Telenor MDM Samsung KME Note (5.25.00) June 2017
Table of Contents 1 2 3 4 Introduction... 4 1.1 Samsung KME Features... 5 1.2 Utilising Samsung KME... 5 1.3 Samsung KME Supported devices and models... 5 Simple KME workflow... 6 2.1 Initial steps, performed with Samsung KME dashboard... 6 2.2 Device registration steps performed on Telenor MDM server:... 6 Apply for KNOX Mobile Enrollment... 7 3.1 Prepare the Samsung KME environment... 8 3.1.1 Add a MDM Profile... 9 3.1.2 Custom JSON Data string... 11 Prepare the Telenor MDM KME environment... 14 4.1 Enable KME devices in Dashboard... 14 4.2 View KME devices in Dashboard... 14 4.3 View KME devices via Reports... 14 4.4 Manually select device as KME enabled... 15 4.5 Set multiple devices as KME enabled... 15 4.6 Final steps Ready to enroll... 15 Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 2 / 17 ^Home
Table of Figures Figure 1 Incompatible to KME device ( API 2.3)... 4 Figure 2 Samsung KME dashboard... 8 Figure 3 Resellers reference and KNOX ID... 8 Figure 4 Telenor MDM server dashboard... 14 Figure 5 Telenor MDM server reporting facility... 14 Figure 6 Telenor MDM server device information... 15 Figure 7 Device list pending review... 15 Figure 8 Device list Ready to enroll... 16 Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 3 / 17 ^Home
1 Introduction Samsung KNOX Mobile Enrollment (KME) is an efficient way to enroll large numbers of corporate-owned Samsung KNOX compatible (KNOX version 2.4 and above) devices into the Telenor Mobile Device Management (MDM) environment without manually configuring each device. Applies only to devices capable of running Samsung KNOX 2.4 and above!. Upgrades may be available for your existing devices, if so, upgrade them to the latest firmware level. Indicate, on the MDM server, Infrastructure > Users & Devices > User > Device >Contact and enrollment information that the devices are compatible with KME enrollment. Figure 1 Incompatible to KME device ( API 2.3) To check the KNOX API version of a device Navigate to Infrastructure > Users & Devices > User > Device > Inventory > Setup data The latest version of Samsung KME (June 2017) requires MDM server version 5.25.xx (or above) and MDM client 5.25.xx (or above) in order to utilise the updated KME functionality. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 4 / 17 ^Home
1.1 Samsung KME Features The following is a list of some of the main Samsung KME features. Auto re-enroll - Once a device is enrolled in your MDM, the MDM software will be reinstalled even if the device is erased and reset. Multiple MDM configurations - If you manage a complex MDM environment, Mobile Enrollment lets you set up devices with the right profile. Automatic installation and activation - Turn on the device, connect to Wi-Fi or Mobile data depending on Knox API level version, and Knox Mobile Enrollment installs and activates MDM application. Mobile Enrollment behaves differently depending upon the Knox API version found in the devices firmware. For example 1. Knox API level 2.4 this introduced KME enrollment but only via Wi-Fi activation 2. Knox API level 2.7 now KME enrollment was possible also via Mobile data connection 3. Knox API level 2.7.1, which came with Android 7 release, now KME starts up after the 3.rd click in initial startup with asking the user to go through all other kind of startup dialogue boxes. 4. Knox API level 2.8, which right now only is in Galaxy S8 and S8+ devices combines the use of KME and KC (Knox Customization) at the same time from the same Knox portal account of Samsung. Please note that Samsung Knox Configure (KC) is a licensed and payable service, where KME is for free. Easy and efficient integration - No specific Knox license required. Cost saving for IT Admins 1.2 Utilising Samsung KME The following is a bulleted list of the minimum Samsung KME requirements. Samsung Knox 2.4 (or above) devices. A Telenor MDM server. A Knox Portal account with the Knox Mobile Enrollment feature enabled (See Prepare the Telenor MDM KME environment ) 1.3 Samsung KME Supported devices and models The following devices support Knox Mobile Enrollment out of the box: Galaxy A3 (SM-A300, SM-A310), Galaxy A5 (SM-A500, SM A510), Galaxy J5 (SM-J500), Galaxy Note 5, Galaxy S5 Neo, Galaxy S6, Galaxy S6 edge, Galaxy S6 edge+, Galaxy S7, Galaxy S7 edge, Galaxy S8, Galaxy S8+, Tab A3 (2017), A5 (2017)Galaxy Xcover 3 (SM-G388), Galaxy Tab A, Galaxy Tab E, Galaxy Tab S2, Galaxy Tab 4. For other Samsung devices, contact your sales representative for more information and details on using older devices with Knox Mobile Enrollment. See https://www.samsungknox.com/en/solutions/mobile-enrollment Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 5 / 17 ^Home
2 Simple KME workflow This section is a review section of the typical steps a customer must take to be able to utilise Samsung s KME (Knox Mobile Enrollment facility). 2.1 Initial steps, performed with Samsung KME dashboard 1. 2. 3. 4. 5. 6. 7. Customer registers with Samsung KME through www.samsungknox.com On successful registration, logs into Customer portal Launches KME Register/Define and add the participating reseller that the devices were purchased from Finally create a MDM profile Add Telenor MDM client file to created profile. Add JSON Activation string from Telenor MDM server to created profile 2.2 Device registration steps performed on Telenor MDM server: 8. Ensure the validity of the IMEI of KME designated devices and that they are KNOX 2.4 compatible For a single device: Manually create and enable the device for KME through the Telenor MDM UI For multiple devices: Use the CSV import facility of the MDM server to automatically create and enable multiple devices ready for KME enrollment using a preformatted CSV file. At this stage, all newly purchased, or recently wiped devices are ready for deployment. It is essential that initial stages of device deployment/enrollment are made through a wireless link. Ensure that the recipient has access to and the details of their associated wireless access point.
3 Apply for KNOX Mobile Enrollment In this section we will: Apply for KNOX Mobile Enrollment Login to the Samsung KNOX dashboard Launch and Inspect the KME dashboard From the https://www.samsungknox.com/en/solutions/mobile-enrollment web page, select the Get Started button. A new web page requesting you to register your company details will be displayed. Equally select this URL https://eu-be.samsungknox.com/itadmin/en/#/create Complete the form and select continue. Once registered, return to the Get Started page and select the Log in button in the Are you an existing KNOX customer field. Then login with you registered Samsung Account details. Your Samsung account dashboard will be displayed. Locate the KNOX Mobile Enrollment section and select the Launch button. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 7 / 17 ^Home
Your Samsung Knox Mobile Enrollment desktop will be revealed. Figure 2 Samsung KME dashboard The Samsung KME desktop allows quick and easy navigation. The main horizontal tabs allow ready access to the following functionalities. Tab Devices MDM Profile Reseller Device Users Description Displays the current KME registered devices Displays the available / configured MDM profiles Displays and allows the definition of Registered reseller and KNOX Customer ID Displays the User ID of associated device users (past and present) 3.1 Prepare the Samsung KME environment From the dashboard, select the Resellers, and register a reseller Figure 3 Resellers reference and KNOX ID Once all the Resellers information has been entered, select Save. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 8 / 17 ^Home
3.1.1 Add a MDM Profile The MDM profile allows the KME administrator to: Define the MDM client to be downloaded into the device Copy to clipboard a JSON data string from associated MDM server Decide whether to add KNOX related EULA s Decide on an additional User agreement From the MDM profiles screen select the Add button A MDM Profile Details page will be presented. Ensure to insert a friendly name into the Profile name, then select the Add MDM applications button. Select the Add MDM applications button. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 9 / 17 ^Home
The Add MEM applications pop up will be revealed. Insert the following URL https://mdm.dmaas.de/mdmclient/telenor/mdmclient-latest.apk into the field provided. Once the link has been provided for the Telenor MDM client, select Save The MDM client provided at the download link will be maintained at the latest release level. Therefore the administrator will only need to register the MDM client download link once. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 10 / 17 ^Home
The MDM Agent APK field will be populated with the supplied URL of the Telenor MDM Client APK package. If a different MDM Agent APK is required, simply use the Remove function, and repeat the process. Additional MDM applications may be loaded at this stage, but this is beyond the scope of this document. The MDM client requires enrollment data prior to activation. This enrollment and activation data is supplied by the enrolling MDM server through an encoded JSON Data string. 3.1.2 Custom JSON Data string Select the required MDM server and Tenancy, then Navigate to Settings > Android > KME Mobile Enrollment Select the Copy to clipboard button to copy the JSON enrollment and activation string to your clipboard.. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 11 / 17 ^Home
Then paste the JSON Data string into the box provided. It is also possible, at this point in time, to select a specific Knox-related EULA that will appear on the users device, that when accepted, will allow the MDM client to continue and complete the installation and activation process. The number of steps and actions the end user has to perform during installation is greatly reduced if the Knox related EULA are not selected. On completion, select the Save button. The MDM Profiles dashboard will display the recently created profile. Multiple profiles are allowed. Add creates a new MDM profile entry. Delete allows the selected MDM profile to be deleted. Edit allows the selected MDM profile to be edited. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 12 / 17 ^Home
Selecting the MDM Profile hyperlink will reveal a summary of the profiles attributes. Check the summary information, edit any required information. Save when completed. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 13 / 17 ^Home
4 Prepare the Telenor MDM KME environment In this section we describe where the MDM administrator can confirm KME enabled devices, and describe the effect of the Export KME button. 4.1 Enable KME devices in Dashboard Navigate to Settings > System > Dashboard > Devices and ensure that the KME checkbox is selected. 4.2 View KME devices in Dashboard Navigate to Dashboard > Devices The number of KME enabled devices within the current tenancy will be clearly displayed. Figure 4 Telenor MDM server dashboard The total number of KME devices assigned to users, excluding KME devices registered in the DevicePool or Unregistered devices within the current tenancy will be clearly displayed. 4.3 View KME devices via Reports Navigate to Reports> KME Devices Figure 5 Telenor MDM server reporting facility Use the Telenor MDM server Report facility to identify specific or general KME device information through the use of filters and groups. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 14 / 17 ^Home
4.4 Manually select device as KME enabled Navigate to Organization > Users & Devices > Select a User > Select a user s device> Contact and enrollment information > Knox Mobile Enrollment Yes No 4.5 Set multiple devices as KME enabled Figure 6 Telenor MDM server device information It would be better to use the CSV Import facility, allowing multiple devices to be KME enabled by specifying their KME state through the import of a CSV file into the Telenor MDM server 4.6 Final steps Ready to enroll Once the proof of purchase has been obtained, whether electronically, or through purchase documentation, then the approved devices on the device list will have their status changed from pending verification to Ready to enroll. Figure 7 Device list pending review When approved, the status will change to Ready to enroll. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 15 / 17 ^Home
Figure 8 Device list Ready to enroll At this stage, contact the user and ensure that they have the password details for their wireless access point. Once this is confirmed, ask the user to power on the device. Once a Wi-Fi link is established, the device will communicate with Samsung s KME servers, and if the devices IMEI is registered then enrollment will commence, automatically. Please be advised: If a KME device, that is in the KME portal and enrolling to a Telenor MDM instance using MDM client and the JSON activation string, is not preregistered to a user or Devicepool, then this device will show up in the Global tenant > unregistered devices.. From Unregistered devices this KME device can then be assigned, by the Global administrator, to a user KME devices that you want to preregister in the MDM servers Devicepool can be imported using a CSV file. However, it is important to note that the device has KME status = Yes and Platform = Android. If you want to use KME in combination with the unique Multiuser Autoassign feature, then the device must be preregistered to the Devicepool or to any user inside a MDM tenant. Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 16 / 17 ^Home
List of changes Version Date Changes Reason Author 1.0 2017-06-04 Version release 5.25 Tony Dargis Telenor_MDM_KME_Note_5.25.0x_EN.docx Page 17 / 17 ^Home