com.samsung.android.appseparation Copy

Separated Apps, made by Samsung as part of Knox Platform for Enterprise. It is an administrator feature rather than a user one: it holds a nominated set of authorised third-party business apps in a separated area of a fully managed device, where Samsung documents that they cannot intercommunicate with work apps or reach confidential work data. Samsung positions it at enterprises that need full control of the device while still allowing those third-party apps, and states plainly that it is not intended for personal apps and data and does not offer the privacy guarantees of a work profile on a company-owned device. In our sample it is Samsung-signed, appears only on Samsung devices across API levels 31 to 37, and holds the Knox app-separation permission. Version note: how it is configured changed at Android 14. Before that it was driven by Knox Service Plugin, Samsung's OEMConfig app. From Android 14 Samsung also supports configuring it with a managed configuration applied to the Separated Apps app itself through managed Google Play, and Samsung documents that these managed configurations take priority over Knox Service Plugin policies, overriding an existing Knox Service Plugin setup once enabled. If you administer a mixed fleet, expect the same feature to be driven from two different places depending on the device's Android version. For Android Enterprise and EMM use this is a live policy surface, not dead weight. On devices where the feature is configured, disabling or removing the package removes the mechanism enforcing that separation. On devices where it has never been configured it sits idle, so the practical risk of disabling it is low, but the safer course is to leave it in place unless you are certain the feature is unused across the fleet.

• Separated Apps for Android 14 | Knox Platform for Enterprise | Samsung Knox Documentation →
• Separated apps | Knox Platform for Enterprise | Samsung Knox Documentation →
• Package provenance for com.samsung.android.appseparation - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 36 permissions: 1 runtime (user-granted), 19 signature or system-level, 7 install-time and 9 vendor or uncatalogued. The signature/system share marks it as a privileged component, not an ordinary app.
• APK size ranges from 6.9 MB to 13.8 MB across the reporting device profiles, so the build differs substantially between them.
• Reported as an updated system app on 10 of 21 profiles - a newer build is installed over the one in the system image there.