Samsung Knox supports the deployment of internal and public applications.

Internal apps are company-specific apps developed by your organization that you may not necessarily want to be searchable in the public app store, but you want your users to have access to this application from their device. Use Workspace ONE UEM to distribute, track, and manage your internal applications. For more information on deploying internal apps for inside the Knox container, see Internal Applications Overview.

In order to deploy and manage public apps from Google Play inside the Knox Container, Android and the Google Play Store needs to be enabled through the Workspace ONE UEM console. Play for Work applications are available inside the Knox container after the device is enrolled, the Knox container is created, and Android is configured in the console. Play for Work public apps that are configured in the console will be pushed through Play for Work. In cases where the device is already enrolled, the AirWatch Agent Settings may need to be re-saved after configuring Android and Google Play, in order to send the Play for Work configuration to devices.

For more extensive information about deploying public and internal applications, including Google Play for Work, see the comprehensive AirWatch Mobile Application Management Guide.


VMware productivity apps (Browser, Boxer, Content Locker, etc) are not supported with Android (Legacy) Knox container deployments, such as Dual Persona or Container Only Mode, due to technical limitations with Knox container data separation. The manages the container from the outside, and is not able to communicate with apps on the inside. Since the apps require a direct link to the in order to communicate with the console, the apps cannot be configured inside the container. In order to use productivity apps with Knox, the device must be enrolled using Android Enterprise on a device running Knox 3.x or higher.