Workspace ONE supports a broad range of operating systems and device types, including:

• Operating Systems: iOS/iPadOS, Android (including Android Enterprise), Windows 10/11, macOS, ChromeOS, and select Linux distributions.
• Device Types: Smartphones, tablets, laptops, desktops, rugged devices, kiosks/POS systems, IoT endpoints, and wearables.
• Key Use Cases:
  • Corporate and BYOD: Securely manage employee-owned and corporate devices.
  • Frontline and Rugged: Barcode scanners, handhelds, and retail peripherals.
  • Kiosk and POS: Single-purpose devices for retail, hospitality, and healthcare.
  • IoT and Specialty: Printers, sensors, and other connected endpoints.

Workspace ONE supports all major zero-touch enrollment programs:

• Apple Business Manager (ABM)/DEP
• Android Enterprise (Fully Managed, COPE, Work Profile)
• Windows Autopilot
• Samsung Knox Mobile Enrollment
• Other Methods: QR code, NFC bump, staging, and bulk provisioning.

Zero-Touch at Scale:
Integration with OEM programs and automation workflows ensures devices are provisioned with minimal user interaction. Pre-configured profiles, apps, and compliance policies are applied automatically during enrollment.

• Granular OS Update Controls:
  • Defer or schedule major OS upgrades.
  • Approve or block specific versions.
• Urgent Security Patches:
  • Automate patch deployment based on risk posture.
  • Use smart groups to target specific device cohorts without disrupting mission-critical apps.

Built-in Security Controls:

• Full-disk encryption enforcement.
• Certificate-based authentication.
• App and data containerization.
• Threat detection and remediation (via Workspace ONE Intelligence and integrations).
• Remote lock and wipe.

Compliance Enforcement:

• Real-time posture monitoring.
• Automated remediation (e.g., quarantine non-compliant devices).
• Conditional access tied to device health.
• Detailed audit trails for reporting and regulatory needs.

Conditional access policies dynamically allow or deny access based on real-time device compliance, user risk, and app sensitivity. For example, a device failing encryption checks can be blocked from accessing corporate apps until remediation.

Workspace ONE supports rugged endpoints via OEMConfig, StageNow, and integrations with Zebra OEM services. This includes barcode scanners, printers, and retail peripherals, ensuring full lifecycle management and remote troubleshooting.

Workspace ONE offers phased migration strategies and tools like staging, bulk provisioning, and API-based integrations. Professional services and migration partners ensure minimal disruption during transitions.

Workspace ONE Intelligence provides real-time dashboards for compliance, risk scoring, and operational insights. Customizable reports and automation workflows help IT teams proactively address issues and maintain compliance.

Operating Systems

• Android
• Windows
• iOS / iPadOS
• macOS
• tvOS
• Linux
• ChromeOS

Supported Device Types

• Rugged handhelds
• Tablets and smartphones
• POS systems and kiosks
• Wearables (Android-based)
• Printer management with SOTI Connect

SOTI MobiControl is purpose-built for mission-critical, frontline mobility, including:

• Retail and QSR POS management and kiosk lockdown
• Transportation and logistics fleet device management
• Warehouse scanner and printer coordination
• Field service and utility technician mobility
• Healthcare clinician device governance and home health deployments
• Rugged lifecycle management and OS control

Core Differentiator: Deep rugged device control, advanced remote troubleshooting, and operational visibility beyond traditional office-focused UEM.

SOTI MobiControl supports:

• Android Enterprise (Fully Managed, Work Profile, Dedicated Device
• Samsung Knox Mobile Enrollment (KME)
• Windows Autopilot
• Apple Business Manager (DEP/Automated Device Enrollment)
• QR code / NFC / StageNow / OEM-based enrollment
• Bulk provisioning for rugged devices

SOTI MobiControl provides:

• Granular OS update deferral policies
• Controlled deployment rings
• Forced update windows outside operational hours
• Patch enforcement policies for critical CVEs
• App compatibility testing workflows
• Ability to block major OS upgrades until validated
• Remote rollback support for managed applications

Executive Impact: Maintains operational continuity during peak seasons or clinical shifts while ensuring compliance with security mandates.

Built-In Security Controls

• Full device encryption enforcement
• Certificate lifecycle management (SCEP / PKI integration)
• Secure containerization (Android Enterprise work profiles)
• Remote lock and wipe (full and selective)
• Password and biometric enforcement
• Device health monitoring
• Network policy enforcement (Wi-Fi/VPN configurations) Compliance Enforcement & Verification
• Real-time compliance dashboards
• Automated remediation policies
• Alert-based enforcement
• Full audit logs and historical tracking
• Conditional access alignment with IdP solutions

Result: Reduced enterprise risk exposure and improved audit readiness.

SOTI provides:

• Full remote control (Android, Windows, macOS, Linux)
• Remote screen view and interaction
• Remote file system access
• Remote log capture and diagnostics
• Live device performance metrics
• Background service visibility
• Remote command execution
• Integrated printer troubleshooting via SOTI Connect

Business Outcome:

• 30–50% reduction in escalations
• Reduced truck rolls
• Faster MTTR (Mean Time to Resolution)

SOTI is engineered for rugged and distributed environments where downtime directly impacts revenue.

• Centralized enterprise app store
• Silent app deployment
• Version pinning and staged rollouts
• Forced app updates
• Rollback to prior versions
• App-level configuration enforcement
• Real-time app health monitoring

Impact: Prevents app incompatibility disruptions across thousands of devices during critical operating windows.

• Role-based policy assignment
• Dynamic policy enforcement based on compliance state
• Automated SCEP certificate issuance and renewal
• PKI integration with enterprise CA
• Conditional remediation workflows
• Compliance reporting dashboards
• Exportable audit trails

Enterprise Value: Automated enforcement reduces manual overhead and audit risk.

For rugged deployments:

• OEM integration (Zebra StageNow, Honeywell tools, etc.)
• QR/NFC-based rapid enrollment
• Bulk provisioning profiles
• Peripheral pairing automation (scanners, printers)
• Policy auto-application on first check-in
• App auto-installation and configuration
• Certificate auto-deployment

Large distribution centers or retail rollouts can provision hundreds of devices per hour using structured staging workflows.

SOTI dashboards provide:

• Real-time device health visibility
• Battery degradation monitoring
• App crash analytics
• Network signal analysis
• OS fragmentation visibility
• Compliance state tracking
• Printer error alerts

Administrators can identify trends before failures occur.

Measured Outcomes:

• Reduced MTTR
• Lower device replacement rates
• Fewer reactive escalations
• Improved frontline productivity

Yes.

Mobility Ecosystem Integrations

• Android Enterprise (fully managed and work profile)
• Apple Business Manager (ADE/DEP)
• Windows Autopilot
• Samsung Knox Mobile Enrollment

Identity & Access Integrations

• Microsoft Entra ID (Azure AD)
• Okta
• SAML-based SSO
• LDAP
• REST API integrations for ITSM and enterprise platforms

SOTI aligns with enterprise identity strategies and conditional access frameworks.

We support Android (including Android Enterprise), iOS/iPadOS, Windows, and Linux. Our device types include kiosks, POS systems, digital signage, tablets, rugged devices, and IoT devices. We excel in retail, hospitality, QSR, healthcare, logistics, and field services—any scenario requiring dedicated, single-purpose devices with locked-down configurations and remote management at scale.

We support Android Enterprise zero-touch enrollment, Apple Business Manager/DEP, Windows Autopilot, and Samsung Knox Mobile Enrollment. We also offer Seamless Provisioning on compatible hardware, where devices are pre-configured and automatically enroll, download the correct blueprint, install required apps, and lock into their designated mode when powered on and connected to the internet—requiring no IT intervention on-site.

We provide staged rollouts to deploy updates incrementally, scheduling controls for maintenance windows, policy-based update management, rollback capabilities, and testing groups to pilot updates before full deployment. Urgent security patches can be prioritized and deployed rapidly, while major OS upgrades can be controlled, tested, and staged to prevent disruption during peak business hours.

Built-in security controls include device-level encryption enforcement, certificate management, app containerization, kiosk mode lockdown, remote wipe, geofencing, network security policies, and real-time threat detection. For compliance, we provide continuous monitoring dashboards, automated remediation workflows, comprehensive audit trails, policy violation alerts, compliance attestation reporting, and desired state enforcement that automatically corrects non-compliant devices.

Unlike general-purpose MDMs designed for employee devices, Esper is architected for devices serving a single business function. We offer deep kiosk lockdown modes, purpose-built device profiles optimized for POS and signage, persistent configurations that survive factory resets, Android customization depth beyond standard EMM, and performance at scale for managing thousands of identical devices across locations.

Blueprints are reusable configuration templates that define the complete desired state of devices—including apps, policies, settings, and security controls. They eliminate the need for custom deployment scripts, prevent configuration drift through continuous self-correction, simplify scaling by applying one blueprint to thousands of devices instantly, and ensure consistency across your entire fleet without manual intervention.

For PCI-compliant and retail environments, we provide hardware-level encryption enforcement, certificate pinning for payment apps, app whitelisting/blacklisting, USB and peripheral lockdown, screen capture prevention, secure boot verification, network isolation policies, tamper detection and alerting, compliance reporting for PCI DSS, and automatic security patch deployment with rollback protection.

For touchless provisioning, we offer zero-touch enrollment via QR code, NFC, or network-based auto-configuration, and ship-to-location deployment. For remote access and debugging, we provide remote viewer to see device screens in real-time, remote control for troubleshooting, app streaming, remote log collection, command execution, and real-time alerts for device issues or policy violations.

We recommend a phased approach: start with a parallel pilot on test devices, create Esper blueprints matching current configurations, then use staged enrollment—typically via factory reset and re-enrollment for a clean state—rolling out location-by-location to minimize risk. We provide migration support and professional services to ensure smooth transitions, especially for large fleets.

For app deployment, we provide a private app store for internal apps, automatic app updates to all or staged device groups, rollback capabilities, A/B testing, scheduled deployments during off-peak hours, and bandwidth management. For policy enforcement, our desired state architecture continuously checks compliance and auto-remediates, with group-based policies, real-time policy push, compliance dashboards, automated remediation for non-compliant devices, and complete audit logging.

Operating Systems: 42Gears SureMDM supports Android (including Android Enterprise and Wear OS), iOS/iPadOS, macOS, Windows (7/8/10/11), Linux (various distributions), ChromeOS, Apple TV, and VR/IoT platforms (including various printer OEMs).

Device Types: Support extends across smartphones, tablets, laptops, desktops, rugged handhelds (Zebra, Honeywell, Datalogic, etc.), kiosks, POS terminals, smartwatches, and VR devices.

Best Use Cases: 42Gears excels in Dedicated Device Management (Kiosks/POS/Scanners), Rugged Fleet Management for logistics, and Mixed-OS environments where granular lockdown (via Kiosk mode) and remote troubleshooting are critical.

42Gears supports all major automated enrollment methods:

• Apple: Apple Business Manager (ABM) and Automated Device Enrollment (ADE).
• Android: Android Zero-Touch Enrollment (ZTE) and Knox Mobile Enrollment (KME).
• Windows: Windows Autopilot and Provisioning Packages (PPKG).
• Others: QR Code.

Zero-Touch at Scale: By linking SureMDM to these portals (ABM, ZTE, KEM, etc.), IT admins can ship devices directly to end users. Upon first power-on and internet connection, the device automatically downloads the SureMDM Agent, applies pre-configured profiles, and installs necessary apps without any manual IT intervention.

• Update Control: For Windows, SureMDM uses Automated Patch Management with "Update Rings" (Canary, Early Adopters, Broad Rollout, etc.) to stage deployments.
• Disruption Management: Admins can pause or defer updates for up to 30–365 days (depending on the OS) to ensure mission-critical apps are tested.
• Specific OEM Support: Integration with Samsung E-FOTA and Zebra LifeGuard OTA allows for granular version control on rugged and enterprise mobile devices, ensuring updates only happen during maintenance windows.
• Printers: Firmware can be updated on supported printers like Zebra Link-OS printers.

• Built-in Controls: Features include Bitlocker encryption in Windows, FileVault in MacOS, certificate-based authentication, containerization (via Android Work Profile/Apple User Enrollment), and peripheral control (disabling USB, Camera, etc.).
• Compliance and Remediation: SureMDM uses a Compliance Engine to monitor device health (e.g., root/jailbreak detection, OS version). If a device falls out of compliance, SureMDM can trigger automated remediation, such as sending an alert, moving the device to a restricted group, or performing a remote wipe of corporate data.
• Audit Trails: Comprehensive logs and reports provide a history of all administrative actions and device status changes for regulatory auditing. Additionally, these logs can be exported to SIEM tools.

SureLock is a built-in feature in the SureMDM Agent, which replaces the default home screen with a customizable interface that permits only approved applications and URLs. It prevents unauthorized use by disabling hardware buttons (Home, Power), blocking access to system settings, and restricting peripheral access like USB or Wi-Fi settings. In addition, SureLock integrates with SureIdP to enable Shared Device Mode, allowing multiple users to securely "check in" to a device using SSO credentials while receiving role-specific app access. This setup automatically logs user login/logout timestamps, ensuring data privacy between shifts and providing clear audit trails for workforce productivity and accountability.

Education: Locking student tablets into "Exam Mode" and managing mixed fleets of iPads and Chromebooks. More at: 42Gears Education solutions page

Retail: Making the Converting tablets into POS or digital signage and managing rugged scanners for dedicated use only. More at: 42Gears Retail solutions page

Healthcare: Ensuring HIPAA compliance through data encryption and enabling Shared Device Mode so nurses can securely swap devices between shifts. More at: 42Gears Healthcare solutions page

Geofencing triggers alerts, applies any predefined policies, or wipes if a device leaves a virtual boundary. 

Remote Control allows IT to view and interact with the device's screen in real time or to call the end user's device via the remote screen to fix issues. 

Monitoring provides Online/Offline, compliance status, Location tracking, etc. Via a dashboard admin can monitor application usage, battery health, signal strength, and data usage.

SureMDM identifies the device OS and applies the default policies automatically when devices move between the groups. SureMDM can also use Custom Properties. Admins create "Jobs" or "Profiles" that are platform-agnostic, and the system dynamically applies the correct technical implementation based on whether the target is a Windows laptop or an Android tablet.

The process involves using the SureMDM Migrate scripts for OEMs like Zebra and Honeywell, Windows OS, to migrate the device. This is a "touchless" process that automates the removal of the old MDM and triggers enrollment into SureMDM.

SureMDM integrates via API and server tokens (e.g., .p7m for Apple). For identity, it supports SAML 2.0 integration with Okta, Azure AD (Entra ID), Google Workspace, and PingOne, etc allowing for Single Sign-On (SSO) and automated user-group mapping.

Samsung Knox Manage EMM is a powerful solution that allows a company to secure and manage a diverse fleet of devices beyond just the Samsung ecosystem. Knox Manage supports the following operating systems: Android (optimized for Samsung Galaxy; supports all Android Enterprise devices), iOS & iPadOS, macOS, Chrome, Windows, and Wear OS (specifically for the Galaxy Watch series).

Major use cases include:

1. Retail: Stores lock Samsung tablets into kiosk mode using Knox Manage to create secure, customer-facing POS terminals that prevent users from accessing the Android OS or web browsers.
2. Logistics: Fleet managers use Knox Manage Hardware Key Mapping to turn a smartphone’s side button into a dedicated push-to-talk or barcode scanning trigger for rapid inventory processing.
3. Healthcare:  Hospitals deploy Knox Manage Separated Apps to isolate patient data in an encrypted container, ensuring it cannot be copied or shared to personal messaging apps.
4. Construction: Site managers use Knox Manage Geofencing to automatically disable device cameras and high-drain apps the moment a worker enters a hazardous or high-security job site.
5. Education: Schools manage Knox Manage Shared Device Mode to ensure that when a student logs out of a tablet, all browsing history and personal files are instantly wiped for the next class.
6. Finance:  Banks enforce Knox Manage Data Loss Prevention policies that block screen captures and disable USB data transfers to protect sensitive client financial records.
7. Hospitality:  Hotels use Knox Manage Dynamic UI Customization to push branded wallpapers and concierge apps to in-room tablets, providing a unified guest experience across thousands of rooms.
8. Public Safety:  First responders use Knox Manage Certificate Management to ensure only authorized devices can connect to encrypted government networks for secure communication during emergencies.
9. Warehousing:  IT admins use Knox Manage App Whitelisting to block all non-essential apps and entertainment, ensuring mobile devices remain strictly dedicated to business-critical tasks.

Samsung devices with Knox Manage EMM support a wide range of enrollment methods to ensure they fit any business size or deployment model, ranging from automated bulk setups to manual individual enrollments. These include: Knox Mobile Enrollment (KME), Android Enterprise Zero-Touch, QR Code Enrollment, and Token-based Enrollment.

Samsung recommends businesses use Knox Mobile Enrollment (KME), included in Knox Suite bundles. While Samsung supports standard Android Zero-Touch, it specifically recommends KME because it is the only method that allows for a complete "Out-of-Box Experience" (OOBE) that also integrates with other Knox Cloud Services like Knox E-FOTA and Knox Asset Intelligence. It offers the highest level of security, ensuring that even after a factory reset, the device remains locked to your organization and automatically re-enrolls. 

To manage major OS updates and urgent security patches without disrupting users, Samsung provides a combination of two software products, Knox Manage EMM and Knox Enterprise Firmware Over the Air (EFOTA), which together offer granular controls far beyond standard Android Enterprise capabilities. Core controls include:

1. Version Pinning:  Admins can select a specific firmware version to deploy and lock devices to that version, preventing them from automatically upgrading to a major OS release that might be incompatible with in-house apps.
2. Scheduling: Admins can schedule an installation time.
3. Forced Silent Updates: Updates can be pushed silently without any user interaction required.
4. Network and Battery Constraints: Admins can define device state criteria that must be met before an update starts.
5. Complete OTA Blocking: Admins can disable all over-the-air (OTA) updates at the system level.

Samsung Knox Manage EMM leverages a defense-grade security stack that integrates hardware-level protection with cloud-based management. It enforces security through policy application and verifies compliance via continuous monitoring and audit logs. These include:

1. Built-In Security Controls (Encryption: Data-at-Rest (AES-256 and File-Based Encryption), Dual Data-at-Rest, and Data-in-Transit), Certificate Management, Containerization, Rote Wipe & Lock, and Threat Detection (Real-Time Kernel Protection, Attestation, and Network Protection.
2. Enforcement and Verification (Compliance): Monitoring (Real-Time Compliance Checks, Event-Based Triggers, Knox Asset Intelligence), Remediation (Automated Rules, Remote Support), Audit Trails (Console Logs, Device Logs, Security Logs).

Samsung Knox’s hardware-rooted architecture establishes an immutable Root of Trust (RoT) by embedding cryptographic keys directly into the SoC during manufacturing, ensuring every stage of the boot process is verified for integrity. This design provides the critical benefit of defense-grade data protection, where a physical Knox Warranty Bit trips to permanently block enterprise data access if unauthorized tampering is detected. Most importantly, the Samsung Knox Vault provides a hardware-isolated environment for high-entropy assets like biometrics, ensuring they remain secure and inaccessible even if the main OS kernel is fully compromised. 

Samsung designed Knox Suite bundles (which include multiple Knox software products) to provide all-in-one, end-to-end mobility solutions that simplify the entire device lifecycle—from deployment and security to management and analytics—under a single license key. Knox Suite includes these powerful tools in tiered plans (Base, Essentials, Companion, and Enterprise) to provide maximum value and operational efficiency. A summary of each Knox product is below; please contact your Stratix sales rep to determine the right Knox Suite bundle for your use case.

1. Knox Mobile Enrollment: Zero-touch deployment that automatically adds devices to your EMM the moment they are powered on.
2. Knox Platform for Enterprise: Government-grade security features that extend beyond standard Android to protect data at the chip level.
3. Knox Manage:  A cloud-based EMM that provides deep, hardware-level control and remote management for mobile fleets.
4. Knox Remote Support: Allows IT admins to remotely view and control a user's screen to troubleshoot issues in real-time.
5. Knox E-FOTA: Control, test, and schedule Android OS updates to ensure app compatibility and prevent downtime.
6. Knox Capture: Turns a device's camera into a professional-grade barcode scanner without needing custom code.
7. Knox Asset Intelligence: Provides deep visibility into battery health, app stability, and connectivity via data-driven analytics.
8. Knox Authentication Manager: Provides automated sign-in and facial recognition for shared corporate devices to speed up user transitions.

Samsung Knox enables strict data separation by creating an encrypted, hardware-backed secure container known as a Work Profile that isolates corporate apps and sensitive information from personal content. This isolation is reinforced at the kernel level through Security Enhancements (SE) for Android and application sandboxing, which prevents unapproved apps from accessing or sharing data across the profile boundary. Verified by hardware-rooted keys and Dual Data-at-Rest (DualDAR) encryption, this architecture ensures that enterprise data remains completely inaccessible to the personal side of the device, even if the main operating system is compromised. 

Bulk provisioning Samsung devices is a streamlined, zero-touch process driven by Knox Mobile Enrollment (KME), which allows IT admins to deploy thousands of units simultaneously without manual configuration. Certified resellers upload device identifiers into the Knox portal and admins can use CSV files to bulk-assign enrollment profiles and pre-provision user credentials for up to 100,000 devices at once. When end-users first unbox and connect their devices to a network, the units automatically detect their assigned profiles and install the corporate MDM/EMM agent, bypassing most of the standard Android setup wizard. This ensures mandatory persistence, meaning devices will automatically re-enroll even after a factory reset, maintaining strict corporate security and operational efficiency across the entire fleet. With KME, IT admins are able to configure advanced settings to provide greater control over devices, lock devices if security is compromised, and install apps prior to EMM enrollment. In addition, flexible secure deployment options are offered with an on-premise option and with KME Direct, a PC application to enroll and configure devices remotely using local network infrastructure.

Samsung Knox provides a hardware-rooted security framework that allows businesses in regulated industries to hardwire compliance directly into their mobile infrastructure. By securing devices from the chip up, it ensures the integrity of sensitive information through features like government-grade data isolation in secure Work Profiles. Additionally, the platform streamlines regulatory readiness by offering granular OS control through Knox E-FOTA, real-time monitoring via Knox Manage EMM for automated audit trails, and biometric-based multi-factor authentication for secure shared-device environments. This integrated approach enables organizations to maintain continuous operational resilience and avoid penalties while focusing on their core business goals. In addition to Knox Manage real-time monitoring of devices, Knox Manage also provides audits. An IT admin can verify the events that occur in the system, the policies that were applied, any tampering and compliance violations, etc., and take appropriate actions against them.

Samsung Knox acts as a set of unique hardware-level extensions that work seamlessly alongside Android Enterprise and other Unified Endpoint Management (UEM) tools rather than competing with them. By integrating through the Knox Service Plugin (KSP), Knox allows businesses using third-party UEMs like Microsoft Intune or SOTI to access advanced and Samsung-specific features. This harmonized approach ensures that organizations can maintain their existing management infrastructure while gaining "defense-grade" security and comprehensive device oversight that standard Android Enterprise cannot provide alone. 

In addition, Samsung offers Knox Suite Companion Plan, a specialized bundle of Knox tools and solutions designed for organizations that already use a third-party Unified Endpoint Management (UEM) system but want to enhance their Samsung Galaxy device management. It allows IT admins to integrate advanced Samsung-specific, defense-grade security and customization capabilities—such as granular device control, deep analytics, and specialized kiosk modes—directly into their existing workflows without replacing their current management software. Key benefits include streamlined deployment via Knox Mobile Enrollment, enhanced, hardware-level security, and specialized, deep-level management tools, including advanced app management and remote support, which ultimately boost productivity and security for enterprise-level device fleets.