Knox Service Plugin Setup

MDM-agnostic steps for setting up Samsung devices with Knox Service Plugin

1. In your MDM, navigate to the option to add applications through Managed Google Play Store, and add all desired BlueFletch applications plus two Samsung-specific apps:

   1. Knox Service Plugin

   2. BFE Knox Admin Helper

      1. To find the latter, search "bluefletch" (quotation marks included) and select the Knox helper app

2. Locate the Managed App Config for Knox Service Plugin (consult MDM-specific documentation for help finding a managed app config)

   1. Some MDMs (e.g. Intune) have the following settings under device OEM Config policies

      1. Select "Knox Service Plugin" or "Samsung" as the OEM name

   2. Configuration Name:

      1. This can be any string

   3. Profile name (version):

      1. This can also be string. We recommend adding the date that you created this profile

   4. Knox License Key:

      1. Note: Feel free to reach out to BlueFletch for a Knox key to use for testing, but Samsung's recommendation is to use your EMM's key.

   5. Following the Samsung guide Grant special permissions for an app, configure the following settings within the Knox Service Plugin app config:

      1. Device-wide policies:

         1. Enable device policy controls: true

         2. Application management policies:

            1. Enable application management controls: true

            2. Enable permission controls: true

            3. Enable Add applications for accessing the Knox SDK: true (specifically required for Remote Control on Android 15+)*

         3. Device Admin allowlisting:

            1. Enable device admin controls: true

            2. Allowlisted DAs: com.bluefletch.ems.emm.launcher

      2. Return to the base level of the app config, and locate Add Applications for accessing the Knox SDK (specifically required for Remote Control on Android 15+)*

         1. Create a group with the following fields configured:

            1. Package name: com.bluefletch.ems.emm.launcher

            2. Scope: REMOTE CONTROL

            3. The signature is optional

      3. Return to the base level of the app config, and locate Permission Controls. Add a group for each of the apps listed below:

         1. com.bluefletch.ems.emm.launcher

            1. All Files Access

            2. Appear On Top

         2. com.bluefletch.ems.emm.support

            1. Appear On Top

            2. Usage Data Access

            3. Change System Settings

         3. com.bluefletch.ems.emm.remoteagent

            1. Appear On Top

         4. com.bluefletch.ems.emm.deviceinformation

            1. Appear On Top

         5. com.bluefletch.ems.emm.auth.msal (or other auth package)

            1. Appear On Top

         6. com.bluefletch.ems.emm.messaging

            1. Appear On Top

*All the Remote Control-specific settings are derived from the Samsung guide How to authorize remote control permissions for Android 15 or higher.