re asked to provide a personal (Gmail) account.
    Click Next.

    Provide your account details, create a personal account or skip adding a personal account.

    The enrollment is finished!

    We have a personal section on the device, with personal apps and data.

    And we have a work section, with our work apps and data.

    In the Work section, we find the Intune app. Here you find your device, with compliance state.

    That’s it for this post. Thanks for reading!

    Android EMS Intune Knox MEM Microsoft 365 Microsoft Endpoint Manager Samsung
    Share. Facebook Twitter LinkedIn Email WhatsApp
    Peter Klapwijk
    • Website
    • X (Twitter)
    • LinkedIn

    Peter is a Security (Intune) MVP since 2020 and is working as Modern Workplace Engineer at Wortell in The Netherlands. He has more than 15 years of experience in IT, with a strong focus on Microsoft technologies like Microsoft Intune, Windows, and (low-code) automation.

    Related Posts

    Microsoft Defender ATP for Mobile

    June 23, 2020

    Set default Start Menu with Microsoft Intune

    June 5, 2019

    How to start with Android Enterprise work profiles in Microsoft Intune

    April 16, 2019
    View 8 Comments

    8 Comments

    1. Alex on March 19, 2021 12:08

      Super blog, have implemented it exactly the same with me. But I noticed that the device is displayed in Intune as Fully Managed and not as COPE device. Although there is not even a profile / token for Fully Managed. Do you have any ideas?

      Reply
      • Peter Klapwijk on March 19, 2021 12:18

        Hi Alex,

        That’s not my experience.
        As you can see in my previous article related to COPE it shows as “Android (corporate-owned work profile)”.

        The article is found here https://inthecloud247.com/how-to-configure-android-corporate-owned-personally-enabled-user-devices-with-microsoft-intune/

        Are you sure you took the right token for enrollment which you added to the enrollment profile and assigned to the right MDM Profile in the KME portal?

        Reply
        • Alex on March 19, 2021 12:59

          Yes I am absolutely sure. What I found is the part in the following article:
          https://docs.samsungknox.com/admin/knox-mobile-enrollment/create-profiles.htm#Configur

          If I understand it correctly:
          “Force Device Owner Enrollment” sets the device as Fully Managed.
          And “Let MDM choose to enroll as a Device Owner or Profile Owner” would enroll the device as COPE if supported. Do you see it the same way?

          Reply
          • Peter Klapwijk on March 19, 2021 13:21

            I’m not completely sure what this setting exactly does. But I’ve set it to “Force Device Owner Enrollment” and that works fine for me.

            Reply
          • Aaron on March 23, 2021 11:03

            Hi Alex,

            you are right. We experienced the same! COPE in Intune is broken at the moment. For us the only way is Samsung Knox Portal + COPE Token and then skip private Gmail account in the setup assistent.

            Reply
            • Bart on March 23, 2021 20:55

              Hi all, I was testing the same thing today and found this tutorial because I was getting a fully managed enrollment every time. I did 2 things different from this tutorial.

              1. I selected “Let MDM choose to enroll as a Device Owner or Profile Owner”. After this it immediately enrolled to COPE.
              2. I selected “Disable system applications” because I noticed that this settings applies to the “Work” section and not the “private” section and I don’t need the system apps there as well.

              Thanks for posting this, well documented!

    2. Megan on April 7, 2021 03:25

      There is documentation somewhere that tells you if it is Android 10+ and has the option to use Profile owner, it will. Otherwise it will default to Device Owner which is the old school way of doing things. So Bart is correct, change that setting.

      Note, I have also encountered that using a PO profile you aren’t technically supported to push Outlook app config, just app protection policies. Very disappointing. I seem to recall Airwatch, ahem, VMware, telling me the same thing in their platform ~1 year go, but I’m not convinced.

      Reply
    3. Libor Holub on December 7, 2022 11:34

      COULD ANYBODY HELP ME WITH MY (RELATED) ISSUE PLEASE?
      -I am working with the Galaxy S20FE device for about 2 years
      -09/22 would have installed MS Intune work profile (mod) for company owned Android Enterprise (COPE) for device management

      Unified Endpoint Management solution (it can be Knox Mobile Management, Intune or Mobile Iron) must instruct the device to start using that mode and can provide to the device configs and apps over Android API system.
      Example of policy which can be delivered by UEM is Network Config.
      -and from this point on, my device’s Wi-Fi module starts automatically/ spontaneously (irregularly):

      -IT department on trial removed the “corporatemobile” wifi connection on Android, and the automatic connection disappeared
      -by trial/error I have come to the conclusion that the connection problem is generated by the MS Intune environment – can you please help me where to change the MS Intune settings ?

      Reply
    Leave A Reply Cancel Reply

    Peter Klapwijk

    Hi! Welcome to my blog post.
    I hope you enjoy reading my articles.

    Hit the About Me button to get in contact with me or leave a comment.

    Awards
    Sponsor
    Latest Posts

    Hide the “Turn on an ad privacy feature” pop-up in Chrome with Microsoft Intune

    April 19, 2025

    How to set Google as default search provider with Microsoft Intune

    April 18, 2025

    Using Windows Autopilot device preparation with Windows 365 Frontline shared cloud PCs

    April 13, 2025

    Using Visual Studio with Microsoft Endpoint Privilege Management, some notes

    April 8, 2025
    follow me
    • Twitter 4.8K
    • LinkedIn 6.1K
    • YouTube
    Tags
    Administrative Templates Android Automation Autopilot Azure Azure AD Browser Conditional Access Edge EMS Exchange Online Feitian FIDO2 Flow Google Chrome Graph Graph API Identity Management Intune Intune Monitoring iOS KIOSK Logic Apps macOS MEM MEMMonitoring Microsoft 365 Microsoft Edge Microsoft Endpoint Manager Modern Workplace Office 365 OneDrive for Business Outlook Passwordless PowerApps Power Automate Security SharePoint Online Teams Windows Windows 10 Windows10 Windows 11 Windows Autopilot Windows Update
    Copy right

    This information is provided “AS IS” with no warranties, confers no rights and is not supported by the authors, or In The Cloud 24-7.

     

    Copyright © 2025 by In The Cloud 24-7/ Peter Klapwijk. All rights reserved, No part of the information on this web site may be reproduced or posted in any form or by any means without the prior written permission of the publisher.

    Shorthand; Don’t pass off my work as yours, it’s not nice.

    Recent Comments
    • Peter Klapwijk on Using Windows Autopilot device preparation with Windows 365 Frontline shared cloud PCs
    • John M on Using Windows Autopilot device preparation with Windows 365 Frontline shared cloud PCs
    • Christoffer Jakobsen on Connect to Azure file shares with Microsoft Entra Private Access
    • Ludo on How to block Bluetooth file transfer with Microsoft Intune
    • RCharles on Automatically configure the time zone (during Autopilot enrollment)
    most popular

    Application installation issues; Download pending

    October 1, 2024

    Restrict which users can logon into a Windows 10 device with Microsoft Intune

    April 11, 2020

    How to change the Windows 11 language with Intune

    November 11, 2022

    Update Microsoft Edge during Windows Autopilot enrollments

    July 9, 2024
    Peter Klapwijk – In The Cloud 24-7
    X (Twitter) LinkedIn YouTube RSS
    © 2025 ThemeSphere. Designed by ThemeSphere.

    Type above and press Enter to search. Press Esc to cancel.

    Manage Cookie Consent
    To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
    Functional Always active
    The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
    Preferences
    The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
    Statistics
    The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
    Marketing
    The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
    Manage options Manage services Manage {vendor_count} vendors Read more about these purposes
    View preferences
    {title} {title} {title}