Samsung KNOX EMM Release Notes...Samsung KNOX EMM 14.7 Release Notes Copyright © 2014 Samsung...

Samsung KNOX™ EMM Release Notes

KNOX EMM 14.7

September 2014

ii

Copyright Notice

Copyright © 2014 Samsung Electronics Co. Ltd. All rights reserved. Samsung is a registered trademark of

Samsung Electronics Co. Ltd. Specifications and designs are subject to change without notice. Non-metric

weights and measurements are approximate. All data were deemed correct at time of creation. Samsung is

not liable for errors or omissions. Android and Google Play are trademarks of Google Inc. ARM and TrustZone are

registered trademarks of ARM Ltd. or its subsidiaries. All brand, product, service names and logos are trademarks

and/or registered trademarks of their respective owners and are hereby recognized and acknowledged.

Document History

Date Changes

July 2014 First version of document.

September 2014 Updated for version 14.7.

Contact Information

If you want to contact us about … You have these options …

General KNOX questions KNOX Portal, for comprehensive information about KNOX

How to get KNOX Try KNOX, to start a free trial, get pricing info, or buy KNOX

Contact KNOX Sales, if you need help buying KNOX

Technical questions KNOX Support, for self-help resources like videos, guides, and FAQs

If you already have a KNOX portal account, log in to see all the

resources available to you. If you do not have an account, you can

register for one.

Other support options Contact KNOX Support

https://samsungknox.com/https://samsungknox.com/solutions/try-knoxhttps://www.samsungknox.com/contact?subject=saleshttp://samsungknox.com/supporthttps://www.samsungknox.com/sso/loginhttps://www.samsungknox.com/user/registerhttps://samsungknox.com/faq/how-do-i-get-knox-support

Samsung KNOX™ EMM 14.7 Release Notes Copyright © 2014 Samsung Electronics Co. Ltd. 1

Contents About this release ............................................................................................................................................................................ 3 New Features ..................................................................................................................................................................................... 3 Installation .......................................................................................................................................................................................... 4 Security ................................................................................................................................................................................................ 4 Known issues ..................................................................................................................................................................................... 4

User enrollment ........................................................................................................................................................................... 4 Profile installation fails after successful enrollment ........................................................................................................................... 4

Proxy server and administration ........................................................................................................................................... 5 High memory and CPU usage by the proxy server ............................................................................................................................. 5 Disabling a user does not remove profiles ............................................................................................................................................. 5 Only one Exchange profile is installed when two profiles were configured .............................................................................. 5 Ratings region can’t be set to a region other than the US ............................................................................................................... 5 “Allow use of Safari policy” setting can’t override “Accept cookie in Safari” setting .............................................................. 5 Wi-Fi auto-connects when GP is set to not auto join ........................................................................................................................ 5 Deleting the ManagedBy property prevents device from being managed ................................................................................ 5 Changing the APNS certificate causes previous devices to be unreachable ............................................................................. 5 Integrated Windows Authentication (IWA) doesn’t work through web proxies ....................................................................... 6 Using IWA with a cloud proxy machine running a firewall ............................................................................................................. 6 Proxy server upgrade fails if ADUC is open ........................................................................................................................................... 6 Device enrollment and group proxy downloads go to different proxies ..................................................................................... 6

Admin and user portals ............................................................................................................................................................ 6 Downloading certificate fails on Windows Server ............................................................................................................................... 6 Portal dialogs do not close on Firefox ...................................................................................................................................................... 6 Can’t save profile after uploading image in Account Customizations page ............................................................................. 7 Previews for .tiff and .dib image file logos not visible in the Admin Portal ............................................................................... 7 Bulk user import using CSV file with IE fails .......................................................................................................................................... 7 Can’t map multiple email addresses to the same user ..................................................................................................................... 7

Multi-factor Authentication (MFA) ....................................................................................................................................... 7 Required data for each selected authentication factor isn’t present ............................................................................................ 7 Email as an MFA mechanism is subject to spam / junk filters ....................................................................................................... 7 SMS or phone authentication are only attempted once a password is validated ................................................................... 7 Can't close email authentication page on Firefox ............................................................................................................................... 8 High auth "lock" icon displays incorrectly .............................................................................................................................................. 8

Android Devices ........................................................................................................................................................................... 8 Always vibrate on email notification setting doesn’t function on Samsung KNOX devices................................................ 8 PKI authentication for VPN and Wi-Fi not supported on some Samsung KNOX devices ................................................... 8 Cisco AnyConnect VPN type not supported on SAFE devices ......................................................................................................... 8 Changes in account name in Admin Portal does not show on Android devices ..................................................................... 8 HTC One X passcode issues ......................................................................................................................................................................... 8 IMEI number is incorrectly displayed in KNOX EMM ......................................................................................................................... 8 Samsung KNOX device app management restrictions only apply for Samsung KNOX Workspace devices ................ 9 Notify on receiving new mail does not function on KNOX devices .............................................................................................. 9 Must remove existing KNOX container in order to re-enroll .......................................................................................................... 9 Samsung Galaxy Note II does not accept WPA/WPA2 setting in GP .......................................................................................... 9 Can’t log in to bookmark app whose url is "ftp://***" on Android mobile device .................................................................. 9 Admin portal only prompts for numeric passwords when trying to lockout device ............................................................... 9 Exchange email app doesn’t have a Load more details button. ................................................................................................. 9 Can’t set passwords containing complex characters on HTC One X ............................................................................................ 9 Camera app stops on LG Nexus 5 when a group policy is applied............................................................................................ 10 Can’t configure Exchange account on Samsung Galaxy S4 ......................................................................................................... 10

iOS devices .................................................................................................................................................................................. 10


Can’t unenroll iOS device while it is receiving a group policy ..................................................................................................... 10 Can’t establish VPN connection on iOS device using 56-bit encryption ................................................................................. 10 Can’t connect to VPN after turning RSA SecurID off....................................................................................................................... 10

App Capture ............................................................................................................................................................................... 10 Login form only displays after clicking button or link on website.............................................................................................. 10

Apps............................................................................................................................................................................................... 10 Refreshing user details page causes provisioning app to disappear ......................................................................................... 10 Configuring Zoho for SP-initiated authentication ........................................................................................................................... 10 “No certificate found” error when using SAML to configure SSO for Webex ......................................................................... 10 Problems launching Arrow Electronics Europe app ......................................................................................................................... 11 Using the Aribaexchange app with Internet Explorer 10 ............................................................................................................... 11 Using AIM with mobile devices ................................................................................................................................................................ 11 Using Windows Azure app with mobile devices................................................................................................................................ 11 Using My Memova with Internet Explorer 10 ..................................................................................................................................... 11 Asana app doesn’t support Internet Explorer ..................................................................................................................................... 11 Gliffy app doesn’t support mobile devices ........................................................................................................................................... 11 ClickTime app doesn’t support the mobile Chrome browser ....................................................................................................... 11 Using the Webex SAML app with users defined in the Samsung KNOX Cloud Directory Service ................................. 11 Only one Office 365 app can be installed at once ........................................................................................................................... 12 SSO error with Android Dropbox app ................................................................................................................................................... 12 Repeat login failures with Box app......................................................................................................................................................... 12

Additional Information and Support ..................................................................................................................................... 12


About this release

Samsung KNOX EMM delivers Identity as a Service (IDaaS) for robust, Active Directory- and cloud-based

single sign-on, access management, app management and mobile management across any cloud, mobile

or on-premise app from a catalog of thousands of tested and pre-integrated apps.

With Samsung KNOX EMM you can use Active Directory and Windows Group Policy to automate security

policy enforcement, locate devices, wipe or lock devices as well as auto-issuance or renewal of certificates

for strong authentication to Wi-Fi and VPN networks for end-users' Samsung KNOX, Android, Apple iOS,

and other mobile devices. Mobile application management (MAM) provides a customizable mobile

enterprise app store for pushing and maintaining rich mobile client apps.

Samsung KNOX EMM SSO delivers federation, password management and single sign-on as a service. It

has built-in multifactor authentication with Samsung Authenticator soft token, one time passcode (OTP)

via text/email and interactive phone calls. Samsung also delivers scriptable per-app authentication policies

to restrict access or require additional authentication.

New Features

Many new features are introduced to improve usability for first-time users and system

administrators.

Quick Start Wizard

Simplified add app flow for mobile apps

Drag-and-drop option to set priority order for policies

Improved UI for app configuration

Context-sensitive help, together with more prominent help placement throughout the

product

Several new features for user provisioning

Four new apps (Amazon Web Services, Concur, EchoSign, WebEx)

Improved Office 365 app configuration

Drag-and-drop to set priority order for role mapping

Introduction of a browser extension to support hundreds of new apps. You will be prompted to

install the browser extension the first time you try to use an app that requires it. The KNOX EMM

mobile app has this browser extension built in.

Better integration with Active Directory

End-user ability to reset a lost password from the login screen (using a second factor).

Password expiration notification from inside the User Portal.

Better device management and visibility

Configurable policy to specify device check-in frequency

Improved device status reporting


Improved end-user mobile experience

Multiple tab support when running web apps in the KNOX EMM mobile app

Improved support for Samsung devices

KNOX 2.0 support for fine-grained synching of data between device and container

The KNOX EMM app inside the KNOX container has been updated to match the UI of the

KNOX EMM app outside the container

Support for Juniper SSL VPN (for the whole device or per-app)

Support for IMAP/POP email inside the KNOX container

New KNOX EMM apps (14.7) will be available on the Apple App Store and Google Play store.

Installation

Please refer to the Samsung KNOX EMM MDM and Samsung KNOX EMM SSO Installation Guides for

detailed installation steps. For Samsung KNOX EMM Admin Guides, How To information, and FAQs, go to

Samsung KNOX Support.

Security

No security issues were found or resolved in this release.

Known issues

The following sections describe common known issues or limitations associated with this release of

Samsung KNOX EMM.

User enrollment

Profile installation fails after successful enrollment

For AD users, if the default enrollment container is used on a new tenant, the proxy fails

to grant permissions on the default enrollment container. Workarounds:

Use another enrollment container instead of the default This can be done during

proxy install or subsequently using the proxy configuration UI.

Uninstall and then re-install the proxy using the same reservation code.

Install multiple proxies.

https://www.samsungknox.com/en/system/files/admin-doc/Samsung%20KNOX%20EMM%20MDM%20Install%20Configure%20Guide.pdfhttps://www.samsungknox.com/en/system/files/admin-doc/Samsung%20KNOX%20EMM%20SSO%20Install%20Configure%20Guide.pdfhttps://www.samsungknox.com/en/support/knox-emm/admin-guidehttps://www.samsungknox.com/en/support/knox-emm/product-how-tohttps://www.samsungknox.com/en/support/knox-emm/faqhttps://www.samsungknox.com/en/support


Proxy server and administration

High memory and CPU usage by the proxy server

A caching facility has been added to the Samsung KNOX Cloud Service and proxy server

which can cause high CPU / RAM usage while the cache is building and may last several

hours, depending on the number of Active Directory users and the number and type of

Active Directory groups used. However, after the cache has built the CPU / memory usage

should reduce significantly.

Disabling a user does not remove profiles

If users are disabled in Active Directory, their profiles are not removed from the device.

Only one Exchange profile is installed when two profiles were configured

If you create two Exchange profiles with different profile names but pointing to the same

Exchange host, only one profile will be installed.

Ratings region can’t be set to a region other than the US

The GP setting "Restrictions Settings" has the ability to set the region to locations other

than the United States, but this setting never reflects on an iOS device due to an Apple

bug. This issue will be resolved once Apple provides a fix.

“Allow use of Safari policy” setting can’t override “Accept cookie in Safari” setting

Accept Cookie in Safari. This is a known Apple bug and will need to wait for Apple for bug

resolution.

Wi-Fi auto-connects when GP is set to not auto join

This is due to the different way Android and Apple devices behave with Wi-Fi settings.

Deleting the ManagedBy property prevents device from being managed

Samsung KNOX EMM uses the ManagedBy property in the device's property pages to

provide a link to the user using the device. Therefore, if you delete the ManagedBy

property value the device can no longer be managed.

Changing the APNS certificate causes previous devices to be unreachable

If you change the APNS certificate after enrolling some iOS devices in KNOX EMM, those

devices enrolled with the previous APNS certificate will be unreachable. If you have to

change your APNS certificate, ensure all currently enrolled devices are unenrolled first.


Integrated Windows Authentication (IWA) doesn’t work through web proxies

This is a limitation of the protocols used for IWA, so if you use a Web proxy to allow users

to access the internet, you cannot use IWA to provide silent login to the Admin or User

Portal.

Using IWA with a cloud proxy machine running a firewall

To support IWA, you should check and ensure that http traffic is allowed to the ProxyHost

executable for any/all networks on the cloud proxy server machine.

Proxy server upgrade fails if ADUC is open

If the Active Directory Users and Computers (ADUC) extension for Samsung KNOX EMM

is installed, you should close ADUC before upgrading the Proxy Server or the upgrade will

fail as ADUC will have the extension open, preventing the binaries from being updated.

Use of Active Directory administration tools

If you wish to use the Active Directory administration tools such as the ADUC plug-in or

the Group Policy extension on computers not running the Proxy, you should log in to

those computers with a local system account rather than a service account.

Device enrollment and group proxy downloads go to different proxies

In situations where there are multiple proxies and multiple domain controllers, it is

possible that device enrollment and group policy download go to different proxies as the

proxies load balance. It is possible that, due to domain controller replication, the device

object may not exist in the domain controller that the proxy doing the GP download is

using, causing the GP download to fail. This issue will be fixed in a future release. The

current workaround is to allow domain controller replication to catch up (anywhere from

15 minutes to 24 hours, depending on the replication schedule) and then reapply policies.

Admin and user portals

Downloading certificate fails on Windows Server

Certificates are encrypted files and Windows Server defaults to disallowing Internet

Explorer (IE) from downloading encrypted packages to disk. To download the certificate

for a SAML Web application or the APNS certificate on Windows server go Internet

Options in IE and uncheck: Advanced > Security > Do not save encrypted packages to

disk.

Portal dialogs do not close on Firefox

Firefox browser security settings can prevent portal dialogs from closing when the close

button is clicked. To allow dialogs to close:

1. Open Firefox and enter about:config in the address bar.

2. Search for close.

3. Change the dom.allow_scripts_to_close_windows setting to true.


Can’t save profile after uploading image in Account Customizations page

The Save button is not enabled after loading a login or portal image in the Account

Customization settings page in the Admin Portal unless another field on the page is also

changed. If you wish to change only the image, modify a text field and then remove the

modification and the button will be enabled.

Previews for .tiff and .dib image file logos not visible in the Admin Portal

Uploaded image files on the Account Customization page in the Admin Portal may not

preview if they are .tiff or .dib format. This appears to be a limitation of the image file

formats supported by each browser .jpeg, .png, and .gif files should preview on all

supported browsers.

Bulk user import using CSV file with IE fails

Internet Explorer tries to open files in the browser if there is no program associated with a

given file extension. To work around this, assign a default program, such as Excel or other

csv editor, to the csv extension as follows:

1. Go to Control Panel > Default Programs > Associate a file type or protocol

with a specific program.

2. Find the .csv extension and associate your preferred program with it.

Can’t map multiple email addresses to the same user

Although it is possible to create multiple user accounts that have the same email address,

logging in using that email address is not supported as it is not possible to definitively

map the email address to a single user.

Multi-factor Authentication (MFA)

Required data for each selected authentication factor isn’t present

When selecting the use of a secondary factor (SMS, phone, email, etc), ensure that the

data is present in Active Directory for all users otherwise it is possible that users with

missing data may be locked out. You can specify a preferred factor and if not present an

alternative factor will be used. For example, if a user has no phone number in Active

Directory and SMS was the preferred factor, the KNOX EMM will fall back to another

selected factor (for example, email). If there is no phone number or email in Active

Directory in this case, the user would effectively be locked out.

Email as an MFA mechanism is subject to spam / junk filters

Be aware that using email as an MFA mechanism may be affected by email providers'

spam or junk filters.

SMS or phone authentication are only attempted once a password is validated

This prevents spam and billing issues if an attacker attempts to brute force passwords to

gain entry.


Can't close email authentication page on Firefox

This is due to Firefox security setting not allowing scripts to close browser windows, a

workaround is:

1. Open Firefox and in the address bar, enter about:config.

2. Search for close keyword.

3. Set the dom.allow_scripts_to_close_windows value to True.

High auth "lock" icon displays incorrectly

It is possible for the high auth "lock" icon to show for an app for which it shouldn’t, and

vice versa. The app should launch as expected, the issue is only with the display of the

icon.

Android Devices

Always vibrate on email notification setting doesn’t function on Samsung KNOX devices

The Samsung KNOX Device Exchange GP setting, Always vibrate on email notification

doesn’t work in this release of the Samsung mobile app, the notification setting remains

at the user's current setting.

PKI authentication for VPN and Wi-Fi not supported on some Samsung KNOX devices

This is a device-specific issue for Galaxy SIII devices running Android 4.0.4, Galaxy Tab 2

devices running Android 4.03, and Galaxy Note II devices running Android 4.1.1.

Cisco AnyConnect VPN type not supported on SAFE devices

In this release the Cisco AnyConnect VPN type is not supported on Samsung KNOX

devices.

Changes in account name in Admin Portal does not show on Android devices

Any changes made to the account name in the Admin Portal are not reflected on enrolled

Android devices. The account name is only set on enrollment.

HTC One X passcode issues

HTC One X can’t accept passcodes with minimum number of complex characters

restriction greater than zero. This appears to be a limitation of this device as other devices

do not have the problem.

IMEI number is incorrectly displayed in KNOX EMM

The IMEI shown for a device may be missing the last digit with some Android devices.

This is an issue with the Android version, the portal is correctly reporting the number it is

given.


Samsung KNOX device app management restrictions only apply for Samsung KNOX Workspace

devices

In this release, Samsung KNOX Device app management restrictions only apply to

Samsung KNOX Workspace devices. In a future release this will be expanded to other

KNOX devices.

Notify on receiving new mail does not function on KNOX devices

The Samsung KNOX Device Exchange GP setting "Notify on receiving new mail" doesn't

work; the setting remains at the user's current setting. This appears to be an issue with

KNOX devices.

Must remove existing KNOX container in order to re-enroll

In order to re-enroll a Samsung device with a KNOX container, wait for the container to

be completely removed before trying to re-enroll. There can only be one KNOX container

managed by KNOX EMM on a device and the enrollment may fail if it tries to auto-create

a container before the old container is completely removed.

Samsung Galaxy Note II does not accept WPA/WPA2 setting in GP

Some versions of the Galaxy Note II firmware don't accept the WPA/WPA2 setting in the

Wi-Fi group policy. Settings > Wi-Fi shows that the setting has been made but the

device can't connect to the network.

Can’t log in to bookmark app whose url is "ftp://***" on Android mobile device

The stock Android browser doesn't support ftp.

Admin portal only prompts for numeric passwords when trying to lockout device

When trying to lockout a device, you are prompted to only provide numeric passwords.

Exchange email app doesn’t have a Load more details button.

Samsung Galaxy S4 devices running older versions of Android do not have the Load

more details button. This is a known Samsung Galaxy S4 device issue and is fixed after

build JDQ39.I9505ZHUDMI1.

Can’t set passwords containing complex characters on HTC One X

If the minimum number of complex characters password policy is set, users can’t change

a password on the HTC One X.

This appears to be an issue with the OS on the HTC One X and may be fixed by a later

ROM upgrade.


Camera app stops on LG Nexus 5 when a group policy is applied

The camera app stops on the LG Nexus 5 when the Permit/prohibit camera use group

policy is applied to it. This is a known issue with Android 4.4 but appears to be fixed in

Android 4.4.2.

Can’t configure Exchange account on Samsung Galaxy S4

If the UPN is the same as the username, you can’t configure an Exchange account on

Samsung Galaxy S4 devices running Android 4.22. This issue has been fixed in later

Android releases.

iOS devices

Can’t unenroll iOS device while it is receiving a group policy

Wait for an enrollment operation to complete, including receiving group policies, before

unenrolling an iOS device.

Can’t establish VPN connection on iOS device using 56-bit encryption

In this release, MPPE 56-bit encryption cannot be used for VPN connections. Use MPPE

40- or 128-bit encryption instead.

Can’t connect to VPN after turning RSA SecurID off

If RSA SecurID is turned off on an iOS device then VPN will not connect. This appears to

be an issue with iOS and has been reported to Apple.

App Capture

Login form only displays after clicking button or link on website

If the login form only shows after clicking a button or link on the website being captured,

app capture will not correctly capture the app at this time.

Apps

Refreshing user details page causes provisioning app to disappear

Refreshing the user details page can cause the provisioning app to disappear. In this case,

click on the user and then navigate back to the user details page.

Configuring Zoho for SP-initiated authentication

When copying the login URL from the Admin Portal and pasting into the Zoho Web site,

add "amp;" after the ampersand (&) and sign in with the URL you are pasting.

“No certificate found” error when using SAML to configure SSO for Webex

When you import SAML metadata into Webex and replace an existing certificate, it is

possible that the certificate may not actually be changed even though the Site Certificate

Manager shows that it is. If you have previously uploaded a certificate you should first


remove it using the Site Certificate Manager before importing the KNOX EMM SAML

metadata.

Problems launching Arrow Electronics Europe app

The Arrow Electronics Europe app is using an incorrect certificate on their website at the

moment, so all browsers will fail to load this app correctly.

On IE 10, click Show all content and the app will open correctly. On some versions of

Chrome you need to confirm that the script should be run, then wait 10 seconds for the

app to run. Firefox will abort the connection so you should use a different browser to run

this app.

Using the Aribaexchange app with Internet Explorer 10

Aribaexchange currently does not support IE10. The site works with earlier IE versions as

well as Firefox and Chrome.

Using AIM with mobile devices

The AIM app is designed to work in the browser version of the User Portal. To use AIM on

a mobile device, use the AIM app available in your mobile device's app store.

Using Windows Azure app with mobile devices

The Windows Azure app requires Silverlight to launch but this is not currently supported

by iOS or Android, so this app should not be used on mobile devices.

Using My Memova with Internet Explorer 10

With default settings, opening My Memova launches a blank page on IE10. Change the

document mode setting to IE7 will allow the app to launch correctly.

Asana app doesn’t support Internet Explorer

The Asana app does not support Internet Explorer. Use another browser to open the

Asana app.

Gliffy app doesn’t support mobile devices

The Gliffy app does not appear to support mobile devices at this time. Open the Gliffy

app on your Windows computer.

ClickTime app doesn’t support the mobile Chrome browser

The ClickTime app does not appear to support the mobile Chrome browser at this time.

Using the Webex SAML app with users defined in the Samsung KNOX Cloud Directory Service

If you have users created using Samsung KNOX EMM Cloud Directory Service, you have

to map the app to your cloud users instead of to your Active Directory users.

1. In the WebEx app, go to the Application Settings page.


2. Under Map to User Accounts, deselect Use the following Active Directory

field to supply the username.

3. Select Use this script and enter the following script:

var username = LoginUser.Get('userprincipalname');

var shortname = username.replace("@YOUR-DOMAIN.com", "");

LoginUser.Username = shortname;

Only one Office 365 app can be installed at once

The ability to configure multiple Office 365 apps may be supported in a future release.

SSO error with Android Dropbox app

On the Samsung Galaxy S4 and Galaxy Note 3 running Android 4.3, an error occurs with

the native Android Dropbox app when using single sign-on and the built-in Internet

browser. This issue has been reported to Dropbox and may be resolved in a later update

of the app. To work around this issue, install Chrome for Android in place of the built-in

Internet browser.

Repeat login failures with Box app

Three consecutive login failures prompts the user to input CAPTCHA to access the

account. After a successful login, this requirement is removed.

Additional Information and Support

Go to Samsung KNOX Support for Samsung KNOX EMM Admin Guides, How To information, and

FAQs. You can also contact the Samsung KNOX Support team for assistance.
https://www.samsungknox.com/en/supporthttps://www.samsungknox.com/en/support/knox-emm/admin-guidehttps://www.samsungknox.com/en/support/knox-emm/product-how-tohttps://www.samsungknox.com/en/support/knox-emm/faq

Date post:	01-Feb-2021
Category:	Documents
Upload:	others
View:	8 times
Download:	1 times

Samsung KNOX EMM Release Notes...Samsung KNOX EMM 14.7 Release Notes Copyright © 2014 Samsung...

Documents