The free KPE Premium powers most Samsung admins never open

Samsung's Knox Service Plugin unlocks device controls that plain Intune policy never surfaces — and the Premium licence it needs costs nothing. Here is how to find it, deploy it, and stop closing tickets as "Intune can't do that".

The problem

A user asks you to stop shared Samsung tablets sleeping after 30 seconds. Or to hide Developer options. Or to force a fleet of handhelds into French. You open the Intune device restrictions profile, scroll the Android Enterprise settings, find nothing, and the ticket gets closed as "Intune can't do that".

On Samsung hardware, it usually can. Most Samsung fleets run on bare Android Enterprise policy while the Knox Service Plugin (KSP) — an OEMConfig app Samsung publishes in Managed Google Play — quietly offers far deeper control. Its Deep Settings Customization and Device Settings policy groups let you lock the screen timeout to an exact value, hide individual Settings screens, set system language and region centrally, and dictate power behaviour — all from inside your existing Intune tenant.

Two false beliefs keep it unopened: that the "Knox Platform for Enterprise Premium" licence it requires costs money (it doesn't — Samsung provides it free of charge), and that Knox management means a separate console (it doesn't — KSP is configured as an ordinary Intune OEMConfig profile).

Why it happens

Three things compound into a discovery failure:

• OEMConfig is a side channel. Intune's built-in Android Enterprise restrictions expose Google's cross-vendor management surface. Vendor-specific capability arrives separately, through an OEMConfig app with its own configuration schema — for Samsung, that app is the Knox Service Plugin. An admin browsing Intune's native settings list will never encounter these policies, because they live inside a profile type most admins have never created.
• The word "Premium" reads as "paid". Samsung's own documentation states that Deep Settings Customization is "available with a free Knox Platform for Enterprise Premium license on devices running Knox version 3.4 or higher" (Samsung Knox documentation, Deep Settings Customization). The licence tier sounds like a purchase order; it is actually a key you generate at no cost from a Samsung Knox account.
• The good settings are buried. Even once a KSP profile exists, the useful controls sit inside nested schema groups with names like "Deep Settings Customization" — hundreds of keys deep. Nobody maps them, so nobody knows they are there.

The net effect: the capability already exists in your tenant, at zero cost, and tickets that it would resolve get closed as impossible.

The fix

Confirm eligibility and get the free licence

1. Check Knox versions. Deep Settings Customization needs Knox 3.4 or higher (per Samsung's documentation). On a device: Settings → About phone → Software information → Knox version. Any reasonably current Samsung device qualifies; verify your oldest models rather than assuming.
2. Generate the KPE Premium key. Create or sign in to a Samsung Knox account at samsungknox.com and generate a Knox Platform for Enterprise Premium licence key. It is free of charge — do not let the word "Premium" send you to procurement.

Deploy KSP through Intune

1. Approve and add the Knox Service Plugin app from Managed Google Play in Intune, and assign it to your Samsung devices.
2. Create a device configuration profile: Android Enterprise → OEMConfig → select the Knox Service Plugin as the associated app.
3. Paste the KPE Premium licence key into the profile, enable the policy groups you need, and configure. Enable KSP's debug option on a pilot ring first so policy results are surfaced on-device while you validate.

Ten controls worth opening (all verified against Samsung's documentation)

1. Hide individual Settings screens — Wi-Fi, Bluetooth, Developer options, Language, Backup and reset, Airplane mode, Lock screen & security can each be hidden from users.
2. Lock the screen timeout to an exact millisecond value, and prevent users changing it — the shared-tablet ticket from the intro, solved.
3. Set system language and region centrally using ISO 639-1 language and ISO 3166-1 country codes.
4. Power behaviour for fixed installations — power on when connected to a power source and power off when disconnected (on Android 12 and lower, Samsung notes this is only supported on Qualcomm and LSI chipsets), plus No Battery Mode on Galaxy Tab Active3 and later.
5. Power Saving Mode enforcement with CPU limiting and brightness reduction, and RAM Plus virtual memory allocation.
6. Display discipline — adaptive brightness on/off or a fixed level (0–255), eye comfort shield with colour temperature, navigation bar type and button order, and touch sensitivity for gloved or screen-protected fleets.
7. Connectivity hardening — Private DNS settings, Wi-Fi advanced behaviour (auto-connect, power saving, Hotspot 2.0) and mobile data switching.
8. Sound and vibration control — charging sound, keyboard sound, screen-lock sound, touch feedback and volume-key defaults, useful in shared and care environments.
9. Lock screen and system presentation — lock screen notification styling, battery percentage display, font size and style, and the text-to-speech engine.
10. Beyond Deep Settings — KSP's wider device-wide policy groups add restrictions such as USB and media control and hotspot and Bluetooth tethering, so check the full schema before declaring anything impossible.

Two rules to obey

• The licence genuinely costs nothing. Samsung's documentation is explicit that both Deep Settings Customization and the Device Settings policy group require a free KPE Premium licence. Do not close the ticket over an imagined cost.
• One KSP profile per device. OEMConfig does not merge multiple profiles for the same app on a device, so consolidate every Knox setting for a given device group into a single KSP profile. Two half-profiles assigned to the same device is a recipe for unpredictable results.

How Decolla handles it

Straightforwardly: it doesn't. Decolla provisions Windows devices over your own Intune and Autopilot tenant — it does not configure Android or Samsung Knox, so the KSP work above is something you do directly in Intune, and this article should get you there without us.

The reason we wrote it up anyway is that the underlying failure — a capability already exists in your tenant, but it is buried where nobody looks, so tickets get closed as impossible — is exactly the problem Decolla is built to remove on the Windows side. The Library is a curated catalogue of 260+ pre-built policies, scripts and fixes, including recurring helpdesk fixes and built-in hardening, so buried Windows capability is mapped rather than rediscovered one ticket at a time. Every deployment starts with a written, itemised plan — delivery method and reversibility class stated per item, with anything irreversible flagged — approved before anything runs, and Decolla can roll back its own changes per item afterwards.

Decolla is pre-launch; if a curated map of Windows provisioning capability sounds useful, the waitlist is open at decolla.app.

Sources

• Samsung Knox documentation — Deep Settings Customization (licence requirement and full policy list)
• Samsung Knox documentation — Device Settings policies (hidden settings screens, language, power management)
• ManageEngine — deploying the Samsung Knox Service Plugin via OEMConfig (community context)