Skip to main content

107: Samsung Knox E-FOTA & Corporate Android eSIM Lifecycle

Implementation Effort: Medium – Requires linking Samsung Knox E-FOTA in the Intune admin center and Android 15+ for full corporate eSIM inventory and remote actions.

User Impact: Low – Firmware updates and eSIM provisioning/removal occur silently or on scheduled maintenance windows without user disruption.

Overview​

Microsoft Intune provides advanced hardware firmware and cellular connectivity lifecycle management for corporate-owned Android Enterprise devices (COBO, COSU, and COPE):

1. Samsung Knox E-FOTA Integration (July 2026 / 2607)​

Admins can integrate Samsung Knox E-FOTA (Firmware Over-The-Air) directly in the Microsoft Intune admin center (included with Microsoft 365 E3 / E5 and Intune Plan 2). This allows IT to:

  • Lock and control the exact OS/firmware version deployed to corporate Samsung fleets.
  • Force silent firmware updates without user interaction and schedule downloads/installations outside business hours to prevent frontline downtime.

2. Corporate Android eSIM Lifecycle Management (June–August 2026 / 2606–2608)​

For corporate-owned Android Enterprise devices (Android 15+), Intune now supports end-to-end eSIM governance:

  • Expanded SIM Inventory: View EIDs, multiple ICCIDs, and activation states under Device details / Hardware.
  • Remote Activate & Remove eSIM Actions: Remotely activate an eSIM using a carrier activation code or remove an individual eSIM by ICCID from the single device view without wiping the device.
  • Wipe eSIM Preservation or Removal: Choose whether to preserve or remove eSIMs during a single-device wipe, or enforce Remove all eSIMs during a device wipe via Settings Catalog policy.
  • Block Users from Adding eSIM Profiles: Prevent unauthorized carrier profile additions via the Android Enterprise Settings Catalog.

Implementation Guidance​

  1. Use the current Samsung enterprise update terminology and verify whether the organization is using Samsung E-FOTA, Knox-related licensing, or another supported Samsung update integration with Intune. Do not assume standard Android update policies give the same level of version control.
  2. Build a firmware governance process that includes test devices, pilot users, and production rings. Samsung devices often vary by region, carrier, and model family, so validate each important hardware variant.
  3. Document approved and blocked OS levels. Some business-critical apps or accessories may require a minimum patch level, while others may need a temporary hold until compatibility is confirmed.
  4. Coordinate firmware waves with compliance policy and Conditional Access. If the organization requires a minimum Android security patch level, make sure the grace period and rollout timing are realistic for the chosen rings.
  5. Plan user communications for reboots, battery requirements, and estimated downtime. Frontline devices should have charging, spare-device, or swap procedures during update windows.
  6. Review update results after each wave and track failures by model, firmware build, carrier, and app bundle.

Reference​