Samsung Knox with Microsoft Intune: UK Setup Guide

Does Samsung Knox work with Microsoft Intune?

Yes. Microsoft documents Knox Mobile Enrollment as a route for enrolling Samsung business devices into Intune. Samsung-specific settings can also be configured through Knox Service Plugin and an Intune OEMConfig profile. The useful starting point is to identify which task belongs to each tool, then test the combination on your chosen handset.

This guide is for a business planning its deployment with an IT administrator. It is not a substitute for the current console instructions or a recommendation to change settings across a live fleet without testing. Start with the Knox overview if you need the product terminology.

Knox Mobile Enrollment, Knox Manage and Intune do different jobs

Enrolment is the route into management. It does not by itself configure your work apps, access rules or support process. Avoid adding Knox Manage solely because the phones are Samsung if your existing Intune deployment already meets the brief. See our Suite plan comparison for the wider buying decision.

Check the prerequisites first

• Confirm the Intune entitlement for the users or devices in this deployment. Microsoft states that Microsoft 365 Business Premium includes Intune Plan 1; do not assume every Microsoft 365 subscription includes it.
• Check the current supported Samsung model, Android version and chosen ownership mode against Microsoft's Android enrolment guide.
• Set up the appropriate Android Enterprise enrolment route and Managed Google Play connection in Intune.
• Obtain a business-controlled Samsung Knox account, the necessary admin access and a representative test phone.
• Agree device registration with the supplier and identify who will prepare the enrolment profile.

Give the business continuing access to its administration accounts. Record the support contact and the process for changing suppliers, rather than letting the deployment depend on one person's undocumented login.

Choose the ownership mode before creating profiles

Microsoft's KME integration documentation covers the first three corporate-owned routes. Do not reuse that corporate-device process as a blanket instruction for staff's personal phones. Have IT select the appropriate BYOD route separately.

Set up Knox Mobile Enrollment for Intune

Microsoft's KME setup instructions describe the enrolment token and profile requirements. Follow them alongside your current Intune console:

1. Prepare the intended corporate-owned enrolment profile in Intune and obtain its enrolment token.
2. Create the Samsung enrolment profile in the Knox Admin Portal, selecting Microsoft Intune as the management platform.
3. Supply the required custom JSON containing the Intune token. Microsoft requires this even if Samsung's console marks the field optional.
4. Register the test devices using a supported upload method, then assign the intended profile.
5. Start setup on a new or appropriately prepared test device with network access, and verify the result in Intune.

The documented JSON key is com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN. Use the exact current JSON format in Microsoft's linked instructions, with your own token. Treat that token as provisioning information and keep it out of public tickets or screenshots.

An already-used device may need a reset for the intended corporate-owned route. Back up any required data, confirm ownership and recovery credentials, and agree the reset before proceeding. This article does not instruct staff to reset their personal phones.

Add Samsung policies with Knox Service Plugin

OEMConfig lets Intune configure settings supplied by a device manufacturer. Microsoft's OEMConfig guidance lists Samsung's Knox Service Plugin and explains that available settings depend on the manufacturer's app.

Have IT add the supported KSP app through Managed Google Play, deploy it to a small test group and create the matching OEMConfig profile. Select only the policies in your written brief. Review existing Intune policies for competing settings before expanding the assignment.

Samsung provides a free KPE Premium licence for supported policy use, while specialist capabilities can have different licensing. Check Samsung's KPE licence guidance for activation and entitlement requirements. A free Samsung entitlement does not remove the separate Intune licensing requirement.

Pilot checks and common enrolment problems

Before handing phones to the full team, check that the device appears in the intended Intune group, receives its required apps, applies the expected policies and reaches the expected compliance state. Test real work with a test account and sample data: email sign-in, a business app, a policy change and the replacement-user process.

These checks help locate the problem; they are not a diagnosis for every error. Use the console status and the linked vendor documentation to investigate the specific failure. Record the final tested configuration so a new starter's phone can be prepared consistently.

Include management requirements in the handset order

Tell the supplier the exact model, device count and registration requirements before ordering. Include your IT provider in the brief and confirm who owns enrolment, configuration and ongoing support. Our small-business Knox setup guide provides a wider rollout checklist, and the UK pricing guide helps separate licence and service charges.

Compare The Networks compares Samsung handsets and business network contracts. Request a Samsung quote with your Intune requirements; registration, software supply and any deployment service must be confirmed in the proposal.