A factory update will trip the fuse. Knox is added after the initial os is compiled. The problem is that most service centers or regional Samsung centers don't even really understand what KNOX is for. So when they see it tripped they assume that you did something detrimental to the device. When we purchased 150 s4, 8" and 10" we had a Samsung coporate rep show our staff the many enterprise features that can be implemented on the devices. He's the one that told us that simply a rooted device will not void warranty. We have had over 20 devices covered under warranty by 3 different service centers that have been rooted. Now changing Roms and kernels are a different story, we had warranty rejected by the same regional centers for 3 of our devices that we were doing testing on that had these. We have dealt with this extensively over the last 6 months or so.
Sent from my SM-P600 using xda app-developers app