Samsung Knox Mobile Enrollment and Knox Service Plugin with Intune: setup and errors

Samsung Knox Mobile Enrollment (KME) puts new Galaxy devices into Intune the first time they're switched on, and Knox Service Plugin (KSP) adds Samsung-specific settings through an OEMConfig profile. Both depend on pieces outside Intune, such as a Knox Admin Portal profile, a JSON string and a device upload, so their failures often look like Intune problems. In this post I'll map the flow, each place it breaks, and how to prove the fix.

Symptoms#

• A new or factory-reset Samsung device runs the normal setup wizard and never shows your company's enrollment screen.
• The KME screen with your company name appears, but enrollment into Intune fails, or the device lands in the wrong mode (fully managed instead of dedicated, for example).
• Devices your reseller says it uploaded aren't on the Knox Mobile Enrollment Devices page.
• After the update to Android 15 (One UI 7.0) or later, corporate-owned work profile devices show a Serious Software Error and the Phone dialer stops working.
• The KSP OEMConfig profile reports Succeeded in Intune, but the Samsung setting doesn't take effect.

Why it happens#

For KME to work, the device must be registered to your Knox account and assigned a KME profile. Once online at first boot, it fetches the profile from Samsung and starts Android Enterprise setup with the profile's custom JSON. That JSON carries the Intune enrollment token, and the token decides the enrollment mode, because each Intune Android Enterprise enrollment profile has its own token. So:

• No KME screen: the device isn't uploaded, has no profile, or can't reach Samsung's servers.
• KME runs, Intune enrollment fails: the custom JSON is missing or malformed (it looks optional in the Knox Admin Portal, but Intune requires it), or the token is expired, revoked or from another tenant.
• Wrong mode: the token belongs to a different enrollment profile.
• KSP settings missing: KSP is Samsung's OEMConfig app. Intune delivers the configuration to it as managed configuration; applying each policy is KSP's job and depends on the device mode, OS and Knox version and, for some policies, a licence key.
• Serious Software Error: Samsung traces it to a legacy Intune policy for corporate-owned work profile devices that is incompatible with Android 15 (see step 5).

How to fix it#

1. Confirm the device is in KME with a profile#

In the Knox Admin Portal, open Knox Mobile Enrollment, search the Devices page for the IMEI or serial number, and check that a profile is assigned. Devices arrive through a Samsung-approved reseller's upload or the Knox Deployment App, which works over Bluetooth or NFC (Microsoft recommends it for devices previously set up in KME). If a reseller upload is missing, check Samsung's known issues for devices not visible on the Devices page. New Knox accounts wait one to two business days for Samsung's approval.

2. Check the KME profile#

Microsoft Intune must be selected as the EMM, and the custom JSON must be exactly this, with straight quotes and your token in place of the placeholder:

{"com.google.android.apps.work.clouddpc.EXTRA_ENROLLMENT_TOKEN": "enter Intune enrollment token string"}

Leave all system apps enabled, or some default system apps won't appear in the apps tray. Fill in the company name: it appears during enrollment, which makes it an easy check that the device received your profile.

3. Check the Intune token#

In the Intune admin center go to Devices › Device onboarding › Enrollment, select the Android tab and open the enrollment profile for the mode you want. Copy the token from that profile (Export token gives you its JSON content), confirm it hasn't expired or been revoked, and paste it into the JSON. A profile whose token has expired drops out of the list until you filter for inactive profiles. Whenever you replace or revoke a token, update the KME profile at the same time, because the old string stops working. If KME completes and the Android Enterprise steps then fail, the fully managed and COPE enrollment guide picks up from there.

4. Rule out the network#

Test on a simple network first: no captive portal (Samsung lists captive-portal networks among its KME known issues) and no TLS inspection of Samsung, Google or Microsoft traffic. Allow the endpoints each vendor publishes, factory reset the device and try again.

5. Clear the Serious Software Error on COPE devices#

Samsung's knowledge base article traces the error to a legacy Intune policy, introduced on Android 11, that hid the work profile Phone app on corporate-owned work profile devices; it worked up to Android 14, is incompatible with Android 15 and, according to Samsung, has since been removed. It names updated Galaxy S22 and S23 Ultra devices and new Galaxy S25 devices; the update prompt they show doesn't help. Samsung's resolution is to make sure the legacy policy that hides the work profile Phone app is removed from enrolled devices or, if fully managed suits you, to re-enroll them in that mode. Samsung still lists it under its KME known issues; check the article's current state before re-enrolling anything.

6. Make KSP apply#

1. Approve Knox Service Plugin from managed Google Play under Apps › All apps and assign it as required to the same devices as the profile.
2. Create the profile under Devices › Manage devices › Configuration › Create › New policy with platform Android Enterprise and profile type OEMConfig, select the KSP app, and configure it in the configuration designer or the JSON editor.
3. Put each setting in the right section. In Samsung's KSP schema, Device-wide policies apply to company-owned devices (fully managed or corporate-owned work profile) and Work profile policies to personally owned work profile devices, so KME-enrolled devices take their settings from Device-wide policies. A setting in the wrong section won't apply.
4. If a policy needs a Knox Platform for Enterprise Premium licence key, enter it in KSP's basic settings in the same profile; Samsung's KSP documentation says which policies need one.
5. Avoid targeting one device with two KSP profiles unless you've confirmed your setup supports it.

Verify the fix#

• After a factory reset, the device shows your company name from the KME profile before Android Enterprise setup starts.
• Enrollment completes and the device appears under Devices › All devices as a corporate-owned Android device in the mode you intended.
• The KSP profile shows Succeeded and the setting is visible on the device; treat Succeeded as "the configuration reached the app", not as proof.
• On corporate-owned work profile devices running Android 15 or later, the Phone dialer works and the error is gone.

Prevent it next time#

• Keep one test device per model and major OS version, and run it through KME before each rollout.
• Track token expiry and update the KME JSON whenever you rotate a token.
• Check the Devices page for every reseller upload before devices ship.
• Review Samsung's KME known issues before OS upgrades.
• Related: Android zero-touch enrollment with Intune and dedicated devices with Managed Home Screen.

References#

• Enroll devices in Microsoft Intune with Samsung Knox Mobile Enrollment (Microsoft Learn)
• Serious Software Error on Samsung Galaxy company-owned work profile devices in Microsoft Intune (Samsung Knox)
• Knox Mobile Enrollment knowledge base articles (Samsung Knox)
• Knox Service Plugin schema structure (Samsung Knox)