A Guide on using Samsung’s KPE Premium License with MaaS360
Authors - @Anish Kothari and @Dhanasekar Varadarajan
Introduction
Knox Platform for Enterprise (KPE) from Samsung is a military-grade mobile solution for IT admins to manage and secure all kinds of Samsung devices.
It provides a big set of advanced and unique security and device management features on top of the underlying Android Enterprise platform capability available with Android devices. It is specifically targeted to fill security and management gaps necessary to meet the high standard of requirements from strictly regulated industries and organisations.
The features of KPE can be leveraged by purchasing a KPE License. The available licenses are of two types - Standard and Premium.
- Standard License - The Standard License is free to use and only available for EMM/UEM vendors. MaaS360 had acquired a license and used it to provide features to customers.
- Premium License - The Premium License is a paid license which the customers had to purchase from Samsung themselves. Then, they could configure the license through MaaS360 to use the available premium KPE features.
While the Standard License provided a host of functionalities that serve the purpose of most organisations, the Premium License has a special, focused set of features.
A non-exhaustive list of such features include
- Enhanced Work Profile Configurations - Move apps from Personal profile to Work Profile, two-way transfer of files
- Enhanced Samsung DeX Management
- Knox VPN
- A plethora of Device & Settings customization options
- Separated Apps mode
- Advanced Battery Optimization capabilities
The full list of policies (Standard and Premium) is available from Samsung at https://docs.samsungknox.com/admin/knox-service-plugin/policies.html
The Big Change
From the 1st of July, 2021, Samsung is providing the entire KPE platform for free which includes the Premium License features as well.
Customers can now purchase a KPE Premium License for free from Samsung (www.samsungknox.com) and start using it via MaaS360 for all the available Premium set of capabilities.
Configuring MaaS360 to use the KPE Premium License
The simple list of steps mentioned below need to be done to use KPE Premium License with MaaS360 using Samsung’s Knox Service Plugin for Android Enterprise devices.
- Login to your MaaS360 account and navigate to Apps -> Catalog. Add a new Google Play App under Android.
- Search for “Knox Service Plugin” and select the app for distribution.
- Select the app, configure the distributions as required and select the Configuration tab.
- The Configuration tab is the entry point where all the supported policies can be configured. As shown below, click on the checkbox for “Configure App Settings” to begin the configuration process.
Important : Please go through the Note section to ascertain that it matches your requirement.
- The KPE Premium License key can be input in the box highlighted in red in the screengrab below.
All possible list of policies provided by Samsung can also be configured.
The entire list can be viewed at https://docs.samsungknox.com/admin/knox-service-plugin/policies.html for reference.
CAUTION - Do not select conflicting policies from the MaaS360 Android MDM policy that have been applied on the device, especially the ones that do not require the Premium License. This can lead to undefined behaviour.
Best practices :
- Select only policies that need the KPE Premium License.
- If other policies are configured, ensure that there’s no conflict from the MaaS360 Android MDM Policy
(Example - Camera is allowed from the Configuration tab but restricted in the MDM Policy)
- Distribute and test with a small set of devices at first. Once you are sure that everything is working as intended, increase the distribution gradually to cover all your devices.
- Editing the configuration
- Navigate to Apps -> Catalog -> Knox Service Plugin
- Click on More -> Edit App Configuration as shown below.
This will open up the same view shown earlier to configure Samsung policies.
And it is done! You have successfully configured the KPE Premium License with MaaS360.
Coming soon : Full-fledged OEMConfig support
(This feature described below is in Beta at the time of writing this document.
Please contact MaaS360 support for enabling it for your account. The illustrations captured here may change later and this post will be updated accordingly. )
In the new, improved workflow, the steps to use KPE Premium License with MaaS360 are :
- After logging in to the MaaS360 account, navigate to “Android OEMConfig” under the Security tab.
- Once the Android OEMConfig page opens up, click on “Add Configuration” as shown below.
- A dialog containing all the possible OEM config apps will be displayed.
For Samsung devices, “Knox Service Plugin” has to be chosen.
Select this and enter a name for the configuration. (In the screengrab below, the config is named as “KPE_Premium” for illustration).
Click on “Next” after the name is provided.
- In the page that opens up, enter the KPE Premium License in the highlighted field as shown below.
Important : Notice the scrollbar at the right. This page has ALL the possible policies provided by Samsung with both the KPE Standard License and the KPE Premium License. The Premium license features will be tagged with the word “Premium” beside the name of the policy.
The entire list can be viewed at https://docs.samsungknox.com/admin/knox-service-plugin/policies.html for reference.
Once all the necessary features and policies are configured, click “Next”.
- Upon clicking Next, the Distributions tab will open up. This new configuration can be distributed to existing groups of devices/specific devices as required.
Note - If this is your first time using Samsung’s Knox Service Plugin, it is essential to use the “Distribute Application” option as well to distribute it to the required devices (If this app has been already distributed, then the setting will not be available.)
Once the distributions are properly configured, click on “Publish”.
And we are done! The configuration is complete.
The next time the “Android OEMConfig” section is opened from the Security tab, it will list the newly saved configuration (“KPE_Premium” in this illustration).
The menu options at the right can be used to
1. View & Edit the configuration
2. Delete the configuration
As always, please reach out to MaaS360 support for more information on this Beta feature.