Knox Mobile Enrollment (KME)

How it works

You create a KME account on the Samsung Knox portal and register your MDM there, supplying the enrollment profile: server URL, enrollment token, and the setup steps you want skipped or shown. Your reseller then uploads the device identifiers, IMEI for cellular models or serial number for Wi-Fi-only tablets, into your account. From that point the devices are yours in Samsung's records.

The device does the rest. Out of the box, as soon as it gets network access during setup, it checks in with Samsung, finds it belongs to a KME profile, downloads the MDM agent and enrolls as a fully managed device before the user ever reaches a home screen. Policies, apps and kiosk configuration land in the same pass. For stock already sitting in a cupboard, the Knox Deployment App lets an admin register units by Bluetooth or NFC instead of waiting on a reseller.

Compared with Google's zero-touch enrollment, the trade-offs are real. Zero-touch is multi-brand and covers Pixel, Zebra, Honeywell, Lenovo, Samsung and more; KME is Samsung-only. KME gives finer control over the out-of-box experience and works back to older Knox versions. Until 2021 a device had to be in one program or the other, which forced a choice at purchase time; since then Samsung and Google support dual registration, so a Galaxy handset can sit in both portals. Useful as a migration path, though running both on the same fleet long term mostly adds confusion about which profile is authoritative.

Why it matters for a fleet

Unboxing 400 handsets by hand is roughly ten minutes each if nothing goes wrong. KME turns that into a logistics problem instead of an IT problem: the reseller ships sealed boxes straight to the sites, and the first person to power one on gets a configured device.

It also removes a quiet risk. A device enrolled at first boot cannot be used for 20 minutes as a personal phone before anyone notices, and factory resetting it brings the management back rather than escaping it.

Make the reseller requirement part of the tender. A supplier who is not in the Knox Deployment Program cannot register your devices, and discovering that after delivery means falling back to manual enrollment.

How Appaloosa handles it

Appaloosa supports Knox Mobile Enrollment as well as Google zero-touch for Android, plus Apple Automated Device Enrollment and Windows Autopilot, so a mixed fleet uses one console and one set of profiles. Samsung specifics, including Knox settings pushed through OEMConfig with the Knox Service Plugin, come along with it. Details sit on the zero-touch enrollment page.