跳到主要內容

042: Knox Attestation

Implementation Effort: Medium
User Impact: Low to Medium

Overview​

Samsung Knox attestation can provide an additional device-integrity signal for supported Samsung devices in Microsoft Intune app protection scenarios. It is intended to help determine whether a device is genuine and in a healthy enough state to be trusted with protected organizational data.

In Zero Trust, vendor-specific attestation should be treated as a supplemental signal, not the only trust decision.

Implementation Guidance​

  1. Confirm that the target Android population actually includes supported Samsung devices and that the required Samsung/Intune prerequisites are in place.
  2. Decide whether the control is being used for a Samsung-specific deployment, an executive/high-risk population, or a rugged/frontline scenario.
  3. Configure the attestation-related app protection setting only for user/device populations where the check is meaningful.
  4. Use assignment filters or separate policies if you need to scope the behavior specifically to Samsung devices.
  5. Choose the response action carefully. In most cases, Block access is easier to support than immediate Wipe data.
  6. Test the user experience, including terms acceptance and remediation steps.
  7. Keep a fallback plan for non-Samsung devices so the security standard remains consistent across Android platforms.

Samsung-specific controls can be valuable for corporate Samsung fleets, but they should complement a broader Android device integrity strategy across all OEMs.

Reference​