com.samsung.android.knox.pushmanager Copy

Labelled "KnoxPushManager", this is a Samsung background service that sits in the Knox part of the platform on Galaxy devices. It has no launcher icon. Samsung does not publish a page describing this package by name, so the note below reasons from the site's own data rather than from vendor documentation, and no disable rating is given for that reason. The permission set recorded here is unusually informative. The package declares the ability to receive cloud-to-device push messages, reach the internet, start at boot, run a data-sync foreground service, query all installed packages and read privileged phone state. Alongside those it holds Samsung's own Knox permissions for device registration and for Knox enhanced attestation. That combination suggests, but does not establish, a device-side receiver for Samsung's Knox cloud services: the path by which a service in the cloud reaches a device rather than waiting for the device to check in. Samsung Knox Guard can send notifications to enrolled devices, and Knox attestation is documented as a service a server calls, but that documentation describes the administrator's side and does not name any on-device component, so the connection is inference rather than fact. For Android Enterprise, EMM and kiosk use, no public Samsung configuration or policy reference for this package was found for this note, and there is nothing here for an administrator to set. The practical handling on Knox-managed hardware is to leave it in place: a component holding Knox registration and attestation permissions is not a sensible debloat target when its exact role is undocumented, and the consequences of removing it cannot be predicted from the sources available. Version note: it is long-standing rather than new. Samsung's own 2021 application list for the Galaxy S21+ records it at version 1.1.00.35, and the builds recorded here run from 1.2.00.3 to 1.4.02.5 across API 31 to API 37. The package versions recorded here changed over that period, but no source establishes whether its role changed with them, and that is flagged here rather than answered.

• Send notifications - Knox Guard, Samsung Knox Documentation →
• Knox Attestation - Samsung Knox Documentation →
• Galaxy S21+ 5G (G996N) Application List - Samsung Knox CC Mode documentation →
• Package provenance for com.samsung.android.knox.pushmanager - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 19 permissions: 1 runtime (user-granted), 4 signature or system-level, 8 install-time and 6 vendor or uncatalogued.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.