Release Notes and Advisories Guide. BlackBerry UEM Version 12.7 and all maintenance releases

Transcription

1 Release Notes and Advisories Guide BlackBerry UEM Version 12.7 and all maintenance releases

2 Published: SWD

3 Contents Installing or upgrading the software...4 What's new in BlackBerry UEM...5 What's new in BlackBerry UEM version 12.7 MR2...5 What's new in the BlackBerry UEM 12.7 MR2 REST APIs... 7 What's new in BlackBerry UEM version 12.7 MR1...7 What's new in BlackBerry UEM What's new in the BlackBerry UEM 12.7 REST APIs Fixed issues in BlackBerry UEM Fixed issues in BlackBerry UEM 12.7 MR Fixed issues in BlackBerry UEM 12.7 MR Fixed issues in BlackBerry UEM Known issues Maintenance releases of the BlackBerry Connectivity app Legal notice...34

4 Installing or upgrading the software Installing or upgrading the software 1 You can use the setup application to install BlackBerry UEM version 12.7 MR2 or to upgrade from BES12 version 12.5.x, BlackBerry UEM version 12.6.x, or BlackBerry UEM version 12.7.x. When you upgrade the software, the setup application stops and starts all the BlackBerry UEM services for you. The BlackBerry UEM setup application backs up the database by default. 4

5 What's new in BlackBerry UEM What's new in BlackBerry UEM 2 This section contains a list of all the new features that have been introduced in BlackBerry UEM 12.7 and its maintenance releases. What's new in BlackBerry UEM version 12.7 MR2 Support for app-based PKI solutions Added support for app-based PKI solutions, such as Purebred, which can enroll certificates for BlackBerry Dynamics apps. You can now install the PKI app on devices and allow the latest versions of BlackBerry Dynamics apps, such as BlackBerry Work and BlackBerry Access, to use certificates enrolled through the PKI app. This option is supported only for ios devices. Multiple Apple Device Enrollment Program (DEP) account Added support for using multiple DEP accounts. If you have upgraded to BlackBerry UEM 12.7 MR2 and want to configure multiple DEP accounts, you must enable the feature. If you have installed BlackBerry UEM for the first time, the feature is enabled by default. Google account user management New controls prevent users from adding additional accounts in the Android workspace. Android activation Several changes have been made to the Android activation experience including more robust explanation about password requirements, the BlackBerry UEM Client is locked into the foreground during activation, and on several screens the back button has been removed. New IT policy rules Group name Display name Description Android work profiles Allow changing Wi-Fi settings Specify whether the user can change the settings in the work Wi-Fi profile. If this rule is not selected, the user can't change any settings in the profile, including their Wi-Fi connection credentials. 5

6 What's new in BlackBerry UEM Group name Display name Description Android work profiles Allow additional Google accounts Specify whether the user can add additional Google accounts to the work space. Android work profiles Disallowed account types Specify the types of accounts that cannot be added to the work space. If no account types are specified, there is no restriction. For more information, visit support.blackberry.com/kb/ to read article KB Android work profiles Allow NFC trust agent Specify if NFC can be used to unlock the device. Android work profiles Android work profiles Allow tags with basic authentication to unlock the device Allow secure NFC tags to unlock the device Specify if NFC tags that authenticate using the tag ID can be used to unlock the device. Specify if NFC tags that use challenge-response authentication can be used to unlock the device. Android work profiles Allow Bluetooth trust agent Specify if Bluetooth can be used to unlock the device. Android work profiles Allow places trust agent Specify if places can be used to unlock the device. Android work profiles Allow custom places Specify if a user can trust places other than Home. Android work profiles Allow Face trust agent Specify if face image can be used to unlock the device. Android work profiles Allow Voice trust agent Specify if voice can be used to unlock the device. Android work profiles Allow On-body trust agent Specify if On-body can be used to unlock the device. Android work profiles Trust agent inactivity timeout Specify Device inactivity timeout in minutes. When a device is in an idle state for a certain period of time, trust agents will be revoked. Android work profiles Allow obtaining device location Specify if work apps can obtain location of device. This policy will supersede any location profile assigned to the user. Android work profiles Allow transfer of work data using NFC Specify whether the device can send work data to another device using NFC. KNOX MDM Allow iris authentication Specify whether a user can authenticate with the device using an iris scan. KNOX MDM Allow facial authentication Specify whether a user can authenticate with the device using facial recognition. KNOX Premium - Workspace Allow iris authentication Specify whether a user can authenticate with the work space using an iris scan. 6

7 What's new in BlackBerry UEM What's new in the BlackBerry UEM 12.7 MR2 REST APIs For details about the new additions and changes discussed here, see the BlackBerry UEM 12.7 MR2 REST API Reference posted here. You can view the API reference online or download it (unzip the contents and open the index file). New paths and methods Resource: Users Path /{tenantguid}/api/v1/users/{userguid}/userdevices/ {userdeviceguid}/applications Description Retrieve a list of the assigned and installed apps for a specific user device. New data types Type Installation status User device application User device applications Description This data type provides the installation status of an app. This data type provides details of an assigned or installed app, including guid, disposition, status, name, version, and so on. This data type provides a collection of device apps. What's new in BlackBerry UEM version 12.7 MR1 Android Support for Android 8: BlackBerry UEM is now compatible with devices running Android 8 software. ios Support for ios 11: BlackBerry UEM is now compatible with devices running ios 11 software. AirPrint AirPrint profile update : The AirPrint profile has been updated to include a checkbox that allows the administrator to force the use of TLS, and a field for specifying a port number. 7

8 What's new in BlackBerry UEM Good Control to BlackBerry UEM synchronization Improved synchronization: When upgrading from Good Control to BlackBerry UEM, Good Control can communicate with BlackBerry Dynamics containers during the synchronization process, which helps to remove the risk of downtime for end users. Google Play and the Samsung KNOX Workspace Support installing specific apps from Google Play in Samsung KNOX Workspace: Administrators can now specify a list of apps from the Google Play Store that users can install in the Samsung KNOX Workspace. New IT Policy rules Device type Type Description ios Allow AirPrint (supervised only) Specify whether users can use AirPrint on the device. ios ios ios ios Allow AirPrint credentials storage (supervised only) Force trusted certificates for TLS (supervised only) Allow AirPrint ibeacon discovery (supervised only) Allow users to configure Wi-Fi settings (supervised only) Specify whether users can store AirPrint credentials using icloud Keychain. Specify whether the device must use trusted certificates with TLS to connect to printers using AirPrint. Specify whether the AirPrint app can use ibeacons to discover nearby printers. Specify whether users can configure Wi-Fi settings. If this rule is not selected, devices can only connect to Wi-Fi networks if the settings have been sent to the device by a configuration profile, for example a UEM Wi-Fi profile or using the Apple Configurator. ios Allow dictation (supervised only) Specify whether users can use dictation on the device. ios Allow user-configured VPN (supervised only) Specify whether a user can add a VPN configuration to the device. ios Allow system app removal (supervised only) Specify whether a user can remove system apps from the device. Android Default app permissions Specify whether app permission requests are granted or denied by default. If you select "Prompt user" the user is asked to grant or deny permissions. If you select "Always grant" the user is not prompted and permission requests are always granted. If you select "Always deny" the 8

9 What's new in BlackBerry UEM Device type Type Description user is not prompted and permissions requests are always denied. Android Allow lock screen features Specify whether special features can be enabled on the device lock screen. Android Allow camera on lock screen Specify whether users can access the device camera on lock screen. Android Allow notifications Specify whether the device can display notifications on the lock screen. Android Allow all notification content Specify whether all notification content can appear on the lock screen or only the notification type. Android Allow fingerprint authentication Specify whether the user can unlock the device using a fingerprint. Android Allow notification responses Specify whether the user can type a response to a notification on the lock screen. Android Allow trust agents Specify whether trust agents can unlock the device. What's new in BlackBerry UEM 12.7 This section contains a list of all the new features that have been introduced in BlackBerry UEM Microsoft Intune Microsoft Intune integration: For ios and Android devices, if you want to protect data in Microsoft Office 365 apps using the MAM features of Microsoft Intune, you can use Intune to protect app data while using BlackBerry UEM to manage the devices. Intune provides security features that protect data within apps. For example, Intune can require that data within apps be encrypted and prevent copying and pasting, printing, and using the Save as command. You can connect UEM to Intune, allowing you to manage Intune app protection policies from within the UEM management console. Note: The Microsoft API that allows UEM to connect to Intune is currently in Beta. Service interruptions could occur for this feature if Microsoft makes significant changes to the API. (JI ) Device management Wearable devices: You can activate and manage certain Android-based, head-worn wearable devices in BlackBerry UEM. For example, you can manage Vuzix M300 Smart Glasses. Smart glasses provide users with hands-free access to visual information such as notifications, step-by-step instructions, images, and video and allow users to issue voice commands, scan bar-codes 9

10 What's new in BlackBerry UEM and use GPS navigation. Examples of BlackBerry UEM management capabilities that are supported include: Device activation using QR codes, IT policies, app management and location services. (JI ) Apps App configuration: For Android apps that support app configuration (such as BlackBerry Productivity Suite), you can configure the settings in an app configuration instead of in an profile. You must be using Android work profiles to use this feature. (JI ) List of installed apps: You can specify whether BlackBerry UEM receives a list of apps that are installed in the user's personal space on ios, Android, Windows 10, and BlackBerry 10 devices in your environment. By default, the ability to view apps that are installed in the user's personal space is enabled when the device is activated using a supported activation type. You can view the list of apps that are installed in a user's personal space in the user account's device details page or the Personal apps page. (JI ) Note: You can also view apps that were installed on devices before they were activated as KNOX Workspace only devices. Viewing the list of personal apps installed in the user's personal space is not supported on devices that are activated with the following activation types: ios and Android: User privacy Android: Work and personal - user privacy Samsung KNOX: Work and personal - user privacy - (Samsung KNOX) BlackBerry 10: Work and personal - Corporate ios and Android: Device registration for BlackBerry 2FA only App update notifications: Device users are notified of any new or updated apps. There is a new "Updated/New" tab in the Work Apps list and in the Work apps section of the BlackBerry UEM Client. (JI ) Apple VPP account: You can configure the VPP account to automatically update VPP apps on devices. (JI ) Restricted apps: For Samsung KNOX devices activated with Work and personal - full control, you can create a compliance profile that enforces app restrictions in the personal space as well as the workspace. (JI ) VPP apps: You can associate VPP licenses to ios BlackBerry Dynamics app entitlements just as you can for other ios apps. You can associate VPP licenses when you assign apps (or app groups) to users or user groups. (JI ) Management console Bulk updates: The following are added to the list of commands that can be sent to multiple devices: Update device information; Delete all device data; Delete only work data; Remove devices; Change device ownership; and Update OS (for supervised ios devices. (JI ) Upload a certificate: User credential profiles now allow administrators or users to upload a certificate to push to devices. (JI ) 10

11 What's new in BlackBerry UEM Customize the consoles: You can add a custom background image for the log in screen, a custom logo, and a custom name for BlackBerry UEM Self-Service. (JI ) User certificate upload: User credential profiles now allow users to upload certificates to BlackBerry UEM that can be associated with Wi-Fi, VPN, and profiles. (JI ) Admin commands: The Remove device command lets you remove a device from BlackBerry UEM. (JI ) License expiration date: The Licensing summary page in the management console now always displays the license expiration date instead of displaying the date only within the warning period. (JI ) User search: On the top right corner of the User > Managed devices screen, there is a User search link that you can use as an alternative method to search for users by name. Note that if you log out of the console when you are on the User search screen, when you log back into the console you will be returned to the User search screen. (JI ) Login notice: The character limit that can be used in the login notice for the BlackBerry UEM management console and BlackBerry UEM Self-Service has been increased. The maximum number of characters is now 50,000. (JI ) Notes field: A notes field has been added for users. Administrators can use the notes field to keep track of any special information about the user. This information is stored against the user object and not against an individual device. If the user is removed, the information in the notes field is also removed. (JI ) Password complexity: In Settings > General settings > Activation defaults, administrators can specify minimum or maximum password complexity for automatically generated activation passwords. Administrators can specify password length as well as if lowercase letters, uppercase letters, numbers, or special characters are required for the password. (JI ) Gatekeeping profile: You can now configure the gatekeeping servers in a gatekeeping profile instead of in an profile. On upgrade to BlackBerry UEM 12.7, gatekeeping profiles are automatically created if you previously configured gatekeeping in profiles. (JI ) User role: A new user role setting allows you to configure whether or not users have permission to create access keys in BlackBerry UEM Self-Service. (JI ) Choose the BlackBerry Proxy cluster to use for activation: Select the Enabled for activation option for the BlackBerry Proxy instance that you want to use for activation purposes. (JI ) BlackBerry UEM Self-Service Activation password You can configureblackberry UEM Self-Service to send an activation to users when they create activation passwords using BlackBerry UEM Self-Service. (JI ) Device activation QR code activation: Users can activate ios and Android devices using a QR code instead of an activation password. You can send the QR code in an activation or users can create a QR code in BlackBerry UEM Self-Service. (JI ) 11

12 What's new in BlackBerry UEM Monitoring Event notifications: You can set up notifications so that s are sent to administrators when certain events occur in BlackBerry UEM or on devices. For each event notification you can configure a recipient list, select the days and times to send notifications, and select an template to use. (JI ) Monitor BlackBerry Work: You can monitor the performance of the BlackBerry Work app and choose the issues that you want to be reported. (JI ) ios Supervised devices: You can configure the activation profile to restrict devices in BlackBerry UEM that are not in supervised mode. If you restrict unsupervised devices, users cannot activate unsupervised devices whether they activate devices with the BlackBerry UEM Client or using DEP. (JI ) Logging: You can use the Get device logs command to retrieve device logs from ios devices that have the BlackBerry UEM Client installed (JI ) Update OS and other new commands: You can send the following new commands to ios devices. (JI ) Update OS (supervised DEP devices running ios 9 and later and supervised devices running ios 10.3 and later) Restart device (supervised devices running ios 10.3 and later) Turn off device (supervised devices running ios 10.3 and later) Android Android for Work: The BlackBerry UEM console and documentation is updated to reflect Google's rebranding of Android for Work. (JI ) Logging: You can use the Get device logs command to retrieve device logs from Android devices that have the BlackBerry UEM Client installed. (JI ) Samsung KNOX Organizational message: You can set an organizational message to appear when the device is locked or rebooted. (JI ) Wallpaper: You can set the wallpaper that displays on the device and the workspace. (JI ) Transferring contacts: Samsung KNOX Workspace devices support transferring contacts using the Bluetooth Phone Book Access Profile. This capability can be disabled by an IT policy rule. (JI ) 12

13 What's new in BlackBerry UEM Windows 10 App mode profile: You can use an app lock mode profile to limit Windows 10 Enterprise and Windows 10 Education devices managed using MDM to run only one app. For example, you can limit access to a single app for training purposes or for point-of-sales demonstrations. (JI ) SCEP profile: Administrators can now select a SCEP profile to associate with a Wi-Fi profile for Windows 10 devices. (JI ) FIPS mode and AutoConnect: Administrators can now enable FIPS mode and AutoConnect for Windows 10 devices in a Wi-Fi profile. FIPS mode can be enabled when WPA2-Personal or WPA2-Enterprise security type and the AES encryption type are selected. Administrators may choose to allow the device to connect automatically to the Wi-Fi network when it is in range. (JI ) Reboot: Administrators can now reboot a Windows 10 Mobile device running RS1 and later from the BlackBerry UEM console. (JI ) Windows Information Protection profile: Administrators can now configure additional options in Windows Information Protection profiles. For example, you can configure the work IP ranges that are considered to be part of the work network, any internal proxy servers to use when connecting to work network locations, and cloud resources that need to be protected, and a list of domains that can be used for work or personal resources. (JI ) Lock Down setting: Administrators can now enable the Lock Down setting in VPN profiles for Windows 10 devices. When this setting is enabled, the device stays connected to the VPN, must be connected to have a network connection, and cannot be disabled. (JI ) Device management Apple TV: You can activate and manage Apple TV devices in BlackBerry UEM. (JI ) BlackBerry Dynamics Certificates: BlackBerry Dynamics apps now support replacing certificates issued by BlackBerry Control with certificates issued by another CA. (JI ) PKI connector enhancements: User credential profiles now allow you to set certificate renewal and revocation options for certificates issues to users through the BlackBerry Dynamics PKI connector. (JI ) BlackBerry Dynamics Launcher Shortcuts: You can add shortcuts to the BlackBerry Dynamics Launcher so that users can quickly access web links. (JI ) 13

14 What's new in BlackBerry UEM BlackBerry Dynamics SDK No password required: With a security policy enforced by the BlackBerry Dynamics SDK and BlackBerry UEM, enterprises can allow users to start mobile applications without requiring a password. The No Password feature is available on ios, Android, macos, and Windows 10 (UWP). (JI ) Policy rules New policy rules were added for BlackBerry UEM To see the new rules, in the BlackBerry UEM Policy Reference Spreadsheet, in the 'Introduced in BES12/BlackBerry UEM Version' column click the arrow and select What's new in the BlackBerry UEM 12.7 REST APIs For details about the new additions and changes discussed here, see the BlackBerry UEM 12.7 REST API Reference posted here. You can view the API reference online or download it (unzip the contents and open the index file). New paths and methods Resource: Devices Path GET /{tenantguid}/api/v1/devices Description Search for devices. Resource: Groups Path POST /{tenantguid}/api/v1/groups/{groupguid}/users POST /{tenantguid}/api/v1/groups/{groupguid}/applications POST /{tenantguid}/api/v1/groups DELETE /{tenantguid}/api/v1/groups/{groupguid} DELETE /{tenantguid}/api/v1/groups/{groupguid}/users DELETE /{tenantguid}/api/v1/groups/{groupguid}/ applications/{appguid} Description Add user accounts to a user group by GUID. Assign apps to a user group by GUID. Create a user group. Delete a user group. Remove user accounts from a user group by GUID. Remove an app from a user group by GUID. Resource: Info 14

15 What's new in BlackBerry UEM Path GET /{tenantguid}/api/v1/info/systeminfo Description Get system info. Resource: Users Path GET /{tenantguid}/api/v1/users/{userguid} PATCH /{tenantguid}/api/v1/users/{userguid} GET /{tenantguid}/api/v1/users/{userguid}/applications GET /{tenantguid}/api/v1/users/{userguid}/groups GET /{tenantguid}/api/v1/users/{userguid}/services DELETE /{tenantguid}/api/v1/users/{userguid} GET /{tenantguid}/api/v1/users/{userguid}/userdevices GET /{tenantguid}/api/v1/users/{userguid}/userdevices/ {userdeviceguid} PUT /{tenantguid}/api/v1/users/{userguid}/profiles/ {profileguid}/certificate DELETE /{tenantguid}/api/v1/users/{userguid}/profiles/ {profileguid}/certificate Description Get the details of a user account by GUID. Update the password for a local (non-directory) user. Get all apps that are directly assigned to a user account. Get all user groups that a user account is assigned to. Get the services that are assigned to a user account. Remove the specified user account. Get the devices that are assigned to a user account. Get a specific device that is assigned to a user account. Add or update a certificate for a user credential profile that supports manually uploaded certificates. Remove a manually uploaded certificate from a user credential profile. New data types Type Application assignment Application assignments Certificate Device Devices Description An app that is (or can be) assigned to a user account or user group A collection of app assignments A certificate that is defined in BlackBerry UEM A device that is defined in BlackBerry UEM A collection of devices 15

16 What's new in BlackBerry UEM Type template types Enrollment types Link Profile categories Service Service assignment Service assignment statuses Service assignments SystemInfo User custom variable User detail User device User devices Description The types of templates that are supported The device enrollment types that are supported A link related to a resource; for example, a link between a user and the groups and profiles the user is associated with Profile categories that are supported Represents a service; for example, MDM (Mobile Device Management) is a service that can be associated with a user so that an administrator can manage the user s devices Represents a service that can be assigned The service assignment statuses that are supported A collection of service assignments System information; for example, activation URL, management console URL, product version, and so on A custom variable that is set for a user account The details of a user account A user s device that is defined in BlackBerry UEM A collection of user devices Changes to resources Resource: Users In the previous release, the following were organized under the Activation passwords resource. In this release, they have been moved into the Users resource: Path GET /{tenantguid}/api/v1/users/{userguid}/ activationpasswords POST /{tenantguid}/api/v1/users/{userguid}/ activationpasswords Description Get all of the non-expired activation passwords for a user account. Set one or more activation passwords for a user account. 16

17 What's new in BlackBerry UEM Path PUT /{tenantguid}/api/v1/users/{userguid}/ activationpasswords Description Replace all of the activation passwords for a user account. DELETE /{tenantguid}/api/v1/users/{userguid}/ activationpasswords Expire all of the activation passwords for a user account. DELETE /{tenantguid}/api/v1/users/{userguid}/ activationpasswords/{activationpasswordguid} Expire a specific activation password for a user account. The following request parameters have been added to GET /{tenantguid}/api/v1/users: Parameter includetotal Description Used to retrieve the total number of user accounts that match the search criteria, which may be different from the number of user accounts returned. max The maximum number of user accounts to return, between 1 and The default value is 100. offset sortby The number of user accounts to exclude from the beginning of the search results, greater than or equal to 0. Used to get pages of results, for example, with max=50 and offset=0 for the first 50 users, max=50 and offset=50 for the next 50 users, and so on. The default value is 0. The field to sort the results by. For GET /{tenantguid}/api/v1/users, the following fields have been added to the query request parameter: displayname guid directoryid groupguid profileguid For POST /{tenantguid}/api/v1/users, additional information has been added to the API reference to indicate the fields that are allowed when creating a directory-linked user or a local user, and information has been added about the Location response header. For POST /{tenantguid}/api/v1/users/{userguid}/activationpasswords and PUT /{tenantguid}/api/v1/users/{userguid}/ activationpasswords, the following response code has been added: 503: SMTP server temporarily unavailable to send s. Retry the request again later. 17

18 What's new in BlackBerry UEM Changes to data types Data type template Profile User Users Changes A default property has been added to indicate whether it is the default template. A default property has been added indicate whether it is the default profile for that category. A links property has been added to indicate links from a user to related resources, for example, groups and profiles. A total property has been added to indicate the total number of users that match the search criteria, which may be different from the number of user accounts returned. 18

19 Fixed issues in BlackBerry UEM Fixed issues in BlackBerry UEM 3 This section contains a list of all the issues that have been fixed since the release of BlackBerry UEM version Fixed issues in BlackBerry UEM 12.7 MR2 User and device management fixed issues When a device that has an associated managed Google account was activated, BlackBerry UEM reconciled all apps applicable to the device and published them to Google Play. (JI ) On a Samsung KNOX device, after an administrator assigned an app with the disposition set to "Optional" to a device, the user could not install the app on the device. (JI ) Wi-Fi profiles with proxy settings were not applied to devices running Android 8.0 or later that were activated with MDM controls or User privacy. If a device with one of these activation types was upgraded to Android 8.0 or later, the Wi-Fi profile was removed from the device. (JI ) A deadlock exception might have occurred in the BlackBerry UEM Core log file when you deactivated a device running Android 8.0 or later and then used a different activation type to reactivate the device. (JI ) On a Samsung KNOX device, apps that were hosted by BlackBerry UEM did not display in the Google Play store in the work space. (JI ) Management console fixed issues An error displayed when you tried to view a user's details. (JI ) You couldn't send an activation that contained a QR code to a user. (JI ) If you activated a device using the MDM controls activation type and then deactivated the device and reactivated it using the apps only activation type, the device might have displayed twice on the Managed devices page. (JI ) When you saved a network usage profile without making any changes to it, the values that you set in the Allow data roaming and Allow cellular data fields might have changed. (JI ) 19

20 Fixed issues in BlackBerry UEM If you had multiple Microsoft Active Directory connections configured and you entered an incorrect password when you logged in to the console, BlackBerry UEM attempted to communicate with all of the Microsoft Active Directory connections. This might have caused you to be locked out of your Microsoft Active Directory account if you had set the number of unsuccessful log in attempts to a small number. (JI ) For devices that used BlackBerry Dynamics and had been assigned a Gatekeeping profile, on the device tab the Gatekeeping profile might have displayed a status of Connection pending. (JI ) In the BlackBerry Dynamics profile, if you selected the Do not allow personal information option, personal information such as the user s first and last names were allowed in a password for BlackBerry Dynamics apps. (JI ) BlackBerry UEM API fixed issues The BlackBerry Web Services API call GetLicenseInfoRequest did not return the number of available licenses or the number of licenses used. (JI ) Fixed issues in BlackBerry UEM 12.7 MR1 Installation, upgrade, and migration fixed issues During installation, the setup application did not timeout if it could not connect with the BlackBerry UEM management console. (JI ) When you migrated BlackBerry 10 devices from BES10 to BlackBerry UEM 12.7, query timeouts might have caused device reactivation failures. (JI ) When you migrated BlackBerry 10 devices from one instance of BlackBerry UEM to another, deadlocks might have displayed in the BlackBerry UEM Core log file. (JI ) If your environment consisted of BES12 version 12.5 MR2 that was integrated with Good Control, when you upgraded to BlackBerry UEM 12.7, the BlackBerry Control service might not have started if the original Good Dynamics installation had special characters in the enterprise name. (JI ) User and device management fixed issues If you used the BlackBerry Dynamics apps only activation type to activate a device for a user, you could not activate a BlackBerry 10 device for the same user. (JI ) 20

21 Fixed issues in BlackBerry UEM After you activated the BlackBerry Access app on an ios device, if you opened the app and clicked the BlackBerry Dynamics launcher and tried to install an internal or custom BlackBerry entitlement app, an error message might have displayed. (JI ) On ios devices that were activated using the User privacy activation type, apps might not have been removed from the New/ Updates tab after the user tapped Install and devices might have received a daily notification for these apps on the New/ Updates tab. (JI ) If you removed an app shortcut from the home screen of an ios device, the shortcut might have installed on the home screen again. (JI ) If you were using a VPN profile and you upgraded to BlackBerry UEM 12.7, when you assigned the Cisco AnyConnect app to a user, the app did not prompt the user to accept the EULA to establish a connection with the device. (JI ) Management console fixed issues In the BlackBerry UEM console, when you navigated to the Settings > BlackBerry Enterprise Identity > Settings, or Settings > BlackBerry Enterprise Identity > Services pages, the console might have stopped responding. (JI ) If your environment consisted of BES12 version 12.5 MR2 that was integrated with Good Control, after you upgraded to BlackBerry UEM 12.7, an error message might have displayed when you tried to update a customized Good Dynamics app binary of a Good entitlement if the new app binary and the old app binary had the same major and minor version but a different build number. (JI ) On the Settings > Licensing page, the Licensing settings page did not display. (JI ) When a Junior HelpDesk administrator clicked on a user that had an activated device, an error message might have displayed. (JI ) When you posted an.apk file update for an Android app, even if the network location that hosted the app had enough free disk space, an error might have occurred. (JI , JI ) After you upgraded from BlackBerry UEM to BlackBerry UEM 12.7, on the Users > Exchange Gatekeeping page the status for gatekeeping users might not have displayed correctly. (JI ) When you created an enterprise connectivity profile and you selected the "Enable per-app VPN" option, and you created an app group and assigned it to a user, if you tried to assign a different enterprise connectivity profile to the user, no profiles were available in the list. (JI ) When you created a device group, any user groups that you created were not listed under the "Scope to user groups" section. (JI ) 21

22 Fixed issues in BlackBerry UEM If you were using Windows Internet Explorer 11, when you created a BlackBerry Dynamics profile and you clicked on the Edit button in the App authentication delegation section, you could not search for apps in the "Select apps for authentication delegation" list. For example if you searched for apps that contained the word "BlackBerry", no results displayed. (JI ) When you created a device profile for Android devices, the tool tip for the "Workspace wallpaper" field stated that it applied only to Samsung KNOX workspace devices but it applied to all KNOX devices except devices activated with the Work and personal - user privacy (Samsung KNOX) activation type. Also, the tooltip for the "Organization" notice field did not state that it applied only to KNOX devices. (JI ) On the Apps page, the number of users in the Applied users column displayed as 0 for apps that you assigned directly to users or through an app group. (JI ) If a user had more than one device activated that used BlackBerry Dynamics apps, on the User summary page you could not tell which user certificate belonged to which device. (JI ) UEM Self-Service fixed issues In UEM Self-Service, on the My devices > Apps page, the app icons might have displayed as generic grey icons. (JI ) Fixed issues in BlackBerry UEM 12.7 Installation, upgrade, and migration fixed issues When you upgraded from BlackBerry UEM 12.6 MR2, to BlackBerry UEM 12.7, the status of the BlackBerry Proxy Service displayed as Stopped on the Settings > Infrastructure > Instances page. (JI ) If you installed BlackBerry UEM 12.6 and you have assigned the BlackBerry Hub+ Services app to users, after you upgraded to BlackBerry UEM 12.7, the app configuration was not assigned to the users. (JI ) If you upgraded from BES12 version 12.5 MR1 to BlackBerry UEM 12.7, the BlackBerry Router service might have been listed twice on the Windows services page; once as "BES12 - BlackBerry Router" and once as "BlackBerry UEM - BlackBerry Router". (JI ) After you extracted the BlackBerry UEM 12.7 installation files, Windows could not find the Autorun.exe file and the UEM installation did not start automatically. (JI ) If you upgraded from BES12 version 12.5 MR1 to BlackBerry UEM, the BlackBerry Secure Connect Plus service might not have started. (JI ) 22

23 Fixed issues in BlackBerry UEM If you upgraded from BES12 version 12.5 MR1 to BlackBerry UEM, the BlackBerry Cloud Connector service might have been listed on the Windows services page. (JI ) After you installed BlackBerry UEM, on the Windows services page, the BlackBerry UEM Router was named BES12 - BlackBerry Router. (JI ) When you used the setup application to upgrade to BlackBerry UEM 12.6, on the Ports screen a red X icon might have displayed beside the Required ports section even when the ports were available. (JI ) After you upgraded from Good Control to BlackBerry UEM, you could not delete the old compliance profile from the management console. (JI ) BlackBerry Workspaces fixed issues You could not install the BlackBerry Workspaces snap-in on BlackBerry UEM (JI ) User and device management fixed issues When you added an app, if you typed a name in the Category field that contained a non-english character, the layout of the Google Play store did not update and users could not access the app. (JI ) When you enrolled Samsung devices with BlackBerry Secure Connect Plus, and upgraded the devices from Android 6 to Android 7, the certificates were deleted and a refresh did not recreate them. (JI ) Android devices with a work profile might have been blocked from synchronizing with Microsoft Exchange Server if you assigned and Gatekeeping profiles to the device. (JI ) You could not apply an app lock mode profile to Windows 10 devices that were running the RS2 build with OS bundle (JI ) When you created an profile and selected the "Enable BlackBerry Secure Gateway Service" option on the ios tab, you might not have been able to verify the user's account on the device. (JI ) When you navigated to Settings > BlackBerry Dynamics > Clusters and you created a cluster with a space in the name, if you created a Connectivity (BlackBerry Dynamics) profile and you used the cluster with the space in the name as one of the BlackBerry Proxy clusters, you could not edit and save the profile. (JI ) If you hosted a private app on BlackBerry UEM and you published the JSON file on the Google Play Store, the app would not install on devices running Android OS 7.x. (JI ) After you created an app configuration for any Android work profile app, and assigned the app and a Gatekeeping profile to an Android device that had a work profile, the device could not connect to a Microsoft Exchange Server. (JI ) 23

24 Fixed issues in BlackBerry UEM If you created an IT policy for Android devices and you selected the "Require certificate revocation (CRL) check for apps" option in the KNOX Premium - Device section, after you assigned the profile to a device the user could not activate it. (JI ) If a device was not pre-encrypted by a manufacturer, when you activated the device using the Work space only activation type and no Google domain, a fake Google account was created on the device, and device enrollment failed and the following message displayed: Google Play Store and Google Play Services may be outdated. (JI ) The icons for the BlackBerry UEM Client and BlackBerry Connectivity apps were not updated to the new versions. (JI ) A null pointer exception might have occurred in the BlackBerry UEM Core while it processed a managed application configuration result sent from an ios device. (JI ) A null pointer exception might have occurred in the BlackBerry UEM Core when an ios device queried BlackBerry UEM for available OS updates. (JI ) On an ios device, after you updated a custom BlackBerry Dynamics app, the Update button still displayed and the version number was truncated. (JI ) When the BlackBerry 2FA server returned HTTP status code 403 to an ios device, the device stopped responding for 30 seconds before reporting the error to the user. (JI ) Management console fixed issues After you added a user, if you immediately used the User search feature to search for the user, the user s name did not display in the search results. (JI ) If you created Web icon profiles, after you upgraded to BlackBerry UEM 12.7, on the Device group page in the Assigned IT policies and profiles column, incorrect text such as???jsp.scope.config.unknown??? displayed. (JI ) * When clicked on Refresh on the Apps screen, an error message might have displayed and you could not accept app permission for any apps that required it. (JI ) If you were using Windows Internet Explorer 11, and your environment included more than 90, 000 users, the user search feature did not work. (JI ) If your organization required a proxy on your internal network, you could not use Google Play with BlackBerry Secure Connect Plus and Android devices with a work profile. (JI ) When you created a SCEP profile, if you selected the "SCEP challenge type" option, you could not edit the profile after you saved it. (JI ) The "Manage BlackBerry Dynamics apps" permissions did not work if you selected the "Selected groups only" option when you created or edited an administrator role. (JI ) 24

25 Fixed issues in BlackBerry UEM When you created a compliance profile, if you selected the "Required Security patch level is not installed" option on the Android tab, no plus sign button (+) displayed so you could not add any security patches. (JI ) When you were using Internet Explorer 11 to use the management console, if you edited a BlackBerry Dynamics app, you could not save the changes. (JI ) If you disabled the View VPN options setting when you created an administrator role, after you assigned the role to an administrator, an error displayed when the administrator clicked on a user that had a VPN profile assigned to them. (JI ) If you used Microsoft Edge to view the management console, when you navigated to Settings > BlackBerry Dynamics > App services and clicked one of the services, then clicked the back arrow, the Edit app section displayed below the app list. (JI ) When you created a VPN profile and set the "Connection type" to "IKEv2", after you assigned the profile to an ios device, the xml payloads from BlackBerry UEM might not have matched the xml payloads from Apple Configurator and the VPN connection did not work. (JI ) When you used Safari to view the management console, the vertical scrollbar was invisible. (JI ) When you navigated to Settings > BlackBerry Dynamics > Properties, the Enable job to automatically remove duplicate containers (on/off)" option was selected. If you deselected the option and clicked Save, the option was turned off in the console and in the database. If you then selected the option again, the option was turned on in the console but not in the database. (JI ) When you created a BlackBerry Dynamics profile, if you set BlackBerry Work as primary, BlackBerry Access as secondary, and BlackBerry Connect as tertiary in the App authentication delegation section and you set the Require password after period of inactivity to 3 minutes, after the user activated BlackBerry Access on a device, if the user tapped on the launcher in BlackBerry Access and tapped on the link to open BlackBerry Work, after the user logged in, the device switched back to BlackBerry Access. (JI ) If you created a.csv file that included a user group with the Enterprise Identity app assigned, and used the file to import a user, in the console the user did not display as able to use Enterprise Identity. (JI ) When you created a company directory connection, if you selected the Enable onboarding and Onboard user with BlackBerry Dynamics apps only options, and you then removed the Enable onboarding option and clicked Save, an error displayed. (JI ) After you completed the synchronization of Good Control with BlackBerry UEM, if you deleted the BlackBerry Dynamics PKI authentication certificate that was created when you performed the synchronization and you navigated to Settings > External integration > Certification Authority and tested the connection for the BlackBerry Dynamics PKI connection, the connection failed. (JI ) 25

26 Fixed issues in BlackBerry UEM After you created a BlackBerry Dynamics internal app, if you opened the App and clicked "Upload a template," an error displayed. (JI ) When you were adding a compliance profile, the list of restricted OS versions for macos did not include build numbers, which caused the macos device to display as Unknown in the OS column on the device page. (JI ) Some BlackBerry Dynamics apps displayed in the app list even if they were unavailable. When you clicked on one of the apps, an error message displayed. (JI ) When you created a compliance profile that had the same name as an existing profile, after you clicked Add, the page did not display correctly. (JI ) If you navigated to Settings > BlackBerry Dynamics > Clusters, and renamed one of the clusters and clicked Save, the change was not saved. (JI ) If you navigated to Settings > BlackBerry Dynamics > App services, and edited one of the services, after you clicked Save, the changes were not saved. (JI ) You could not create a compliance profile for macos devices when you selected the following options: (JI ) "Restricted device model detected" Set the "Device model restrictions" list to "Do not allow device selected device models" After you clicked Edit, you set the Restricted device model list to "imac" Set the "Enforcement action" list to "Delete all data" Did not enter any data in the "Find my Mac PIN" field If you tried to replace directory groups that were associated with your organization's LDAP company directory, the directory groups for your organization's Microsoft Active Directory company directory were removed. Also, if you tried to replace directory groups that were associated with your organization's Microsoft Active Directory company directory, the directory groups for your organization's LDAP company directory were removed. (JI ) On the Settings > templates page, when you created a custom template, if you clicked on the Suggested text link and copied and pasted the text into the body of the message, the formatting of the text was incorrect. (JI ) When you were on the Apps page, if you tapped on a BlackBerry Dynamics app to view the app details, an error message might have displayed that stated no app details were available. (JI ) On the Apps page, if you clicked on the BlackBerry Access app, added an app configuration to the app, and then clicked Save, an error displayed. (JI ) When you used the MDM controls activation type to activate a Windows 10 device, after you installed an app on the device, the app displayed as "Not installed" on the App details page in the console. (JI ) 26

27 Fixed issues in BlackBerry UEM If you assigned a BlackBerry Dynamics profile to a user when the BlackBerry Control service was stopped, an error message displayed. (JI ) On the Users page, some device models might have displayed as Unknown. (JI ) When you clicked Assign to assign a profile to a user, the profile might not have been assigned and the console continued to display the Assign a profile page. (JI ) After you added a BlackBerry Dynamics app to a device, if you added a newer version of the app, on the device tab the app might have displayed as Not installed even when the app was installed. (JI ) When you added an ios app, if you tried to upload a template without filling out all of the fields, the upload failed. (JI ) When you navigated to Settings > BlackBerry Dynamics > App services and clicked on a service, if you changed the description and clicked Save, the change was not saved. (JI ) After you created a web content filter profile and assigned the profile to a user, if you clicked on the profile on the user page, the entries to the "Specific website bookmarks" section were cut off. (JI ) When you created certain profiles, such as proxy profiles, under the "Show device types to configure the profile for *" label, if you clicked on one of the device OS labels the corresponding device OS checkbox was not cleared or selected. (JI ) After you added internal BlackBerry Dynamics apps, on the Apps page the background color for the apps displayed in different shades. (JI ) On the Company directory connection page, if you edited a Microsoft Active Directory connection, and then pressed Enter to save your changes, an error message displayed. (JI ) On a user's page, when you navigated to BlackBerry Dynamics access keys > Send icon, and clicked Send, on the Resend access key screen, the Send button remained active and you could click the button again even though you didn't need to. (JI ) You could not save any changes to a company directory if any of your domain controllers were unavailable. (JI ) On the device page for a user, if you clicked the App actions drop-down list, there was a delay of 4-5 seconds before the options displayed. (JI ) BlackBerry UEM API fixed issues When you called the BlackBerry UEM SOAP API endpoints that were hosted on the BlackBerry UEM Core, if the URL that the client provided ended with a slash (/), the API call failed with a "401 Unauthorized" error. (JI ) 27