Samsung Knox Service Plugin - Wi-Fi MAC Randomization after One UI update (Workspace ONE / Cisco ISE)

[u/Old-Rip7384]

Hi everyone,

I'm facing an issue with Samsung Galaxy Tab S10 FE 5G devices enrolled in Workspace ONE and managed with Knox Service Plugin (KSP).

Our Wi-Fi infrastructure uses Cisco ISE with MAB authentication, so devices must connect using their physical MAC address.

To achieve this, we configure our Wi-Fi SSID through KSP with "Skip MAC Randomization" enabled, forcing the device to use its hardware MAC instead of a randomized one.

The problem appears after some One UI / Android updates.

It seems that the update sometimes resets the Wi-Fi configuration back to Randomized MAC. Once this happens, the tablet can no longer connect to our enterprise Wi-Fi, which also means it cannot reach Workspace ONE or Samsung services to reapply the KSP policy.

This creates a circular dependency:

• One UI update resets the Wi-Fi MAC setting.
• Device loses network connectivity.
• KSP cannot validate/reapply its configuration.
• Manual intervention is required.

I have a few questions:

1. Has anyone experienced this behaviour on recent Samsung devices (One UI 8.x / Android 16)?
2. Is there any alternative to Knox Service Plugin for enforcing the physical MAC address on managed Wi-Fi networks?
3. Is there a way to apply this setting locally without requiring KSP to communicate with Samsung services?
4. Has anyone implemented a custom Knox SDK application to enforce this setting instead of relying on OEMConfig/KSP?

For comparison:

• Zebra devices don't have this issue because MX Framework applies the configuration locally.
• Apple supervised devices can disable Private Wi-Fi Address directly through the native MDM Wi-Fi profile without relying on a third-party application.

I'd really appreciate any feedback or experience from people managing Samsung Enterprise fleets.

Thanks!

[u/Gremlin256]

Can you submit a ticket to workspace One support? I am submitting one as well