Impact of Upcoming Samsung Knox 3.11

With the release of Android 15 and Knox SDK 3.11, Samsung now requires MDM apps like Scalefusion to be set as Device Owner (for EMM) or Profile Owner (for BYOD) to access the full range of Knox SDK features.

Previously, Samsung Knox allowed secure functionality even in device admin mode, making modern enrollment methods like Android Zero-Touch or Samsung KME optional. This update marks a shift, and some customers may experience operational changes.

This article highlights the impact of this change and provides clear guidance on the steps you can take to adapt seamlessly.

What is the change?

To unlock the full potential of Samsung Knox SDK features with Scalefusion, devices must be enrolled using modern management methods such as Android Zero-touch, Samsung KME, or the 6-tap method, which assigns Scalefusion the necessary device owner privilege.

Impact of the Change

1. Scalefusion must be enrolled as a Device Owner on Android 15 and above to provide the full range of Samsung Knox features.

2. Devices currently enrolled in Device Admin mode (Download and Install/Legacy method) will need to be re-enrolled using modern methods like Android Zero-touch, Samsung KME, or the 6-tap setup.

When will the Change come to effect?

1. Scalefusion has collaborated with Samsung to secure an extension, and the change will now take effect on December 31st, 2025.

Scope of Impact

1.  Samsung Knox devices running Android 15 devices and Knox 3.11

2. Samsung Knox devices that will be updated to Android 15

Devices Not Impacted

1. Any Samsung Knox devices enrolled using modern methods like Android Zero-touch, Samsung KME, 6-times tap or afw#mobilock are not impacted.

Changes implemented by Scalefusion

To mitigate the impacts, Scalefusion has made the following changes,

1.  Scalefusion will block device admin aka legacy mode enrollment from Samsung Knox devices that are running Android 13, Android 14 or Android 15.

2.  Scalefusion will by default set the Allow OTA updates to false/block on Android 13 and Android 14 devices

3.  IT Admins can manage the above settings from Scalefusion console by navigating to Utilities > Global Settings > Android > Samsung Knox SDK Compatibility Settings

4. Scalefusion will be sending email notifications to all customers who have Samsung Knox devices enrolled in legacy device admin mode.

Recommended Plan of Action for IT Admins

If your company manages Samsung Knox devices then we recommend the following actions,

1. Review all Samsung Knox devices by identifying those enrolled in legacy device admin mode. This can be done through the Scalefusion dashboard or by querying device enrollment data to flag devices using the legacy admin method.

   1. The search can be scoped to devices running Android 13 or Android 14 as they have higher chances of getting updated to Android 15

2. Devise a migration plan for the legacy enrolled devices so that these devices can be re-enrolled using modern management methods.

   1. Scalefusion can assist you with your Android Zero-touch account, making it easier to migrate devices from legacy enrollment to modern management with minimal steps.

   2. Please plan your migration plan on or before December 31st, 2025.

3. Once all your devices have been migrated to modern management methods, you can relax the OTA update settings from Utilities > Global Settings > Android > Samsung Knox SDK Compatibility Settings

We understand that this change may create some operational challenges for customers with devices enrolled in device admin mode. While the legacy Download and Install/Device Admin method made enrollment easier for some, we believe it's essential to adopt a unified enrollment approach for all company-owned devices. This will align with Android Enterprise and the recommended modern enrollment methods for greater consistency and security.

Please feel free to reach out to support@scalefusion.com for any additional questions or help that you may need during this process.