Bulk Enrollments with Samsung Knox Mobile Enrollment

Requirements

• Successful Android Enterprise Integration
• Successful Knox Mobile Enrollment Registration

Process Overview

• Hardware vendor or Administrators adds devices to the Knox Mobile Enrollment Program
• Administrator creates a Knox Mobile Enrollment Profile that contains the Companion and the Silverback server address
• Administrator downloads the device list from the Knox Mobile Enrollment Program
• Administrator creates pending enrollments for users in Silverback
• Administrator creates a *.csv file for adding enrollment credentials to Knox Mobile Enrollment
• Administrator uploads the *.csv file to Knox Mobile Enrollment
• Users starts with the out-of-the-box experience and connects the device to a network
• During the enrollment, the Knox Mobile Enrollment Service provides the user credentials to Matrix42 Companion
• Devices will be enrolled into Silverback and are managed.

Additional Notes

Within this guide we will use the bulk configuration option for Knox Mobile Enrollment devices, but you can additionally create a single pending enrollment in Silverback with the Provision User option (Devices > Pending > Provision User) and enter manually the username and the one-time password by opening the device in the Knox Mobile Enrollment Portal > Devices and enter a single User ID (Username in Silverback) and the Password (Silverback One-Time Password). If you intend to use a service account for bulk enrollment, we recommend to use the following Bulk Enrollment with a Service Account approach with a dedicated profile configured with a DPC Extras.

Another option is to predefine only the username in the KME Portal and in this case, the Companion application will pre-fill during the enrollment the username and your Silverback Server address. If you intend to only predefine the username, you can add only two columns (IMEI/MEID or Serial Number, Username) in the kme_devices_authentication_upload.csv file and during Bulk Provision Users in Silverback, you can enable the Email User Details checkbox to send users the specific One-Time Passwords. In this case, ensure to add in the Bulk Enrollment for KME.csv two columns (Username, E-Mail Address). If you do not enable the Email User Details checkbox during bulk provision users, you can always review from the Bulk Enrollment - Timestamp.csv the One-Time Passwords for users for enrolling the devices on the behalf of users and/or for adding the corresponding One-Time Passwords into the Knox Mobile Enrollment Portal. 

Please note additionally that the One-Time Passwords are only valid for a one-time usage, so in case a device will be factory wiped, the existing One-Time Password might already be used and a new one needs to be generated. In case an already used One-Time Password is present in the Knox Mobile Enrollment portal, the user will face during the enrollment the information Pending Enrollment not found. By creating a new pending enrollment, users are able to change the pre-filled OTP to a new valid one. You can assign after the bulk enrollment a different profile and clear user credentials in the Knox Mobile Enrollment portal, which will let the users starts after the next factory wipe at the Self Service Portal. Please refer to Configure Profile and further for additional information.

Login to Samsung Knox

• Open https://www.samsungknox.com/
• Press Sign in
• Sign in with your Samsung Account
• e.g. silverback@imagoverum.com
• e.g. Pa$$w0rd

Create a Profile

• From the Knox Admin Portal, select Knox Mobile Enrollment 
• Select Profiles
• Press Actions and select Create Profile
• Enter as Profile Name, e.g. Silverback KME Bulk
• Enter a Description, e.g. Silverback Bulk Enrollment Profile
• Enter your Company Name
• Enter your Support email
• Enter your Support phone number
• Press Next
• Under Pick your MDM select Matrix42 Silverback
• Wait until the verification is finished
• Under MDM Server URI, enter your Silverback Server URL, e.g. https://silverback.imagoverum.com
• Press Next

Configure Profile

• Keep the DPC extras empty
• Disable or Leave all systems apps enabled
• Configure the Enrollment screens (optional)
• Add Privacy Policy, EULAs and Terms of Service (optional)
• Upload a Root and intermediate certificate (optional)
• Disable the Enrollment screens options (optional)
• Enable and configure Advanced settings (optional)
• Press Next
• Review and edit (if needed) your made configurations
• Press Create
• If you are using Advanced settings, confirm the information message

Download Devices

• Navigate to Devices
• Select the devices that you want to use with bulk enrollment
• Click Actions
• Select Download devices as CSV 

Create Users List

• Open any Text Editor, e.g. Notepad or Notepad++
• Enter in each line a username 
  • maria.miller@imagoverum.com
  • tim.tober@imagoverum.com 
  • vincent.valentine@imagoverum.com
• Press Save as
• Save the file as a *.csv file, e.g. as Bulk Enrollment for KME.csv

Bulk Provision Users

After creation of the Bulk Enrollment for KME user list, we will generate for each user a pending enrollment with the Bulk Provision Users functionality of Silverback. Here we will upload the previously create *.csv and we will define the expiration time in hours for each pending enrollment that will be created. 

• Login to your Silverback Management Console
• Navigate to Devices
• Select Pending
• Select Bulk Provisioning Users
• Click New Bulk Provision
• Select Choose File and upload your previously created Bulk Enrollment for KME.csv
• Set the OTP Expiry (hours) to a value when you estimate the completeness of the device enrollments
  • e.g. 24 for one day
  • e.g. 168 for one week
  • e.g. 720 for one month (maximum)
• Keep all other values as default
• Enter either LDAP (Admin) or local System User credentials to authorize the action
  • e.g. ffryer_adm@imagoverum.com if your user list contains LDAP users
  • e.g. any other system user in silverback if your user list contains only local users
• Press Submit
• Wait until the Bulk Provisioning User process is finished 
• Press Download
• Open your downloaded Bulk Enrollment - Timestamp.csv file with Microsoft Excel
• Use the text to columns option to make the *.csv more easier to read

• Locate the Username (A) and the One Time Password (D) column

Merge Devices and Users

• Open your recently downloaded kme_devices.csv with Microsoft Excel
• Use the text to columns option to make the *.csv more easier to read

• Now create a new Blank Workbook
• Copy and paste and the IMEI/MEID or Serial Number from the kme_devices.csv into Column A in your new Workbook
• Now enter in Column B the Usernames from Bulk Enrollment - Timestamp.csv that will receive these devices
• Now enter in Column C the corresponding One Time Passwords from Bulk Enrollment - Timestamp.csv

• In this case, Maria Miller will receive device RFCR80GAG5T and the corresponding One Password is e256
• Review all devices, usernames and OTP and save the Workbook as e.g., kme_devices_authentication_upload.csv 
• Open your saved kme_devices_authentication_upload.csv with Notepad or Notepad++
• Review if your export contains ; or , as a separator
• Depending on your regional settings, the *.csv will contain ; instead of , as a separator.
• If your export contains ; as shown in the screenshot below, use the replace function and replace ; with , 

• Click Edit
• Select Replace
• Use the Replace function as followed and select Replace All

• This is how the final kme_devices_authentication_upload.csv  should look like

Upload List

• Navigate back to your Knox Mobile Enrollment
• Navigate to Devices
• Select Bulk Actions
• Click Assign User Credentials and same profile
• Press Select and upload your previously created kme_devices_authentication_upload.csv
• Under Modify the MDM profile of selected devices, select your previously created Silverback KME Bulk profile
• Add a Tag, e.g. Wave 1 (optional)
• Press Submit