Enterprise Product Guide

Transcription

1 Enterprise Product Guide BlackBerry Enterprise Software April 2018

2 Published: SWD

3 Contents BlackBerry enterprise products... 5 The BlackBerry Infrastructure...6 BlackBerry UEM...7 Architecture: BlackBerry UEM... 7 BlackBerry UEM components... 9 BlackBerry UEM Cloud Architecture: BlackBerry UEM Cloud...12 BlackBerry Enterprise Mobility Suites...15 BlackBerry Enterprise Mobility Suite components...16 Additional enterprise server products...20 BlackBerry 2FA...21 Architecture: BlackBerry 2FA...22 BlackBerry Enterprise Identity...23 Architecture: BlackBerry Enterprise Identity...23 BlackBerry Workspaces BlackBerry WorkLife BlackBerry Analytics...26 SecuSUITE for Enterprise...27 BlackBerry AtHoc BlackBerry UEM Notifications Enterprise apps BlackBerry UEM Client BlackBerry Dynamics apps BBM Enterprise Enterprise SDKs BlackBerry UEM Integration SDK BlackBerry Dynamics SDK BBM Enterprise SDK...35

4 BlackBerry Web Services Architecture: BlackBerry Web Services and BlackBerry UEM Glossary Legal notice...38

5 BlackBerry enterprise products BlackBerry enterprise products 1 The BlackBerry enterprise software platform offers more than the best-in-class unified endpoint management provided by BlackBerry UEM. BlackBerry UEM is integrated with BlackBerry Dynamics to provide a secure mobile app platform that you can manage from a single interface. BlackBerry Enterprise Mobility Suites combine BlackBerry UEM and more EMM services to mobilize content, deploy leading business apps, deliver enhanced collaboration, protect your enterprise content everywhere it goes, and ensure document security and compliance. This document shows how BlackBerry enterprise products work together to help you securely mobilize your people, processes, apps, and information. For more information to help you learn about BlackBerry enterprise software, see the Discover BlackBerry Enterprise products content. 5

6 The BlackBerry Infrastructure The BlackBerry Infrastructure 2 At the heart of BlackBerry is the BlackBerry Infrastructure. The BlackBerry Infrastructure is a global private data network distributed across multiple regions that enables and secures data in transit between thousands of organizations and millions of users around the world. It is designed to efficiently manage the transport of data between BlackBerry services and end-user devices. The BlackBerry Infrastructure is the essential, highly secure hub for many BlackBerry products and services, including: BlackBerry UEM BBM BlackBerry 2FA BlackBerry Enterprise Identity SecuSUITE for Enterprise For organizations using BlackBerry UEM, the BlackBerry Infrastructure provides a trusted path between the organization and every user based on strong, cryptographic, mutual authentication. Because of the end-to-end encryption that protects data transmitted between the device and BlackBerry UEM, organizations can be sure that data sent to and from devices is safe and secure. BlackBerry UEM maintains a constant connection to the BlackBerry Infrastructure, meaning that organizations require only a single outbound connection to a trusted IP address to send data to users. 6

7 BlackBerry UEM BlackBerry UEM 3 BlackBerry UEM is a multiplatform EMM solution from BlackBerry that provides comprehensive device, app, and content management with integrated security and connectivity, and helps you manage ios, macos, Android, Windows 10, and BlackBerry 10 devices for your organization. BlackBerry UEM offers trusted end-to-end security and provides the control that organizations need to manage all endpoints and ownership models. Key benefits of BlackBerry UEM include the following features: Feature Low total cost of ownership Single web-based interface Flexible ownership models User and device reporting Simple user set up and enrollment Industry-leading mobile security High availability Benefit BlackBerry UEM reduces complexity, optimizes pooled resources, ensures maximum uptime and helps you achieve the lowest total cost of ownership. Manage ios, macos, Android, Windows 10, and BlackBerry 10 devices all from a single management console. Use a set of customizable policies and profiles to manage BYOD, COPE, and COBO devices, and protect business information. Manage fleets of devices using comprehensive reporting and dashboards, dynamic filters, and search capabilities. Allow users to activate their own devices with BlackBerry UEM Self-Service. BlackBerry UEM leverages the BlackBerry Infrastructure to ensure data security across all devices. Configure high availability to minimize service interruptions for device users. For more information about BlackBerry UEM, see the BlackBerry UEM content. Architecture: BlackBerry UEM For more information about the BlackBerry UEM architecture, see the BlackBerry UEM Architecture content. 7

8 BlackBerry UEM Component BlackBerry UEM BlackBerry Infrastructure BlackBerry Dynamics NOC Devices Third-party application and content servers BEMS and BlackBerry plugins BlackBerry UEM is a unified endpoint management solution that provides comprehensive multiplatform device, application, and content management with integrated security and connectivity. The BlackBerry Infrastructure registers user information for device activation and validates licensing information. All the data that travels between the BlackBerry Infrastructure and BlackBerry UEM is authenticated and encrypted to provide a secure communication channel into your organization for devices outside the firewall. The BlackBerry Dynamics NOC is a network operations center that provides secure communications between BlackBerry Dynamics apps on devices and BlackBerry Control, BlackBerry Proxy and BlackBerry Enterprise Mobility Server. BlackBerry UEM supports ios, macos, Android, Windows, BlackBerry 10, and BlackBerry OS (version 5.0 to 7.1) devices. BlackBerry UEM connects to content and application servers in your organization's environment, including the company directory, mail server, certification authorities, and so on. BlackBerry UEM works with additional BlackBerry enterprise products such as BlackBerry Enterprise Identity, BlackBerry 2FA, BlackBerry Workspaces, and BlackBerry WorkLife to allow you to extend the endpoint management capabilities in your organization. The BlackBerry Enterprise Mobility Server provides several services used to send work data to and from BlackBerry Dynamics apps. 8

9 BlackBerry UEM BlackBerry UEM components This diagram shows the BlackBerry UEM components that are used to manage ios, macos, Android, Windows, and BlackBerry 10 devices. For information about the components that manage BlackBerry OS (version 5.0 to 7.1) devices, see the BlackBerry UEM Architecture content. Component name BlackBerry UEM Core The BlackBerry UEM Core is the central component of the BlackBerry UEM architecture. It consists of several subcomponents that are responsible for: Logging, monitoring, reporting, and management functions Authentication and authorization services Scheduling and sending commands, IT policies, and profiles to devices 9

10 BlackBerry UEM Component name BlackBerry UEM database BlackBerry Control BlackBerry Control database BlackBerry MDS Connection Service BlackBerry Collaboration Service The BlackBerry UEM database is a relational database that contains user account information and configuration information that BlackBerry UEM uses to manage devices. BlackBerry Control sends user, policy, and other configuration data to BlackBerry Dynamics apps on devices. The BlackBerry Control database is the repository that BlackBerry UEM uses to store user, app, and policy information for BlackBerry Dynamics apps. The BlackBerry MDS Connection Service provides a secure connection between BlackBerry 10 devices and your organization's resources when the device is not connected to your work Wi-Fi network or using a VPN connection. The BlackBerry Collaboration Service provides an encrypted connection between your organization's instant messaging server and the BlackBerry Enterprise IM app on BlackBerry 10 devices. BlackBerry Dispatcher The BlackBerry Dispatcher provides secure connectivity using IPPP for BlackBerry 10 devices. BlackBerry Affinity Manager BlackBerry Proxy BlackBerry Secure Connect Plus BlackBerry Secure Gateway BlackBerry Gatekeeping Service Management console and BlackBerry UEM Self-Service The BlackBerry Affinity Manager is responsible for maintaining an active SRP connection between BlackBerry 10 devices and the BlackBerry Infrastructure when the devices are not using BlackBerry Secure Connect Plus. BlackBerry Proxy maintains the secure connection between your organization and the BlackBerry Dynamics NOC. It also supports BlackBerry Dynamics Direct Connect, which allows app data to bypass the BlackBerry Dynamics NOC. BlackBerry Secure Connect Plus provides a secure IP tunnel between work apps on devices and your organization's network. One tunnel is established for each device through the BlackBerry Infrastructure. The BlackBerry Secure Gateway provides a secure connection through the BlackBerry Infrastructure and BlackBerry UEM to your organization's mail server for ios devices. The BlackBerry Gatekeeping Service sends commands to Exchange ActiveSync to add devices to an allowed list when devices are activated on BlackBerry UEM. Unmanaged devices that try to connect to an organization's mail server can be reviewed, verified, and blocked or allowed by an administrator using the BlackBerry UEM management console. The management console and BlackBerry UEM Self-Service provide a web-based user interface for administrator and user access to BlackBerry UEM. 10

11 BlackBerry UEM Component name Administrators use the management console to manage system settings, users, devices, and apps. Users use BlackBerry UEM Self-Service to set an activation password and send commands to devices, such as set password, lock device, and delete device data. BlackBerry Enterprise Mobility Server BlackBerry Enterprise Mobility Server databases BlackBerry Push Notifications BlackBerry Connect BlackBerry Presence BlackBerry Docs BlackBerry Router and proxy servers BEMS consolidates several services used to send work data to and from BlackBerry Dynamics apps, including: BlackBerry Push Notifications, BlackBerry Connect, BlackBerry Presence, and BlackBerry Docs. The BEMS databases store user, app, policy, and configuration information. BlackBerry Push Notifications accepts registration requests from ios and Android devices and then communicates with Microsoft Exchange to monitor users' work mail accounts for changes. BlackBerry Connect provides secure instant messaging, company directory lookup, and user presence information to ios and Android devices. BlackBerry Presence provides real-time presence status to BlackBerry Dynamics apps. BlackBerry Docs lets your BlackBerry Dynamics app users access, synchronize, and share documents using their work file server, Microsoft SharePoint, Box, and content management systems that support CMIS, without the need for VPN software, firewall reconfiguration, or duplicate data stores. By default, BlackBerry UEM makes a direct connection to the BlackBerry Infrastructure over ports 3101 and 443. If your organization's security policy requires that internal systems cannot make connections directly to the Internet, you can install the BlackBerry Router or use a third-party TCP proxy server that supports SOCKs v5 with no authentication. BlackBerry Control and BlackBerry Proxy support using a third-party HTTP proxy server to connect to the BlackBerry Dynamics NOC. BlackBerry Infrastructure and BlackBerry Dynamics NOC The BlackBerry Infrastructure registers user information for device activation, validates licensing information for BlackBerry UEM and provides a trusted path between the organization and every user based on strong, cryptographic, mutual authentication. The BlackBerry Dynamics NOC is a separately-located network operations center that provides secure communications between BlackBerry Dynamics apps on devices and BlackBerry Control, BlackBerry Proxy, and BlackBerry Enterprise Mobility Server. 11

12 BlackBerry UEM Cloud BlackBerry UEM Cloud 4 BlackBerry UEM Cloud is an EMM solution from BlackBerry that helps you manage ios, macos, Android, Windows 10, and BlackBerry 10 devices for your organization. An easy-to-use, low-cost, and secure solution, BlackBerry hosts BlackBerry UEM Cloud over the Internet. You only need a supported web browser to access the service. BlackBerry UEM Cloud offers trusted end-to-end security and support for a wide range of devices and provides the control that organizations need to manage all endpoints and ownership models. Key benefits of BlackBerry UEM Cloud include the following features: Feature Low total cost of ownership Speed of deployment Single web-based interface Flexible ownership models User and device reporting Simple user set up and enrollment Industry-leading mobile security Benefit BlackBerry UEM Cloud removes the need to install, manage, and update servers. BlackBerry UEM Cloud uses a web-based browser interface that doesn't require any server installation. You can go from purchase to service availability in minutes. Manage ios, macos, Android, Windows 10, and BlackBerry 10 devices all from a single management console. Use a set of customizable policies and profiles to manage BYOD, COPE, and COBO devices, and protect business information. Manage fleets of devices using comprehensive reporting and dashboards, dynamic filters, and search capabilities. Allow users to activate their own devices with BlackBerry UEM Self-Service. BlackBerry UEM Cloud leverages the BlackBerry Infrastructure to ensure data security across all devices. For more information about BlackBerry UEM Cloud, see the BlackBerry UEM Cloud content. Architecture: BlackBerry UEM Cloud For more information about the BlackBerry UEM Cloud architecture, see the BlackBerry UEM Cloud Architecture content. 12

13 BlackBerry UEM Cloud Component BlackBerry UEM Cloud BlackBerry Connectivity Node BlackBerry UEM Cloud is a service that allows you to manage devices used in your organization's environment. The BlackBerry Connectivity Node is an optional component that you install inside your organization's firewall. It includes five components that add functionality to BlackBerry UEM Cloud: The BlackBerry Cloud Connector connects BlackBerry UEM Cloud to your company directory behind the firewall to allow basic attribute synchronization, search functionality, and user authentication services. BlackBerry Proxy maintains a secure connection between your organization and the BlackBerry Dynamics NOC, which allows BlackBerry Dynamics apps to communicate securely with your organization's resources behind the firewall. The BlackBerry Gatekeeping Service sends commands to Exchange ActiveSync to add devices to an allowed list when devices are activated on BlackBerry UEM Cloud. BlackBerry Secure Connect Plus provides a secure IP tunnel between work apps on devices and your organization's network. The BlackBerry Secure Gateway provides a secure connection through the BlackBerry Infrastructure and BlackBerry UEM Cloud to your organization's mail server for ios devices. 13

14 BlackBerry UEM Cloud Component BlackBerry Infrastructure and BlackBerry Dynamics NOC The BlackBerry Infrastructure registers user information for device activation and validates licensing information. If you enable BlackBerry Secure Connect Plus or the BlackBerry Secure Gateway, data in transit that uses these services passes though the BlackBerry Infrastructure. The BlackBerry Dynamics NOC is a separately-located NOC that provides secure communications between BlackBerry Dynamics apps on devices and BlackBerry Proxy. Devices Company directory BEMS and BlackBerry plugins BlackBerry UEM Cloud supports ios, macos, Android, Windows, and BlackBerry 10 devices. BlackBerry UEM Cloud supports connectivity with your organization's Microsoft Active Directory or LDAP company directory using the BlackBerry Connectivity Node. The cloud version of BlackBerry Enterprise Mobility Server provides BlackBerry Push Notifications, which accepts push registration requests from ios and Android devices and then communicates with Microsoft Exchange to monitor the user's work mail account for changes. BlackBerry UEM Cloud works with additional BlackBerry enterprise products such as BlackBerry Enterprise Identity, BlackBerry 2FA, and BlackBerry Workspaces to allow you to extend UEM capabilities in your organization. For more information, see the Discover BlackBerry UEM plug-ins content. Microsoft Azure Active Directory Microsoft Azure Active Directory is a cloud-based directory management service. If your organization uses Azure Active Directory you can connect to it instead of, or in addition to, a company directory behind the firewall. 14

15 BlackBerry Enterprise Mobility Suites BlackBerry Enterprise Mobility Suites 5 BlackBerry Enterprise Mobility Suites include BlackBerry UEM, BlackBerry Dynamics, and additional services under one license to offer a comprehensive unified endpoint management solution that provides mobile collaboration and a trusted endto-end approach to security. Suite BlackBerry Enterprise Mobility Suite - Management Edition Features Cross-platform support for ios, macos, Android (including Samsung KNOX), Windows 10, and BlackBerry 10 devices BlackBerry UEM with support for Work and personal - Corporate activations for BlackBerry 10 devices, MDM controls, and User privacy activations for most device types, and Work space only activations for Android devices BlackBerry Dynamics with support for MDM, MAM, and BlackBerry Access Cloud and on-premises deployment options BlackBerry Enterprise Mobility Suite - Enterprise Edition All BlackBerry Enterprise Mobility Suite - Management Edition features BlackBerry Work BlackBerry Enterprise Mobility Suite - Collaboration Edition All BlackBerry Enterprise Mobility Suite - Enterprise Edition features Advanced BlackBerry UEM security and connectivity features for managing ios, Android (including Samsung KNOX Workspace), and BlackBerry 10 devices Secure instant messaging using BlackBerry Enterprise IM and BlackBerry Connect Secure access to work content using BlackBerry Secure Connect Plus and BlackBerry Docs Unlimited deployment of BlackBerry Dynamics secured apps from third-party software vendors Complete cloud service federation and single sign-on solution using BlackBerry Enterprise Identity Two-factor authentication enabled through users' devices for authentication to BlackBerry apps and Microsoft Office 365 with BlackBerry 2FA BlackBerry Enterprise Mobility Suite - Application Edition All BlackBerry Enterprise Mobility Suite - Collaboration Edition features Unlimited deployment of customer-developed BlackBerry Dynamics secured apps Custom shared services app integration Full two-factor authentication enabled through users' devices with BlackBerry 2FA 15

16 BlackBerry Enterprise Mobility Suites Suite Features Data gathering and usage metrics from BlackBerry Dynamics apps on your users' devices using BlackBerry Analytics BlackBerry Enterprise Mobility Suite - Content Edition All BlackBerry Enterprise Mobility Suite - Application Edition features Enterprise file synchronization and sharing, access control, and document rights management with BlackBerry Workspaces BlackBerry Enterprise Mobility Suite components This diagram shows how the products and services included with BlackBerry Enterprise Mobility Suites work together with BlackBerry UEM. 16

17 BlackBerry Enterprise Mobility Suites Component name BlackBerry UEM Core BlackBerry 2FA module The BlackBerry UEM Core is the central component of the BlackBerry UEM architecture. BlackBerry 2FA provides two-factor authentication to your organization's resources. The BlackBerry 2FA module is a component of the BlackBerry UEM Core that receives authentication requests from the BlackBerry 2FA server or BlackBerry Enterprise Identity and sends requests to users' device. BlackBerry 2FA is included with the BlackBerry Enterprise Mobility Suite - Collaboration Edition for user authentication only with Microsoft Office 365 and with BlackBerry enterprise products. BlackBerry 2FA is included with BlackBerry Enterprise Mobility Suite - Application Edition, and BlackBerry Enterprise Mobility Suite - Content Edition for all supported uses. 17

18 BlackBerry Enterprise Mobility Suites Component name BlackBerry Enterprise Identity plug-in for BlackBerry UEM BlackBerry Enterprise Identity provides a single sign-on solution to users and unified management for administrators across a number of cloud and SaaS services. The BlackBerry Enterprise Identity plug-in for BlackBerry UEM allows administrators to manage Enterprise Identity from the BlackBerry UEM console. BlackBerry Enterprise Identity is included with the BlackBerry Enterprise Mobility Suite - Collaboration Edition, BlackBerry Enterprise Mobility Suite - Application Edition, and BlackBerry Enterprise Mobility Suite - Content Edition. BlackBerry Workspaces plugin for BlackBerry UEM The BlackBerry Workspaces plug-in for BlackBerry UEM integrates Workspaces management into the BlackBerry UEM management console. The BlackBerry Workspaces plug-in for BlackBerry UEM is part of BlackBerry Workspaces and is included with the BlackBerry Enterprise Mobility Suite - Content Edition. BlackBerry UEM database BlackBerry Control BlackBerry Control database BlackBerry Collaboration Service The BlackBerry UEM database is a relational database that contains user account information and configuration information that BlackBerry UEM uses to manage devices. BlackBerry Control sends user, policy, and other configuration data to BlackBerry Dynamics apps on devices. The BlackBerry Control database is the repository used by BlackBerry UEM to store user, app, and policy information for BlackBerry Dynamics apps. The BlackBerry Collaboration Service provides an encrypted connection between your organization's instant messaging server and the BlackBerry Enterprise IM app on BlackBerry 10 devices. The BlackBerry Collaboration Service is part of BlackBerry Enterprise IM and is included with the BlackBerry Enterprise Mobility Suite - Collaboration Edition, BlackBerry Enterprise Mobility Suite - Application Edition, and BlackBerry Enterprise Mobility Suite - Content Edition. BlackBerry Proxy Management console and BlackBerry UEM Self-Service BlackBerry Enterprise Mobility Server BlackBerry Enterprise Mobility Server databases BlackBerry Proxy maintains the secure connection between your organization and the BlackBerry Dynamics NOC. The management console and BlackBerry UEM Self-Service is a web-based console that provides administrator and user access to BlackBerry UEM and other integrated BlackBerry enterprise products. BEMS consolidates several services used to send work data to and from BlackBerry Dynamics apps, including: BlackBerry Mail, BlackBerry Connect, BlackBerry Presence, and BlackBerry Docs. The BEMS databases store user, app, policy, and configuration information. 18

19 BlackBerry Enterprise Mobility Suites Component name BlackBerry Push Notifications BlackBerry Connect BlackBerry Presence BlackBerry Docs BlackBerry 2FA server BlackBerry Push Notifications accepts registration requests from ios and Android devices and then communicates with Microsoft Exchange to monitor users' work mail accounts for changes. BlackBerry Connect provides secure instant messaging, company directory lookup, and user presence information to ios and Android devices. BlackBerry Presence provides real-time presence status to third-party BlackBerry Dynamics apps. BlackBerry Docs lets your BlackBerry Dynamics app users access, synchronize, and share documents using their work file server, SharePoint, Box, and content management systems supporting CMIS, without the need for VPN software, firewall reconfiguration, or duplicate data stores. BlackBerry 2FA provides two-factor authentication to your organization's resources. The BlackBerry 2FA server communicates with your work VPN and the BlackBerry 2FA service in BlackBerry UEM to send the request for the second factor to a user's devices. The BlackBerry 2FA server is part of BlackBerry 2FA and is included with the BlackBerry Enterprise Mobility Suite - Application Edition and BlackBerry Enterprise Mobility Suite - Content Edition. BlackBerry Workspaces servers BlackBerry Workspaces is a secure file management platform that allows users to securely access, synchronize, edit, and share files and folders using a Web browser or apps on Windows or macos tablets and computers or on ios, Android, and BlackBerry 10 devices. The BlackBerry Workspaces servers are part of BlackBerry Workspaces, which is included with the BlackBerry Enterprise Mobility Suite - Content Edition. For more information on components within BlackBerry UEM, see the BlackBerry UEM Architecture content. 19

20 Additional enterprise server products Additional enterprise server products 6 BlackBerry offers several products that your organization can use to add features and functionality to BlackBerry UEM. Some enterprise products require you to have a BlackBerry UEM installation or BlackBerry UEM Cloud. These products work with BlackBerry UEM to provide additional capabilities to your organization, such as identity management and device capabilities. Some products can be implemented independently from BlackBerry UEM. Many of the products that work independently can also be integrated with BlackBerry UEM, either on their own or as part of one of the BlackBerry Enterprise Mobility Suites. Component BlackBerry UEM BlackBerry UEM Cloud BlackBerry 2FA BlackBerry UEM is a unified endpoint management service that allows you to manage devices used in your organization's environment. BlackBerry UEM Cloud provides most of the unified endpoint management features of the on-premises version of BlackBerry UEM in a cloud environment. BlackBerry 2FA provides your users with two-factor authentication to your organization s resources. Target systems can include VPNs, network gateways, and, when it is deployed with BlackBerry Enterprise Identity, cloud services. 20

21 Additional enterprise server products Component BlackBerry Enterprise Identity BlackBerry Workspaces BlackBerry WorkLife BlackBerry Analytics SecuSUITE for Enterprise BlackBerry AtHoc BlackBerry Enterprise Identity provides single sign-on to cloud services, such as Workspaces, Box, WebEx, and Salesforce, for your users. BlackBerry Workspaces is an enterprise file synchronization and sharing solution that allows users to share, edit, and control their files on every device, including Windows or macos computers and ios, Android, and BlackBerry 10 devices. BlackBerry WorkLife is a split-billing solution and virtual SIM platform that allows organizations to keep track of work-related voice and data usage on users' devices. BlackBerry Analytics is a web-based tool that you can use to view information about devices and BlackBerry Dynamics apps in your organization's environment. SecuSUITE for Enterprise is a software-based solution hosted in the BlackBerry Infrastructure that provides secure calling and text messaging on mobile devices, safeguarding your organization s sensitive conversations against electronic eavesdropping. BlackBerry AtHoc Networked Crisis Communication is a comprehensive emergency mass notification system used by military, government, and commercial organizations to provide physical security, force protection, and personnel accountability for their workforce. It empowers organizations to communicate internally and externally with their people and partnered organizations, anytime, anywhere, across multiple devices. If you have both BlackBerry AtHoc and BlackBerry UEM, you can use BlackBerry UEM Notifications to message users via SMS, phone, and directly from the UEM console. BlackBerry 2FA BlackBerry 2FA provides users with two-factor authentication to your organization s resources. It allows you to use your users ios, Android, BlackBerry 10, or BlackBerry OS (version 6.0 to 7.1) devices as the second factor of authentication when users connect to your organization s resources. BlackBerry 2FA prompts users for confirmation on their device when they attempt to access one of your resources. For users who don't have a mobile device or have a mobile device that doesn't have sufficient connectivity to support the realtime BlackBerry 2FA, you can issue standards-based one-time password (OTP) tokens. The first authentication factor is the user's directory password, and the second authentication factor is a dynamic code that appears on the token's screen. You manage BlackBerry 2FA from the BlackBerry UEM or BlackBerry UEM Cloud management console. You can also install a BlackBerry 2FA server in your network. The BlackBerry 2FA server allows you to leverage services such as a VPN gateway or REST endpoint to provide users with access to those resources. BlackBerry 2FA is integrated with BlackBerry Enterprise Identity. If you do not install the BlackBerry 2FA server, you can use BlackBerry 2FA to provide a second factor of authentication for the resources that you manage access to with Enterprise Identity. 21

22 Additional enterprise server products BlackBerry 2FA can be purchased separately or licensed with the BlackBerry Enterprise Mobility Suite - Application Edition or BlackBerry Enterprise Mobility Suite - Content Edition. Two-factor authentication enabled through users' devices for authentication to BlackBerry apps and Microsoft Office 365 only is available with the BlackBerry Enterprise Mobility Suite - Collaboration Edition. For more information about BlackBerry 2FA, see the BlackBerry 2FA content. Architecture: BlackBerry 2FA Component User's computer or device BlackBerry 2FA server (optional) VPN gateway (optional) The user's computer or device is any device that the user wants to connect to a resource that requires two-factor authentication. The BlackBerry 2FA server connects to the BlackBerry 2FA module in BlackBerry UEM to find the devices associated with a user and to send authentication requests to the BlackBerry 2FA app that's installed on the devices. The BlackBerry 2FA server is supported only with onpremise installations of BlackBerry UEM. The VPN gateway is a computer that accepts VPN connections to your organization's network. The VPN gateway requires the BlackBerry 2FA server. 22

23 Additional enterprise server products Component REST API (optional) BlackBerry Enterprise Identity (optional) BlackBerry 2FA module within BlackBerry UEM User's device with BlackBerry 2FA or an OTP token The REST API is a customer-defined, on-premises service that authenticates users who access it through the BlackBerry 2FA server's REST API client. The VPN gateway requires the BlackBerry 2FA server. BlackBerry Enterprise Identity provides users with single sign-on to cloud services, such as Workspaces, Box, Cisco WebEx, and Salesforce. Enterprise Identity can connect directly to the BlackBerry 2FA service in BlackBerry UEM. The BlackBerry 2FA module within BlackBerry UEM provides the connection to the devices that are used as the second factor for authentication. The devices can be managed by BlackBerry UEM or activated with BlackBerry UEM only for BlackBerry 2FA. For ios and Android devices, BlackBerry 2FA is included with the BlackBerry UEM Client. For BlackBerry 10 and BlackBerry OS (version 6 to 7.1) devices, users must install the BlackBerry 2FA app. Users who don't have a supported mobile device can use a one-time password (OTP) token. BlackBerry Enterprise Identity BlackBerry Enterprise Identity provides single sign-on (SSO) to cloud services such as Microsoft Office 365, G Suite, BlackBerry Workspaces, and many others. With single sign-on, users don't have to complete multiple log ins or remember multiple passwords. Administrators can also add custom services to Enterprise Identity to give users access to internal applications. Users can access the services from any device they want to use, such as ios, Android, or BlackBerry 10 devices and other computing platforms. Administrators use the BlackBerry UEM management console to add services, manage users, and to add and manage additional administrators. The integration with BlackBerry UEM makes it easy to manage users and entitle them to access cloud applications and services from their devices. Using BlackBerry UEM, cloud services and mobile app binaries can be bundled together and then simply assigned to a user, or group of users. Enterprise Identity can be purchased separately or licensed with the BlackBerry Enterprise Mobility Suite - Collaboration Edition, BlackBerry Enterprise Mobility Suite - Application Edition or BlackBerry Enterprise Mobility Suite - Content Edition. For more information about Enterprise Identity, see the BlackBerry Enterprise Identity content. Architecture: BlackBerry Enterprise Identity 23

24 Additional enterprise server products Component Devices BlackBerry Enterprise Identity BlackBerry Infrastructure External cloud applications BlackBerry UEM with Enterprise Identity plug-in Company directory Users, including employees, employee candidates, partners, suppliers, and customers, who you want to have access to one or more cloud-based applications can authenticate from supported apps and from the browser on any device. BlackBerry Enterprise Identity is hosted in the BlackBerry Infrastructure. It provides single sign-on, mobile zero-sign-on, and multifactor authentication services for cloudbased SaaS applications. The BlackBerry Infrastructure is the BlackBerry network. It authenticates and authorizes users, devices, and enterprise software. Any cloud application, such as BlackBerry Workspaces, that you want to provide single sign-on access to for your users. The Enterprise Identity plug-in for BlackBerry UEM allows administrators to manage Enterprise Identity from the BlackBerry UEM or BlackBerry UEM Cloud management console. Enterprise Identity supports Microsoft Active Directory and LDAP company directories. 24

25 Additional enterprise server products Component Internal cloud applications User's device with BlackBerry 2FA Internal cloud applications include any cloud-based application that users access through your organization's network. If you want to use two-factor authentication with Enterprise Identity, BlackBerry 2FA allows you to use your users devices as the second factor. For ios and Android devices, BlackBerry 2FA is included with the BlackBerry UEM Client. For BlackBerry 10 and BlackBerry OS (version 6 to 7.1) devices, users must install the BlackBerry 2FA app. BlackBerry Workspaces BlackBerry Workspaces is an enterprise file management platform that allows users to securely access, synchronize, edit, and share files and folders across multiple devices. BlackBerry Workspaces limits the risk for data loss or theft by embedding digital rights management security into every file, so your content remains secure and within your control, even after it is downloaded and shared with others. Users can access BlackBerry Workspaces from a Web browser and from apps on Windows and macos computers and on ios, Android, and BlackBerry 10 devices. Content is synchronized across all of a user's devices when they are online, allowing users to manage, view, create, edit, and annotate files from any device. The Workspaces administration console allows you to configure, manage, and enforce security policies on files, regardless of where the files reside and track all document activities and report on them for auditing purposes. If your organization has BlackBerry UEM or BlackBerry UEM Cloud, you can use the Workspaces plug-in for BlackBerry UEM to integrate Workspaces management into the BlackBerry UEM management console. If your organization also implements BlackBerry Enterprise Identity, you can use Enterprise Identity to manage user entitlement to Workspaces. For more information about Enterprise Identity see the BlackBerry Enterprise Identity content. BlackBerry Workspaces can be purchased separately or licensed with the BlackBerry Enterprise Mobility Suite - Content Edition. For more information about Workspaces, see the BlackBerry Workspaces content. BlackBerry WorkLife BlackBerry WorkLife is a split-billing solution and virtual SIM platform that allows organizations to keep track of work-related voice and data usage on users' devices. BlackBerry WorkLife Data allows you to track and reimburse users for work-related data usage (for example, when they use work apps). BlackBerry WorkLife Persona allows you to track and reimburse users for voice calls and SMS messages using a work phone number that you assign to a user. 25

26 Additional enterprise server products BlackBerry WorkLife Persona When you use WorkLife Persona to manage work phone numbers, you can: Accurately manage and reduce costs by tracking the voice calls and text messages Conveniently monitor and report work-related voice and message activity without visibility into users' personal lives Easily address legal and compliance requirements associated with the exchange of sensitive information (for example, by recording calls in real-time and archiving text messages into existing enterprise ediscovery solutions) To use WorkLife Persona, users must install the BlackBerry WorkLife app. The WorkLife app is supported on devices running Android 5.0 or later and iphone 5 or later devices that run ios 8.0 or later. BlackBerry WorkLife Data BlackBerry WorkLife Data allows your organization to meter the amount of data an employee uses for work on their personal device so that you can reimburse the employee for only the data charges incurred when they use their personal device for work purposes. Employees can continue to use personal apps, but your organization does not track the amount of data used by personal apps. As an administrator, you can enable BlackBerry WorkLife Data for work apps. Work apps can be BlackBerry Dynamics apps or VPN-secured third-party apps. When the user uses a work app, WorkLife Data automatically tracks the amount of data that the app uses. For more information about WorkLife, see the BlackBerry WorkLife content. BlackBerry Analytics BlackBerry Analytics is a web-based tool that you can use to view information about the devices and BlackBerry Dynamics apps in your organization's environment. BlackBerry Dynamics apps send the following events to BlackBerry Analytics: App usage (launch count) Daily/monthly active users: app launch for individual unique users Crash count Time zone from the device setting Locale language from the device settings App name App version Operating system Minutes used BlackBerry Analytics does not collect or store any information that identifies a user. 26

27 Additional enterprise server products BlackBerry Analytics is included with the BlackBerry Enterprise Mobility Suite - Application Edition and the BlackBerry Enterprise Mobility Suite - Content Edition. For more information about BlackBerry Analytics, see the BlackBerry Analytics content. SecuSUITE for Enterprise SecuSUITE for Enterprise is a software-based solution that provides secure calling and text messaging for ios, Android, and BlackBerry 10 devices. With SecuSUITE for Enterprise, technology that was designed to protect national security has been adapted and optimized to secure your organization s communications against electronic eavesdropping and third-party attacks. SecuSUITE for Enterprise is hosted in the BlackBerry Infrastructure, which provides a direct connection to more than 600 carriers, allowing users to connect securely with the people they need to talk to across networks around the globe. SecuSUITE for Enterprise encryption and authentication processes run safely in the background of the device, without impacting performance or usability. The SecuSUITE for Enterprise app is available for ios, Android, and BlackBerry 10 devices. For BlackBerry 10 devices, the device must be activated with BES10 or BlackBerry UEM. Your organization can use the SecuSUITE for Enterprise app for ios and Android devices without BES10 or BlackBerry UEM. For more information about SecuSUITE for Enterprise, see the SecuSUITE for Enterprise content. BlackBerry AtHoc BlackBerry AtHoc Networked Crisis Communication is a comprehensive emergency mass notification system used by military, government, and commercial organizations to provide physical security, force protection, and personnel accountability for their workforce. BlackBerry AtHoc is FedRAMP authorized, which is a mandatory requirement for US federal agency cloud deployments. AtHoc empowers your organization to alert the people you care about, collect information from the field for situational awareness, account for people before, during, and after an event, and connect with external organizations to enable the connected community to manage events. Using AtHoc, your leaders can protect your personnel and operations through rapid communications, make informed decisions, and best position your organization to begin the recovery process for business continuity and sustained operational resilience. AtHoc provides the following benefits: Comprehensive end-to-end emergency notification system that unifies all communication modalities to alert everyone your organization cares about with a single click. Gives personnel in the field the ability to report events with rich geo-tagged media reports, plus a one-click "duress" button to report emergent situations for rapid response. Get status updates from select groups or all of your people to ensure your people are safe during emergencies, recall personnel, and conduct daily mustering. 27

28 Additional enterprise server products Share authoritative information with external targeted organizations, agencies, and the public in real-time during crises, empowering the connected community to collectively assess situations and provide a coordinated response to protect lives and property. Integrated weather alerts can access National Weather Service feeds to automatically trigger alerts based on weather type, severity, and location. Web-based user interface for user subscription, delivery preferences, and system administration. Message routing to targeted users. The Store-and-Forward capability saves alerts for desktop delivery when a user is offline and delivers them once a user s presence is detected, if the alert is still alive. For more information about BlackBerry AtHoc, see the AtHoc content. BlackBerry UEM Notifications BlackBerry UEM Notifications takes advantage of the BlackBerry AtHoc Networked Crisis Communication system to allow BlackBerry UEM administrators message users using SMS, phone, and directly from the UEM management console. This add-on simplifies communications to end users and user groups by eliminating the need for additional messaging solutions. BlackBerry UEM Notifications cuts through the clutter of everyday messages, resulting in more users taking action. BlackBerry UEM Notifications provides the following key capabilities: Leverage BlackBerry UEM for simplified communication Multiple delivery methods (text, phone, and ) Increased engagement from users For more information about BlackBerry UEM Notifications, see the the UEM Notifications administration content. 28

29 Enterprise apps Enterprise apps 7 BlackBerry offers several enterprise apps that administrators can push to devices or users can install to help them access work data and be more productive. Component BlackBerry UEM Client BlackBerry 2FA The BlackBerry UEM Client allows BlackBerry UEM to communicate with ios, Android, and Windows Phone devices. This app must be installed to activate ios, Android, and Windows Phone devices on BlackBerry UEM. On BlackBerry 10 and BlackBerry OS (version 6.0 to 7.1) devices, users must install the BlackBerry 2FA app to use their devices as a second authentication factor. For ios and Android devices, BlackBerry 2FA functionality is included with the BlackBerry UEM Client. BlackBerry Workspaces app BlackBerry Dynamics apps BBM Enterprise The BlackBerry Workspaces app allows you to access your BlackBerry Workspaces account to view, comment, notify, annotate, edit, and securely share your files with others. Files opened in the BlackBerry Workspaces app are controlled and protected at all times, ensuring that your organization s data remains safe. The BlackBerry Workspaces app is available for Windows and macos tablets and computers and ios, Android, and BlackBerry 10 devices. BlackBerry Dynamics productivity apps such as BlackBerry Work, BlackBerry Access, BlackBerry Connect, and BlackBerry Docs To Go provide users with access to work data and productivity tools. BBM Enterprise provides an additional layer of end-to-end encryption for BBM messages sent between BBM Enterprise users in your organization and other BBM users. 29

30 Enterprise apps BlackBerry UEM Client The BlackBerry UEM Client is an app that allows BlackBerry UEM to manage ios, Android, and Windows Phone devices. Users must install the BlackBerry UEM Client before activating an ios, Android, or Windows Phone device for mobile device management with BlackBerry UEM. Users can download the latest version of the BlackBerry UEM Client from the App Store for ios devices, from Google Play for Android devices or from the Windows app store for Windows Phone devices. After users activate their devices, the BlackBerry UEM Client allows users to do the following: Verify whether their devices are compliant with the organization's standards View the profiles that have been assigned to their user accounts View the IT policy rules that have been assigned to their user accounts Access work apps Create access keys for BlackBerry Dynamics apps Preauthenticate with BlackBerry 2FA (ios and Android only) Access a software OTP code Deactivate their devices For more information about the BlackBerry UEM Client, see the BlackBerry UEM Administrator content and the BlackBerry UEM Client end user content. BlackBerry Dynamics apps BlackBerry Dynamics productivity apps provide users with access to work data and productivity tools. BlackBerry Dynamics apps developed by BlackBerry include the following apps: App BlackBerry Work The BlackBerry Work app provides secure access to work and allows users to view and send attachments, create custom contact notifications, and manage their messages. For more information about BlackBerry Work, see the BlackBerry Work content. BlackBerry Access BlackBerry Access is a secure browser that allows users to access work intranets and web applications. BlackBerry Access also allows you to enable access to work resources or build and deploy rich HTML5 apps, while maintaining a high level of security and compliance. For more information about BlackBerry Access, see the BlackBerry Access content. 30

31 Enterprise apps App BlackBerry Connect BlackBerry Connect allows communication and collaboration with secure instant messaging, company directory lookup, and user presence from an easy-to-use interface on the user s device. For more information about BlackBerry Connect, see the BlackBerry Connect content. BlackBerry Tasks BlackBerry Tasks allows users to create, edit, and manage tasks that are synchronized with Microsoft Exchange. For more information about BlackBerry Tasks, see the BlackBerry Tasks content. BlackBerry Notes BlackBerry Notes allows users to create, edit, and manage notes that are synchronized with Microsoft Exchange on their mobile device of choice. For more information about BlackBerry Notes, see the BlackBerry Notes content. BlackBerry Docs To Go BlackBerry Docs To Go allows users to create, edit, and format Microsoft Word documents and Microsoft Excel spreadsheets that are stored in the app or shared from other BlackBerry Dynamics apps. Users can also view, edit, and present Microsoft PowerPoint presentations from their devices. For more information about BlackBerry Docs To Go, see the BlackBerry Docs To Go content. BlackBerry Share BlackBerry Share allows users to securely access, download, and share documents by integrating Microsoft SharePoint and other corporate repositories with users devices. For more information about BlackBerry Share, see the BlackBerry Share content. For more information about these apps, visit Discover BlackBerry Dynamics apps. You can also use BlackBerry Dynamics apps developed by one of BlackBerry's many third-party application partners. For a full list of publicly available apps, visit the BlackBerry Marketplace for Enterprise Software. You can also develop your own BlackBerry Dynamics apps using the BlackBerry Dynamics SDK. For more information, see the BlackBerry Dynamics SDK content. BBM Enterprise BBM Enterprise adds a layer of end-to-end encryption for BBM messages sent between BBM Enterprise users in your organization and other BBM users inside or outside of your organization. BBM Enterprise is available for ios, Android, BlackBerry 10, Windows, and macos devices. BBM Enterprise uses a FIPS validated cryptographic library. Your organization owns the encryption keys and no one else, not even BlackBerry, can access them. 31

32 Enterprise apps To allow users to use BBM Enterprise, you must use a legacy, stand-alone version of BlackBerry Enterprise Identity to assign BBM Enterprise to users. The required version of Enterprise Identity is provided with BBM Enterprise. After you enable users to use BBM Enterprise, users can download the BBM Enterprise app from the App Store, the Google Play store, or BlackBerry World. For more information about BBM Enterprise, see the BBM Enterprise content. 32

33 Enterprise SDKs Enterprise SDKs 8 BlackBerry offers several SDK options to help your organizaion customize your BlackBerry solution. Component BlackBerry UEM Integration SDK BlackBerry Dynamics SDK BlackBerry Analytics SDK BBM Enterprise SDK BlackBerry Web Services The BlackBerry UEM Integration SDK allows developers to create and deploy BlackBerry UEM plugins that allow for the tight integration of new features or services with an existing BlackBerry UEM installation. The BlackBerry Dynamics SDK allows developers to quickly and easily build their own secure productivity apps. The BlackBerry Analytics SDK works with the BlackBerry Dynamics SDK to send events from your custom apps to BlackBerry Analytics. The BBM Enterprise SDK provides a framework to develop real-time, end-to-end secure messaging capabilities in your own product or service. The BlackBerry Web Services are a collection of SOAP and REST web services that you can use to create applications to manage your organization's BlackBerry UEM domain, user accounts, and all supported devices. BlackBerry UEM Integration SDK The BlackBerry UEM Integration SDK allows developers to create plug-ins that extend the functionality of BlackBerry UEM version 12.7 or later. Using the UEM Integration SDK (which includes the UEM Integration plug-in for Eclipse) and the UEM Integration APIs, you can create and deploy BlackBerry UEM plug-ins that allow for the tight integration of new features or services with an existing BlackBerry UEM installation. BlackBerry UEM plug-ins provide the following benefits: Feature Add new features to BlackBerry UEM Integrate new services You can implement new features for user and device management, monitoring, reporting, integration with third-party systems, and more. You can integrate custom services with BlackBerry UEM to extend service-based functionality to device users. For example, the BlackBerry Workspaces plug-in allows an administrator to integrate Workspaces file-sharing services with an existing BlackBerry UEM domain. 33

34 Enterprise SDKs Feature Administrators can use the management console to assign the Workspaces service to users and groups and to configure and manage various aspects of the service, including distribution lists, workspaces, and document settings. Add UI components to the management console Leverage existing UEM features Leverage existing systems Add custom APIs You can expose the UI for new features or services in the management console, including configuration settings, enable and disable options, administrator permissions, and user assignment mechanisms. Features or services can also be implemented as "back-end" changes with no UI impact. The new features or services that you integrate with BlackBerry UEM can leverage the existing capabilities of the platform, including role-based authorization, high availability, group and user management, logging, monitoring, and licensing. You can integrate BlackBerry UEM plug-ins with and use data from existing systems, including an organization's company directory and key components of the BlackBerry Infrastructure (for example, the licensing infrastructure and provisioning servers). You can add new APIs to BlackBerry UEM that can be exposed on an existing BlackBerry UEM port. For example, you can implement APIs that allow a third-party product to obtain information about the status of activated devices. You can request the free UEM Integration SDK package from the Developers for Enterprise Apps portal. The SDK package gives you everything you need to get started, including the UEM Integration plug-in for Eclipse, several code samples, and API references. For more information about the BlackBerry UEM Integration SDK, see the BlackBerry UEM Integration SDK content BlackBerry Dynamics SDK The BlackBerry Dynamics SDK provides a powerful set of tools to ISV and enterprise developers, allowing them to focus on building their apps rather than learning how to secure, deploy, and manage those apps. The BlackBerry Dynamics SDK can be used to develop native, hybrid, and web apps for ios, macos, Android, and Windows devices, with services such as the following: Security services (e.g., secure communications and interapp data exchange APIs) Mobile services (e.g., presence, , push, directory lookup) Platform services (e.g., single sign-on authentication, indentity and access management, app-level controls for admins) For more information about the BlackBerry Dynamics SDK, see the BlackBerry Dynamics SDK content 34

35 Enterprise SDKs BBM Enterprise SDK The BBM Enterprise SDK provides a framework to develop real-time, end-to-end secure messaging capabilities in your own product or service. The BBM Enterprise SDK security model ensures that only the sender and intended recipient can see each message sent, and that messages aren't modified in transit between the sender and recipient. The BBM Enterprise SDK also provides the framework for other forms of collaboration and communication, such as push notifications, secure voice and video calls, and file sharing. You can even extend and create new types of real-time services and use cases by defining your own custom application protocols and data types. For more information about the BlackBerry Dynamics SDK, see the BBM Enterprise SDK for ios content or BBM Enterprise SDK for Android content BlackBerry Web Services The BlackBerry Web Services are a collection of SOAP and REST web services that you can use to create applications to manage your organization's BlackBerry UEM domain, user accounts, and all supported devices. You can use the BlackBerry Web Services to automate many tasks that administrators typically perform using the management console. For example, you can create an application that automates the process of creating user accounts, adds users to multiple groups, and manages users' devices. To use the BlackBerry Web Services to develop custom applications you should be proficient with Java or the Microsoft.NET Framework and in the use of XML, REST or SOAP, and WSDL. You should also be familiar with the configuration and administration of BlackBerry UEM, including the management of user accounts, groups, IT policies, software configurations, and security settings. The BlackBerry Web Services are installed when you install BlackBerry UEM. For more information about the BlackBerry Web Services, see the BlackBerry Web Services for BlackBerry UEM content. Architecture: BlackBerry Web Services and BlackBerry UEM 35

36 Enterprise SDKs Component BlackBerry Web Services Client application Collections of REST or SOAP web services that you can use to perform administrative tasks in your organization's BlackBerry UEM domain. A custom app that you can develop and integrate with the BlackBerry Web Services to manage user accounts and devices that are associated with BlackBerry UEM. The client applications you create use the administrator account credentials to authenticate with the BlackBerry Web Services. After an application is authenticated, the BlackBerry Web Services are initialized, and the BWS and BWSUtil web services are ready to receive API calls from the application. 36