Knox Manage enrollment becomes essential when Samsung devices must enroll into a different Knox Manage tenant than the one linked to Knox Mobile Enrollment. In this article, I explain exactly how this works.
A typical example:
After a merger, Company A and Company B both have their own Knox Mobile Enrollment environments. Devices live in both KME portals, but you want all Samsung devices enrolled into the Knox Manage tenant of Company B.
By default, KME only auto-links to Knox Manage when both services belong to the same Knox tenant. So what if they don’t?
Knox Mobile Enrollment – Manual Payload Solution
The solution is surprisingly simple… but incredibly hard to find.
Even in the official Samsung Knox knowledge base, this method is barely documented — and the crucial parameters are almost never mentioned.
You can override the default tenant link by using a manual JSON payload in KME.
Within this payload, you can specify the enrollment target and behavior by adding the following key-value pairs:
| Key | Type | Value |
|---|---|---|
tenantId | String | Enter the name of your Knox Manage company account. It occurs after @ in your Knox Manage user name. |
tenantType | String | M |
AllowModifyUserId | String | Allow or Disallow |
Mode | String | DO or PO |
One key that is almost never documented: tenantType.
Another one to watch closely is Mode, because this determines the enrollment type before Knox Manage takes over:
"DO"→ Device Owner"PO"→ Personally Owned (Work Profile)
This setting decides the entire enrollment flow, so make sure to select the correct one for your scenario.
Payload implementation
Which parameters do you need?
In most cases, only two keys are required:
tenantID– the target Knox Manage tenantMode– DO or PO depending on your intended enrollment type
This manual payload method gives you full control over Knox Manage enrollment, even across different tenants.
Sources
Contact
Want advise on the implementation of this Payload or how to merge different Knox tenants? Send me a message via Contact page.