We enforce SD card encryption on our company mobile devices. This becomes a problem when a device is swapped out, and Samsung Knox Enrolment is used. Typically pre KME, we would advise the users in this scenario to remove company portal from old device which would then remove all policies and allow decryption which can then be moved to new device.
However with KME the enrolment enforcement kicks in and a user is unable to go into the menus on an un-enrolled device. We would benefit from a button press from console if this were possible.