Skip to main content

Glossary

Samsung Knox

Samsung Knox is the security platform built into Samsung Galaxy phones, tablets and rugged devices, combining hardware-backed protection with management services for businesses. For an IT team it means two things: a device that checks its own integrity from the chip up, and tools such as Knox Mobile Enrollment and Knox settings that an MDM can use on top of Android Enterprise.

How it works

Knox starts in silicon. Samsung fuses a hardware root of trust into its processors, then checks every stage of boot against it: bootloader, kernel, system. If any stage has been tampered with, an irreversible bit (the Knox warranty bit) flips, and Knox-protected features refuse to run. Samsung has shipped this since 2013, and the Knox Vault secure processor, introduced with the Galaxy S21 in 2021, now stores keys, PINs and biometrics in isolated hardware.

On top of that foundation, Samsung exposes settings that stock Android doesn't: firewall rules, APN control, blocking the USB port for everything but charging, granular hardware controls on rugged models. Since Android Enterprise became the standard, these settings reach the MDM through OEMConfig using the Knox Service Plugin, rather than through a Samsung-specific agent.

Then come the cloud services. Knox Mobile Enrollment (KME) is Samsung's equivalent of Google's zero-touch: a device bought through a Knox reseller shows up in the KME portal and enrolls in your MDM at first boot, no QR code needed. Knox Configure and Knox Guard add pre-configuration and anti-theft locking for customers who need them.

Why it matters for a fleet

Samsung sells the majority of Android devices used in European businesses, so Knox is often the difference between the controls you can apply on paper and the ones you actually get on the handset. A firewall rule or a USB block that Android doesn't offer by default becomes available because the hardware vendor exposes it.

The attestation side matters for compliance. When Knox reports that a device boots cleanly, that's a hardware statement, not a software guess. Security teams working under NIS2 or with a SOC that asks about rooted devices get an answer they can log.

The limit is obvious: Knox only exists on Samsung. A mixed fleet with Zebra scanners and Pixel phones needs a management layer that treats Knox as one OEM extension among others, not as the baseline.

How Appaloosa handles it

Appaloosa manages Samsung devices through Android Enterprise and adds the Knox layer where it helps: enrollment through Knox Mobile Enrollment or Google zero-touch, Knox settings pushed via OEMConfig with the Knox Service Plugin, and the same app distribution, kiosk mode and remote wipe as on any other Android device. Everything runs from the console described on the Android MDM page.

Explore

See the full platform

Enrollment, apps, security, remote support: all in one place.

Explore Appaloosa

See Appaloosa run on your fleet Book a demo

Frequently asked questions

Do I need a Knox license to manage Samsung devices with an MDM?
Not for the basics. Android Enterprise management, Knox Mobile Enrollment and the Knox Service Plugin through OEMConfig are free on supported Galaxy devices. Samsung charges for some premium services, such as Knox Guard or Knox Manage, which you only need if your MDM doesn't already cover those functions.
What's the difference between Knox Mobile Enrollment and zero-touch?
Both enroll a company device automatically at first boot, without a QR code. Zero-touch is Google's program and works across brands, KME is Samsung's and works only on Galaxy devices. Since 2021 Samsung lets you register devices in both portals, so most fleets pick one to keep operations simple.
Can Knox tell me if a device has been rooted?
Yes. The Knox warranty bit flips permanently if a device boots unofficial firmware or gets rooted, and Knox attestation reports it. The MDM can then mark the device non-compliant, block work apps or wipe it. The bit can't be reset, even after reinstalling official firmware.