Intune and Knox E-fota – Automatic E-fota app installation and enrollment

This is a follow up article to the one I wrote last week where we had a look at managing updates for our Samsung devices with E-fota and Intune. If you haven’t seen it you can read it here:

Intune and Knox E-FOTA – Manage updates for your Samsung Android Enterprise devices

To be able to enroll and manage our Samsung devices in to E-fota they need to have the Knox E-fota app Installed. We can add the app and deploy it directly from Intune with Managed Google Play however there’s a huge draw back by doing so, Let me explain.

If we would assign and deploy the app from Intune directly to our devices the app will Install. However for the device to actually enroll in to E-fota the end-user or IT Admin needs to open the app to start the enrollment process. This for many organizations is a big no no since it exponentially increases the likelihood that we won’t have all of our devices enrolled and managed that we want to.

When managing our devices we want the device to automatically enroll in to E-fota and this can be done but its not super obvious how to do that when you first get started working with E-fota, Knox and Intune.

Automatic enrollment through the Knox Service Plugin (KSP) App

This is from my point of view the best way to making sure that all our devices are enrolled in to E-fota automatically without the need for the someone to open up the E-Fota app and perform the enrollment.

The Knox Service Plugin is built on top of Androids OEMConfig and we can use this together with Intune to configure policies and settings on our devices that are manufacturer specific, In this case Samsung specific.

Note.
Each manufacturer has their own OEMConfig app thats available in Google play. For example

Samsung – Knox Service Plugin
Lenovo – Lenovo OEMConfig
Zebra – Zebra OEMConfig powered by MX
Nokia – OEMConfig for Nokia

To summarize there are 3 steps we need perform to be able to reach our goal of automatically enroll our devices managed by Intune in to E-fota with the KSP app.

• Add the Knox Service Plugin App from Managed Google Play to Intune
• Deploy and assign the KSP app to our devices
• Create and configure OEMConfig policy to enabled and enroll our device in to E-fota

Lets get started.

Add the Knox Service Plugin App from Managed Google Play to Intune

From the endpoint.microsoft.com portal go to Apps -> Android and click on Add
In the list select, Managed Google Play
Search for Knox Service Plugin and approve the app

Once the app has been approved, click on Sync or wait for the automatic sync to run. From there you will be able to find the app in the list of applications in Intune.

Deploy and assign the KSP app to our devices

Assign the app to the group of devices you want it to be deployed to.

Create and configure OEMConfig policy to enabled and enroll our device in to E-fota

Navigate to Device -> Android -> Configuration Profiles and create a new profile by clicking on Create profile

From the list that appears select Android Enterprise under platform and OEMConfig under Profile type

Give the profile a name and click on Select an OEMConfig App and choose the correct OEMConfig app from the list. In this case its the Knox Service Plugin

Continue with creating the policy and assigning it to the group of devices you want. It should look something like this ones you are done with the policy creation.

Once the policy has been assigned and applied to our device, you will see the following on the actual device.

The Knox Service Plugin applies the policies and automatically installs the Knox E-fota app and performs the enrollment to E-fota.

That’s it for now, Don’t forget to follow me on twitter @timmyitdotcom