Setup Samsung Knox Mobile Enrollment to enroll Android devices in Microsoft Intune

After writing a few blog articles last April about Android (Enterprise) management with Microsoft Intune, it`s now time to take a look at Samsung Knox Mobile Enrollment (KME). Samsung KME provides a solution which is familiar to Android Zero Touch Deployment, but (off course) fully focused on Samsung Devices;
The admin or the reseller registers the Android devices in the Samsung KME portal. The end-user switches on the (new) Android device, connects it to the internet and the Android device downloads the configuration profile from KME. In combination with Microsoft Intune, the device is enrolled in Intune after the end-user authenticates with the Azure AD credentials and receives the assigned configuration policies and applications and is ready to start using the device without the admin touching the device.

In this blog article I will describe how to setup Samsung Knox Mobile Enrollment to enroll the devices in Microsoft Intune as (Android Enterprise) Corporate-owned, Fully managed user device. I will not describe in further detail how to link your Managed Google Play account with Intune, you can read those steps in a previous article. In this example I enroll the device in Intune as Corporate-owned, Fully managed user device, the steps involved to set this up in Intune can be found here.

Setup Samsung Knox Mobile Enrollment

I assume you have already created a Samsung account, if not go to this portal and create one.

Sign-in to the Samsung Knox portal. There are a lot of options on the dashboard, but for now we are only interested in Knox Mobile Enrollment. If you haven`t already applied for KME, click Apply now.

1. Check I have read and agree…
2. Click Submit application

Now you need to wait until the registration for KME is approved. My approval was done within the hour, but sometimes it could take a few days and you even might be contacted by phone to discuss why you need KME.
When registration is finished, go back to the Samsung Knox portal and under Knox Mobile Enrollmend click Launch Console.
Because it`s the first time we open the KME console, we need to take some steps to setup KME.

1. Click Start

1. Select Server URI not required for MDM
2. Click Continue

On this page we setup our first MDM Profile. With this profile we make sure our devices are enrolled in Intune as a Corporate-owned, Fully managed user device.

1. Give the enrollment profile a Name
2. Give the profile a Description (optional)
3. Click Add support contact

1. Enter your Company Name
2. Enter your Company Address (optional)
3. Enter Support Phone Number
4. Enter Support Email Address
5. Click Save

1. Back at the profile page click Add MDM Applications

Here we need to enter the URL to the APK which needs to be downloaded during enrollment. For enrollment in Intune as Android Enterprise device that URL is https://aka.ms/intune_kme_deviceowner.

1. Enter https://aka.ms/intune_kme_deviceowner
2. Click Save

After providing the APK URL we get some more options.

1. Check Enable this app as Google Device Owner
2. Choose Microsoft Intune as Supported MDM
3. Make you decision to Leave all system apps enabled (or remove them)

The last part of setting up our enrollment profile is to fill in the custom JSON data on the right site of the page. By filling in this configuration, we make sure our devices are directed to the correct enrollment profile in Intune. When you don`t fill in this information, your users need to scan the QR code from the corresponding Intune enrollment profile during enrollment.

The format for Intune, Android Enterprise is:
{“com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN”: “Enter Intune enrollment token string”}
Replace Enter Intune enrollment token string with the token you find in Intune above to QR Code (located under Device Enrollment, Android enrollment, Corporate-owned, Fully managed user devices).
When you use the token from a Corporate-owned, dedicated device, the device is enrolled as dedicated device.

When finished click Save profile.

On the next page you can fill in information about your reseller. This allows you reseller to register devices at Samsung Knox which you purchased and assign it a default enrollment profile. I highly advise to give your reseller these right to register your devices, so you as an admin don`t have to register the devices yourself. You can setup a reseller at a later moment.

1. Click Skip

1. Click Next

You are presented the Knox Mobile Enrollment dashboard. It`s now time to ask your reseller to register your purchased Samsung devices to your account. Or you can register the devices yourself as I will show you next.

Manually register devices with the Knox Deployment app

When you have existing devices which cannot be registered by a reseller to your Samsung account, you have the option to register the devices manually using the Samsung Knox Deployment app.
To get started with this process, download the app from the Google Play Store on a Android device and sign-in.
Sorry for the Dutch printscreens.

1. Select the enrollment Profile we just created in the KME portal
2. Click Deployment mode

We have three deployment modes; Bluetooth, NFC and Wi-Fi Direct. In my example I used NFC as I found that the easiest way. Select the Deployment mode of choice.

Click Start deployment

If you have chosen to use NFC, you only have to ‘ bump’ both devices to get the profile deployed to the device which needs to be registered. Acknowledge the enrollment on the existing Samsung device.
When the deployment is finished, switch back to the KME portal. On the Devices tab, you see the device is registered and the profile is assigned.

End-user experience

Now that everything is setup in the Samsung Knox portal and maybe you have also created a Android Enterprise configuration profile in Intune, it`s time to have a look at the end-user experience.
After connecting the device to the internet, the device will check for updates.

It will show a message the device will be setup. You have to accept the Terms and conditions and click Next.

The device setup is started.

The device is downloading the Google Play Store.

Click Accept & Continue to accept the terms of Chrome.

Now it`s time to authenticate with your Azure AD username and password.

Setting up device

Click Please click here to continue

By default the Microsoft Authenticator and Microsoft Intune apps are installed when the device is enrolled as Corporate-owned, Fully managed user device.

The last step is applying policies.

When the last step is finished, the user is sign-in to the device and enrollment is finished!