The Samsung Knox Admin Portal controls how every corporate Samsung device is enrolled, which EMM it joins and who can lock it, so its admin accounts, roles, enrolment profiles and API credentials are as sensitive as the devices themselves. This guide explains how to run Samsung Knox cloud services securely, using Samsung's Knox documentation for every product detail (checked 8 November 2026). It covers Knox Admin Portal sign-in and identity provider federation, admin roles, Knox Mobile Enrollment profiles and their advanced lock settings, reseller trust, EMM credentials, Knox Platform for Enterprise policies, Knox cloud API credentials, the activity log and a hardening baseline. It is for mobility engineers, endpoint teams and security architects who own a Knox company account. These are customer-side settings in a shared responsibility model. For the category view, see the Mobile Device Management Security Guide.
This is an independent guide from NHI Mgmt Group, based on Samsung's public Knox documentation as of November 2026. It is not sponsored or reviewed by Samsung. Product features change, so confirm settings against Samsung's current documentation.
Key takeaways
- Federate admin sign-in. Connect the Knox Admin Portal to Microsoft Entra, Ping Identity or Okta so invited sub-admins sign in only with identity provider credentials and inherit your MFA and leaver process.
- Build custom roles per service. Roles are created per service or as Common roles, and admins can assign only roles whose permissions they already hold, so keep Super admin and role management to a few people.
- Turn on Knox Mobile Enrollment advanced settings. With a Knox Suite Enterprise Plan, profiles can lock devices that are not enrolled within 1 to 30 days, that are rooted, or whose user cancels EMM enrolment.
- Control reseller trust. Device uploads from resellers can be approved manually or automatically; auto-approve and auto-assign only for resellers you have verified.
- Export the activity log. The portal shows a year of events and keeps five years; download it regularly into your SIEM, and review Knox Manage and Knox Guard events in their own consoles.
How identity and access work in Samsung Knox
The Knox Admin Portal is the central web console for Knox cloud services. Administrators use it to manage devices, licences, admins and roles, and to open each service the company holds, such as Knox Mobile Enrollment, Knox Manage, Knox Asset Intelligence, Knox E-FOTA, Knox Remote Support and Knox Guard. Knox Platform for Enterprise, by contrast, is a set of on-device security and policy capabilities that your UEM applies through the Knox Service Plugin.
Sign-in options
| Option | How it works | Recommended use |
|---|---|---|
| Samsung account (personal) | Admins sign in through the invitation link with a Samsung account | Starting point for small companies; move to an identity provider as you grow |
| Samsung account for Business | Company-managed Samsung accounts; activation includes a password, privacy notice and Knox agreements, plus 2-step verification where it is set up | Company control of admin accounts and user management |
| Identity provider (Microsoft Entra, Ping Identity, Okta) | Connected to the company account; invited sub-admins then sign in only with identity provider credentials | Preferred for organisations with an identity provider: MFA, Conditional Access and offboarding apply centrally |
Decision guidance: Samsung documents that sign-in methods are used one at a time, so plan the switch to an identity provider as a change with a test admin and a rollback (disconnecting the identity provider is covered in Samsung's guides). Companies without an identity provider should use Samsung account for Business with 2-step verification for every admin. See How Single Sign On Works.
Admin lifecycle
- Invitations: sent from the Admins tab, individually or by CSV (up to 10 at a time). Invites expire after seven days, and accounts not activated within 30 days are deleted automatically.
- Deactivate: blocks an admin's access to selected services while leaving other services in place; useful for role changes.
- Delete: removes the admin from the company account. With Samsung account for Business, admins tied only to your location move to Pending deletion and are deleted after 30 days.
- Knox Guard: remove admins from both the Knox Admin Portal and the Knox Guard console to revoke all access.
- Super admin: the super admin who created the company account is marked with a crown; super admins are removed through the Samsung account for Business console.
Admin roles and privileged access
The Roles tab lists the read-only Super admin role, other default roles and any custom roles. Custom roles are created with CREATE ROLE, scoped either to one service or to Common (the common device list).
| Common permission area | What it covers | Risk if over-granted |
|---|---|---|
| Enrollment | View or manage enrolment profiles and EMM credentials | Devices directed to the wrong EMM or profile |
| Devices | Device list, uploads, profile assignment, EMM credentials, tags and deletion | Devices removed from enrolment control |
| Users | View and manage users (Samsung account for Business) | Account changes outside the identity process |
| Resellers | View, register and delete resellers | Untrusted sources of device uploads |
| Administrators and Roles | Invite admins and manage roles | Privilege escalation through role creation |
| Company account settings | View or manage company settings (Samsung account for Business) | Changes to sign-in and company configuration |
Role design practices
- Few Super admins: keep two named Super admins for continuity and use custom roles for daily work.
- Separate role management: Invite and manage administrators and Manage roles open the Administrators and Roles page; grant them only to platform owners.
- Use Viewer roles: Knox Manage, Knox Asset Intelligence and Knox Remote Support offer a default Viewer role for support and audit staff.
- Knox Manage sub-admins: only Super admins invite Knox Manage sub-admins; define their custom roles carefully, as Knox Manage controls device policy directly.
- Delete roles with care: deleting a role removes it from every assigned admin and cannot be undone, so reassign first.
- Quarterly review: export the admin list, confirm each role against job need and deactivate unused service access.
See SaaS Admin Account Protection.
Integrations, API tokens and service accounts
Reseller trust and device uploads
For Knox Mobile Enrollment, the IT admin and an approved reseller in the Knox Deployment Program exchange Customer ID and Reseller ID. The reseller uploads device identifiers; the admin approves each upload or sets preferences to approve future uploads and assign a profile automatically. Auto-approval is efficient, so reserve it for resellers whose identity and contract you have confirmed, and review the reseller list each quarter.
EMM credentials
EMM credentials hold an EMM user ID and an optional password used to connect devices to your EMM out of the box. They are managed on the Enrollment page's EMM Credentials tab, can be checked, edited, deleted and exported to CSV. Treat them as service credentials: grant the Enrollment permission narrowly, protect any CSV export as a secret, and rotate the EMM password in step with your EMM.
Knox cloud API credentials
| Item | Detail from Samsung docs | Handling |
|---|---|---|
| Authentication scheme | Samsung recommends Knox OAuth 2.0 for new integrations; Knox Cloud Authentication is the legacy scheme | Build new integrations on OAuth 2.0 |
| Key pair (legacy) | keys.json downloaded once from the Knox API Portal; Samsung stores the public key and does not store the private key | Keep the private key in a secrets manager or HSM, never in code |
| Client identifier (legacy) | Generated once; regenerate when privileges change or it is lost; regeneration invalidates the previous one | Record an owner; regenerate on staff change or suspected exposure |
| Access token (legacy) | Valid 1 to 30 minutes (default 30), sent signed in the x-knox-apitoken header | Request short-lived tokens per job; avoid caching |
One credential per integration keeps revocation targeted. See the API Key Management Guide.
Knox Platform for Enterprise through your UEM
Knox Platform for Enterprise adds hardware-backed security, policy management and compliance features on compatible Samsung devices. It needs a UEM (Samsung suggests Knox Manage where none exists) and a Knox licence. Policies are applied with the Knox Service Plugin, which offers basic policies and advanced policies including restrictions, application management, VPN, firewall, password policy and audit log, plus certificate management. Documented deployment modes include a work profile on company-owned devices, Android and Knox policies in the personal profile, separated apps, and DualDAR with a work profile on company-owned devices. The UEM's service account and its Knox licence key are therefore part of your trust chain: protect them like any tier zero credential. See the Android Enterprise Security Guide.
Logging and detection
The common activity log, opened from Activity log in the navigation pane, combines events across Knox services. Super admins see all services; sub-admins see services for which they hold View activity log. Each entry shows date, initiator, service, category, event, description and details, with common categories Admin, Device, License and Reseller. The portal displays up to one year of events and Samsung keeps five years; Download Activity Log exports all five years as CSV (filters do not apply to the export). As of November 2026, review Knox Manage and Knox Guard events in their own consoles alongside the common log. Searching by initiator uses the admin's full email address.
| Event to alert on | Why it matters | Response |
|---|---|---|
| Admin invited, role assigned or custom role edited | Expands control of devices or enrolment | Confirm against an approved change |
| Identity provider connected, disconnected or sign-in method switched | Changes how every admin authenticates | Verify with the identity team the same day |
| Reseller registered or auto-approval enabled | New source of trusted device uploads | Confirm reseller identity and contract |
| Enrolment profile changed or advanced settings switched off | Fleet enrolment protections altered | Review in change control |
| EMM credentials exported or edited | Service credential handling | Check purpose and storage of the export |
| Bulk device deletion | Devices leave enrolment control | Page the mobility lead |
Metrics that show it is working: percentage of admins signing in through the identity provider; number of Super admins (target two); KME profiles with advanced lock settings on; resellers with auto-approval and a review date; activity log exports ingested on schedule; API credentials with an owner (target 100 percent).
Hardening baseline
| Area | Setting | Recommended value |
|---|---|---|
| Admin sign-in | Sign in with an identity provider | Connected to Entra, Ping Identity or Okta, with MFA enforced at the identity provider |
| Roles | Super admin and custom roles | Two Super admins; service-scoped custom roles; Viewer for support staff |
| KME lock | Advanced settings, Lock device | On, with a period that fits your deployment (default 7 days, range 1 to 30) |
| KME integrity | Immediately lock device if it's rooted or running unofficial firmware | On |
| KME enforcement | Immediately lock device if user does not enroll with an EMM through Knox Mobile Enrollment | On |
| Lock screen | Lock message and phone number | Service desk number and instructions |
| Pre-enrolment apps | Add app | Only required apps, each with its signature checksum |
| Resellers | Upload approval preferences | Manual approval, or auto-approval only for verified resellers |
| Device policy | Knox Service Plugin | Password, restrictions, VPN, firewall, certificate and audit log policies set in your UEM |
| API | Authentication | Knox OAuth 2.0 for new integrations; private keys in a secrets manager |
| Logs | Download Activity Log | Regular export to SIEM |
Advanced KME settings need a Knox Suite Enterprise Plan and devices not enrolled in Knox Guard, and cannot be changed while a device is in Profile assigned, Provisioned or Provisioned (restricted) status, so set them before assigning profiles.
Rollout order
- Secure the portal: connect the identity provider with a test admin, then move other admins across; keep two Super admins.
- Design roles: create service-scoped custom roles and reassign admins; deactivate unused service access.
- Harden enrolment profiles: enable advanced settings on a pilot profile, enrol test devices, confirm the lock behaviour and message, then apply to production profiles. Roll back by editing the profile before assignment.
- Review resellers: confirm each reseller, then set approval preferences.
- Apply platform policy: configure Knox Service Plugin policies in your UEM for one device group, then expand.
- Operate: schedule activity log exports, quarterly role and reseller reviews, and prompt Samsung security updates through your UEM.
Framework mapping
| Control area | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | CIS Controls v8.1 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Federated admin sign-in | PR.AA-01, PR.AA-02 | IA-2, IA-5 | 6 | A.5.17, A.8.5 |
| Roles and least privilege | PR.AA-05 | AC-2, AC-6 | 5, 6 | A.5.15, A.8.2 |
| Enrolment and device inventory | ID.AM-01 | CM-8 | 1 | A.5.9, A.8.1 |
| Device policy and configuration | PR.PS-01 | CM-6 | 4 | A.8.9 |
| Activity logging | PR.PS-04, DE.CM-03 | AU-2, AU-6, AU-11 | 8 | A.8.15, A.8.16 |
Common misconfigurations
- Personal Samsung accounts for admins: leavers keep personal accounts. Move to an identity provider or Samsung account for Business.
- Role management granted widely: anyone with Manage roles can build roles up to their own level. Limit it to platform owners.
- Advanced settings left off: devices can then skip EMM enrolment after a reset. Turn on the lock settings before assigning profiles.
- Auto-approval for every reseller: uploads from an unverified reseller join your fleet automatically. Approve manually until a reseller is verified.
- EMM credential exports left on laptops: the CSV contains service credentials. Store exports in a secrets manager and delete local copies.
- Only the common log reviewed: Knox Manage and Knox Guard events are reviewed in their own consoles. Include both in the monitoring plan.
- Legacy API keys without owners: keys.json private keys stored in scripts. Move to OAuth 2.0 and a secrets manager.
Practitioner checklist
- Connect the Knox Admin Portal to your identity provider and enforce MFA there.
- Keep two Super admins and give everyone else service-scoped custom or Viewer roles.
- Turn on KME advanced lock settings for non-enrolment, rooting and cancelled EMM enrolment.
- Approve reseller uploads manually until each reseller is verified; review resellers quarterly.
- Protect EMM credentials and their exports as service secrets.
- Use Knox OAuth 2.0 for new API integrations and keep private keys in a secrets manager.
- Apply Knox Service Plugin policies through your UEM, including password, VPN, firewall and audit log.
- Export the activity log to your SIEM and review Knox Manage and Knox Guard consoles too.
Standards and references
- Samsung Knox: Knox Admin Portal
- Samsung Knox: Manage Roles
- Samsung Knox: Manage Admins
- Samsung Knox: View the Activity Log
- Samsung Knox: Configure Advanced Settings (Knox Mobile Enrollment)
- Samsung Knox: Knox Platform for Enterprise
- Samsung Knox: Generate an Access Token
- NIST: SP 800-124 Rev. 2 Guidelines for Managing the Security of Mobile Devices in the Enterprise
Related NHI Mgmt Group resources: Mobile Device Management Security Guide · Android Enterprise Security Guide · SaaS Admin Account Protection · API Key Management Guide