Samsung Knox is Samsung's mobile-security platform spanning hardware (TrustZone, Secure Element) and software (Knox container, Knox Manage MDM, Knox Configure). For wholesale buyers, the most operationally relevant aspect is the Knox fuse (Knox Warranty Bit), a hardware fuse that blows permanently if the bootloader is unlocked, the device is flashed with a non-Samsung firmware, or root is attempted.
The Knox Warranty Bit is a one-time programmable hardware eFuse. It ships from the factory at 0x0 (not tripped) and can only ever move to 0x1 (tripped). When the bootloader is unlocked or an unofficial firmware or root is loaded, Samsung firmware sends a high-current pulse that physically burns the fuse. This is irreversible: there is no reflash, factory reset, or service procedure that returns a tripped bit to 0x0, because it is a physical change to the silicon, not a software flag.
A tripped Knox bit permanently disables the device's Knox-dependent security features. Samsung enterprise enrollment (Knox Platform for Enterprise, Knox Manage, Knox Configure) is rejected, and Knox-backed consumer services stop working, typically Samsung Pay, Secure Folder, and the secure features of Samsung Health. The core phone still functions, but anything that depends on a verified Knox chain of trust does not.
Resale impact: because a tripped unit is locked out of enterprise channels and loses trusted-service functionality, buyers discount it heavily against a clean equivalent, and refurbishers targeting enterprise resale reject it outright. Check the bit before buying. The fuse status is visible on-device in Settings > About phone > Software information > Knox Warranty Bit, and also in Download mode (the RMM/Knox line an Odin-style boot screen shows), where 0x0 is clean and 0x1 is tripped. Third-party Knox status apps read the same value. Verify Knox status on a sample of any Samsung lot; devices with a tripped bit should price 15-30 percent below clean equivalents.