Getting Started Guide

Transcription

1 Getting Started Guide BlackBerry UEM Version 12.6 Maintenance Release 2

2 Published: SWD

3 Contents Getting started with BlackBerry UEM and BlackBerry Dynamics...5 Steps to get started with BlackBerry UEM and BlackBerry Dynamics... 5 Log in to BlackBerry UEM for the first time...7 Synchronizing Good Control with BlackBerry UEM...7 Considerations for synchronizing Good Control with BlackBerry UEM...8 Prerequisites: Synchronize Good Control with BlackBerry UEM Synchronize Good Control with BlackBerry UEM Configuring BlackBerry UEM for the first time...12 Configuring BlackBerry Dynamics profiles Create a BlackBerry Dynamics connectivity profile Create a BlackBerry Dynamics profile Managing BlackBerry Dynamics compliance profiles...19 Managing BlackBerry Dynamics apps Adding BlackBerry Dynamics apps to the app list Manage settings for a BlackBerry Dynamics app Add the work app catalog to the BlackBerry Dynamics Launcher...28 Create an app group that contains all of the BlackBerry Dynamics apps...29 Managing users and groups Creating and managing user groups Create a user account...33 Assign the BlackBerry Dynamics profile to a user group...36 Assign the BlackBerry Dynamics profile to a user account Assigning apps and app groups to user groups and user accounts Activating devices...42 Create an activation profile Assign the activation profile to a user group...48 Assign the activation profile to a user account Steps to prepare users for device activation on BlackBerry UEM...48 Generate access keys for BlackBerry Dynamics apps Manage BlackBerry Dynamics access keys Reference: Finding Good Control features in BlackBerry UEM... 53

4 Appendix: Configuring BlackBerry UEM for BlackBerry Work...55 Configure BlackBerry Work app settings...55 BlackBerry Work app configuration settings Configure BlackBerry Work connection settings...61 Appendix: Configuring BlackBerry UEM for BlackBerry Connect...63 Configure the BlackBerry Connect app settings BlackBerry Connect app configuration settings Configure BlackBerry Connect connection settings...65 Appendix: Configuring BlackBerry UEM for BlackBerry Access...67 Configure BlackBerry Access app settings...67 BlackBerry Access app configuration settings Legal notice...78

5 Getting started with BlackBerry UEM and BlackBerry Dynamics 1 This document outlines how to get started with BlackBerry UEM and BlackBerry Dynamics. With BlackBerry UEM and BlackBerry Dynamics, you get unparalleled features and flexibility. For existing BlackBerry UEM environments, here are some of the advantages you get when you add BlackBerry Dynamics to your environment: Best-in-class secure mobile app platform BlackBerry Work and collaboration apps optimized for business-class user experience Ecosystem of more than 2000 secure mobile apps and Open API SDK Cross-platform support for ios, Android, OS X, and Windows devices, desktops, and wearables For existing BlackBerry Dynamics environments, here are some of the advantages you get when add BlackBerry UEM to your environment: Simplified BlackBerry Dynamics end-user enrollment experience Best-in-class MDM/MAM/EMM, including Apple DEP and VPP, BlackBerry Secure Gateway Service, and support for Samsung KNOX Workspace and Android for Work Comprehensive EMM platform, extensible to a rich portfolio of secure mobile apps and services, such as BlackBerry Workspaces, BlackBerry 2FA, and BlackBerry Enterprise Identity Steps to get started with BlackBerry UEM and BlackBerry Dynamics Step Action Install BlackBerry UEM or upgrade to the latest version of BlackBerry UEM. Refer to the BlackBerry UEM Installation and Upgrade content for details. If you are using BlackBerry Work or BlackBerry Connect, install and configure the BlackBerry Enterprise Mobility Server. Log in to BlackBerry UEM and complete the post installation steps. 5

6 Step Action If you have an existing BlackBerry Dynamics environment, synchronize Good Control with BlackBerry UEM to enable BlackBerry UEM version 12.6 features and move your Good Control settings to BlackBerry UEM. Determine whether there are any other configuration tasks to complete. These tasks are optional based on your organization's needs. Check BlackBerry Dynamics connectivity settings and change them if necessary. Create a BlackBerry Dynamics profile or update the Default BlackBerry Dynamics profile. Add BlackBerry Dynamics apps to BlackBerry UEM so that you can manage them and assign them to users. If required, change BlackBerry Dynamics apps settings. Add the work app catalog to the BlackBerry Dynamics Launcher If required, manage compliance profiles. Control how devices are activated and managed in BlackBerry UEM using activation profiles. Create any necessary user groups or user accounts. Assign the BlackBerry Dynamics profile to a user group or user account. Assign BlackBerry Dynamics apps or app groups to a user account or a user group. Assign the activation profile to a user account or user group. Instruct users to activate an Android device or activate an ios device on BlackBerry UEM. For users that want to activate BlackBerry Dynamics apps on Windows Phone devices, you must generate access key for the apps. 6

7 Log in to BlackBerry UEM for the first time Before you begin: Verify that you have the BlackBerry UEM SRP identifier and SRP authentication key available. If the setup application is still open, you can access the management console directly from the Console addresses dialog box. Note: You may be prompted to provide the IP address and port number of the BlackBerry Router or a TCP proxy server. Note: If you receive an error message that your SRP ID cannot be used with the BlackBerry UEM instance you installed, visit support.blackberry.com/kb to read article KB In the browser, type where <server_name> is the FQDN of the computer that hosts the management console. The default port for the management console is port In the Username field, type admin. 3. In the Password field, type password. 4. Click Sign in. 5. In the Server location drop-down selection, select the country of the computer that has BlackBerry UEM installed on it, and click Next. 6. Type the name of your organization, the SRP identifier, and the SRP authentication key. 7. Click Submit. 8. Change the temporary password to a permanent password. 9. Click Submit. After you finish: When you log in to the management console, you can choose to complete or close the Welcome to BlackBerry UEM dialog box. If you close the dialog box, it will not appear during subsequent login attempts. Synchronizing Good Control with BlackBerry UEM When you install or upgrade to BlackBerry UEM version 12.6 MR1 and later, BlackBerry UEM and Good Control can be synchronized to enable BlackBerry UEM features. The synchronization process creates backups of the BlackBerry UEM and Good Control databases. Synchronization is automatic for: A new installation of BlackBerry UEM An upgrade from BES12 with no integrated Good Control 7

8 An upgrade from a Good Control instance with no users An upgrade from a Good Control instance with one user in the same directory domain as the BlackBerry UEM directory domain If you are upgrading from Good Control with more than one user, or from a BES12 environment with an existing Good Control database that has more than one user, a Security Administrator must start the synchronization manually from the BlackBerry UEM management console. CAUTION: After you synchronize Good Control, you cannot roll back to the previous version. For more information about synchronization, see "About synchronization" in the Planning content. Considerations for synchronizing Good Control with BlackBerry UEM Review the following considerations before you synchronize Good Control with BlackBerry UEM: Item Devices Policies and profiles Considerations The same physical device managed by BlackBerry UEM and Good Control is synchronized into one BlackBerry UEM object. The following profiles and policies are synchronized from Good Control to BlackBerry UEM: BlackBerry Dynamics connectivity profiles: After the synchronization occurs, a Default BlackBerry Dynamics connectivity profile is created in BlackBerry UEM and any existing connectivity profiles are synchronized to BlackBerry UEM. BlackBerry Dynamics compliance profiles: After the synchronization occurs, existing compliance policies from BlackBerry Dynamics policy sets are imported from Good Control as individual BlackBerry Dynamics compliance profiles. You cannot edit these read-only BlackBerry Dynamics compliance profiles, but they can be used as a reference when you create new compliance profiles in BlackBerry UEM. The built-in BES12 compliance profiles are enhanced in BlackBerry UEM to include all of the Good Dynamics compliance policies. Note: The BlackBerry Dynamics compliance profile appears only in environments with a preexisting Good Control server. Security policies: After the synchronization occurs, existing security policies from BlackBerry Dynamics policy sets are imported from Good Control as individual BlackBerry Dynamics profiles. A default BlackBerry Dynamics profile is also created. Apps BlackBerry Dynamics app entitlements and assignments that were configured in Good Control are synchronized from Good Control to BlackBerry UEM. The synchronized apps are shown in 8

9 Item Considerations the BlackBerry UEM app list and the apps are assigned automatically to the same users in BlackBerry UEM. App entitlements for internal apps are synchronized, but internal app source files are not synchronized and must be re-added to BlackBerry UEM. Only BlackBerry Dynamics apps are synchronized. Non-BlackBerry Dynamics apps must be readded to BlackBerry UEM. App entitlements are determined at the app level instead of at the version level as they were in Good Control. After you synchronize, the following occurs: Users that were entitled to one version of an app are entitled to all versions of the app. Users denied one version of an app are denied all versions of an app. Users that were entitled to one version of an app but denied another version of the app are entitled to all versions of the app. After the synchronization of Good Control with BlackBerry UEM is complete, app groups that were configured in Good Control are recreated as user groups in BlackBerry UEM and app policies that were configured in Good Control are recreated as app configurations in BlackBerry UEM. After synchronization, app policies that were assigned to app groups in Good Control remain assigned to users as they were before the synchronization; however, when you view the recreated user groups in BlackBerry UEM, an incorrect app configuration is shown in the Assigned apps table for the user group. This is a known issue. To view the correct app configurations that are assigned to a user, click on the user summary page. The app configuration that is assigned to the app installed on the device is displayed in the apps table. Note: In order to retain the settings that you configured in Good Control, do not make changes to the user group. If you change the settings in the user group, you may make unintended changes to other users. For workaround instructions, visit articledetail?articlenumber= to read article KB Users Good Control users are added to BlackBerry UEM. BlackBerry UEM users are added to Good Control. Good Control users that are Microsoft Active Directory users become directory users in BlackBerry UEM. Good Control local users become BlackBerry UEM directory users if they can be found in the directory. Otherwise, they become BlackBerry UEM local users. 9

10 Item Considerations Good Control users can log in to BlackBerry UEM Self-Service with the same password that they used in Good Control. Administrators After synchronization, Good Control administrators are added to BlackBerry UEM and assigned a similar role as follows: Good Control "All permissions" and "Roles" permissions levels receive the BlackBerry UEM Security Admin role. Good Control "Server Configuration" and "Reporting and troubleshooting" permissions levels receive the BlackBerry UEM Enterprise Admin role. No higher-level permissions are assigned. Good Control "Applications, Shared Services, and Application Wrapping" and "App Groups" permissions levels receive the BlackBerry UEM Senior Helpdesk role. No higher-level permissions are assigned. Good Control "Users and devices," "Container/Device Management," and "Policy Sets" permissions levels receive the BlackBerry UEM Junior Helpdesk role. No higher-level permissions are assigned. Custom roles from Good Control are not synchronized. Administrators assigned to these roles in Good Control must be manually reassigned to new roles in BlackBerry UEM. Console After synchronization, the Good Control console is no longer available. You manage all Good Control devices and services using the BlackBerry UEM management console, for example: Settings: Settings > BlackBerry Dynamics Status and diagnostics: Settings > Infrastructure > BlackBerry Control Policies: Policies and profiles > BlackBerry Dynamics Policies and profiles > Connectivity (BlackBerry Dynamics) Apps: Apps Prerequisites: Synchronize Good Control with BlackBerry UEM CAUTION: Do not initiate synchronization until all BlackBerry UEM, BES12, Good Control, and Good Proxy servers in your environment are upgraded to the same version of BlackBerry UEM. Synchronization in a mixed-version environment is not supported. Confirm that all Good Control servers are connected to the BlackBerry Infrastructure. If you are upgrading to BlackBerry UEM version 12.6 MR1 or later from BlackBerry UEM version 12.6 or BES12: BlackBerry UEM must be connected to a Good Control server. 10

11 The Good Dynamics serial number and license key must be a production license type, not a development license type. You must configure a company directory connection to a Microsoft Active Directory instance in UEM. If there was an existing Good Control environment, the company directory in UEM must also be configured to the same Active Directory forest as the Good Control server. If the Active Directory in Good Control is configured to use multiple directories, each company directory must also be defined in BlackBerry UEM. To receive the confirmation , the administrator account used to initiate the synchronization must have an address configured in BlackBerry UEM. If offboarding is enabled, ensure that all Good Dynamics users are added to an onboarding group. Alternatively, disable offboarding. Note: As part of the synchronization process, BlackBerry UEM performs a backup of the UEM and Good Control databases using the information you specified during the installation process. After the backups are complete, BlackBerry UEM validates them by executing RESTORE VERIFYONLY, which requires the CREATE DATABASE permission. To process this validation, the service account or Microsoft SQL Server account must have permissions on the database server. You must verify that the service account or Microsoft SQL Server account is a member of the dbcreator server role or has the CREATE DATABASE permission. Synchronize Good Control with BlackBerry UEM After the synchronization is complete, all management tasks are performed using the BlackBerry UEM management console. 1. On the menu bar, click Settings > Infrastructure > BlackBerry Control. 2. Click Start synchronization. 3. In the confirmation dialog box, type blackberry. The progress bars display the progress of the synchronization process for policies, users, devices, connection profiles, apps, app policies, user assigned apps, app groups, user certificates, and administrators. 4. If errors occur, resolve the issue displayed in the management console, then click Restart synchronization to retry the synchronization. After the synchronization is complete, BlackBerry UEM sends an to the administrator that states whether the synchronization was successful or not. Note: The is sent only for a manually initiated synchronization. After you finish: For more information about synchronization, refer to the following KB articles at For app groups and policy sets, KB article For synchronization errors, KB article For synchronization warnings, KB article

12 For information about configuring BlackBerry Control and BlackBerry Proxy, see Configuring BlackBerry Control and BlackBerry Proxy. For information about managing Good Control users and devices using the BlackBerry UEM management console, see the Administration content. Configuring BlackBerry UEM for the first time The following table list some of the configuration tasks you may want to perform in BlackBerry UEM. All of these tasks are optional and are based on your organization's needs. For a complete list of configuration tasks,see the Configuration content. Task Connect BlackBerry UEM to company directories Connect BlackBerry UEM to an SMTP server Obtain and register an APNs certificate Control which devices can access Exchange ActiveSync Set up BlackBerry UEM Self- Service Synchronize Good Control with BlackBerry UEM Configure BlackBerry Control and BlackBerry Proxy Required or Optional Optional Optional Optional Optional Optional Optional Optional Description You can connect BlackBerry UEM to one or more company directories, such as Microsoft Active Directory or an LDAP directory, so that BlackBerry UEM can access user data to create user accounts. If you want BlackBerry UEM to send activation s and other notifications to users, you must specify the SMTP server settings that BlackBerry UEM can use. If you want to manage and send data to ios or OS X devices, you must obtain a signed CSR from BlackBerry, use it to obtain an APNs certificate from Apple, and register the APNs certificate with the BlackBerry UEM domain. If you configured Microsoft Exchange to block devices from accessing work and organizer data unless the devices are added to an allowed list, you must create a Microsoft Exchange configuration in BlackBerry UEM. If you want to allow users to perform certain management tasks such as changing their passwords, you can set up and distribute the BlackBerry UEM Self-Service web application. After you install BlackBerry UEM version 12.6 in an environment that has an existing BlackBerry Control server, you must synchronize the BlackBerry Control database with the BlackBerry UEM database to enable BlackBerry UEM version 12.6 features. You can configure BlackBerry Control and BlackBerry Proxy to meet your organization s standards and requirements. 12

13 Configuring BlackBerry Dynamics profiles Profile BlackBerry Dynamics BlackBerry Dynamics connectivity profile Description A BlackBerry Dynamics profile allows devices to access BlackBerry Dynamics apps, such as BlackBerry Work, BlackBerry Access, and BlackBerry Connect. A BlackBerry Dynamics connectivity profile defines the network connections, Internet domains, IP address ranges, and app servers that devices can connect to when using BlackBerry Dynamics apps. Create a BlackBerry Dynamics connectivity profile BlackBerry Dynamics connectivity profiles define the network connections, Internet domains, IP address ranges, and app servers that devices can connect to when using BlackBerry Dynamics apps. BlackBerry UEM includes a Default BlackBerry Dynamics connectivity profile with preconfigured settings. If no BlackBerry Dynamics connectivity profile is assigned to a user account or a user group that a user belongs to, BlackBerry UEM sends the Default BlackBerry Dynamics connectivity profile to a user's devices. BlackBerry UEM automatically sends a BlackBerry Dynamics connectivity profile to a device when a user activates it, when you update an assigned BlackBerry Dynamics connectivity profile, or when a different BlackBerry Dynamics connectivity profile is assigned to a user account or device. Note: For organizations with an existing BlackBerry Dynamics environment, connectivity profiles that were configured in Good Control are synchronized from Good Control to BlackBerry UEM when you perform the synchronization between Good Control and BlackBerry UEM. The connectivity profiles will be assigned automatically to the same users in BlackBerry UEM. For more information about synchronizing Good Control with BlackBerry UEM, see Getting Started with BlackBerry UEM and BlackBerry Dynamics. Note: For organizations with an existing BlackBerry Dynamics environment, be aware that a master connection profile no longer exists and changes to the Default connectivity profile are not inherited by other connectivity profiles. 1. On the menu bar, click Policies and Profiles. 2. Click beside Connectivity (BlackBerry Dynamics). 3. Type a name and description for the profile. 4. Configure the appropriate values for the profile settings. For more information about each profile setting, see BlackBerry Dynamics connectivity profile settings. 5. To add an app server for a BlackBerry Dynamics app, see Add an app server to a BlackBerry Dynamics connectivity profile. 6. Click Add. After you finish: If necessary, rank profiles. 13

14 BlackBerry Dynamics connectivity profile settings Infrastructure setting Route all traffic Domain Primary and Secondary BlackBerry Proxy Clusters Description When selected, all BlackBerry Dynamics app data is routed through the BlackBerry Proxy. Specify the Internet domains that you want to allow access to, in the form *.domain. For example, *.blackberry.com allows access to any server in the blackberry.com domain. BlackBerry Dynamics apps are allowed to connect through your organization's firewall to any server in the domains listed in this table. This includes servers in the subdomains of these domains. Specify the fully qualified domain name, port and priority of the BlackBerry Proxy clusters that must be used to reach the domain. Default domains Domain Specify the default allowed domains in the form +.domain (for example, +.qa.blackberry.com). BlackBerry Dynamics apps may try to connect to an unqualified hostname like "portal" instead of using a fully qualified name like "portal.sales.xyzcorp.com". The domains in this list will be appended to unqualified hostnames to construct fully qualified names. Additional servers Server Specify the fully qualified domain name of any additional servers that BlackBerry Dynamics apps can connect to. Add servers to this list instead of using the "Allowed Domains" list if you want BlackBerry Dynamics apps to connect only to certain servers and not to every server in a domain. IP address ranges Range Specify a range of IP addresses that BlackBerry Dynamics apps can access. Address ranges must be entered with a lower and upper bound address (for example, ) or in IPv4 CIDR notation (for example, /24). For example: Discrete addresses: start, end Example: , An entire subnet: //subnet/24 Example: // /24 14

15 Add an app server to a BlackBerry Dynamics connectivity profile If you have a BlackBerry Dynamics app that is served from an app server or web server, you can specify the name of that server and the priority of the BlackBerry Proxy clusters used for communication with it. 1. On the menu bar, click Policies and Profiles. 2. Click the BlackBerry Dynamics connectivity profile that you want to add an app server to. 3. Click. 4. Under App servers, click Add. 5. Select the BlackBerry Dynamics app that you want to add an app server for. 6. Click Save. 7. In the table for the app, click. 8. In the Server field, specify the FQDN of the app server. 9. In the Port field, specify the port of the BlackBerry Proxy cluster that is used to access the server. 10. In the Priority drop-down list, specify the priority of the BlackBerry Proxy cluster that must be used to reach the domain. 11. In the Primary BlackBerry Proxy cluster drop-down list, specify the name of the BlackBerry Proxy cluster that you want to set as the primary cluster. 12. In the Secondary BlackBerry Proxy cluster drop-down list, specify the name of the BlackBerry Proxy cluster that you want to set as the secondary cluster. 13. Click Save. Rank profiles Ranking is used to determine which profile BlackBerry UEM sends to a device in the following scenarios: A user is a member of multiple user groups that have different profiles of the same type. A device is a member of multiple device groups that have different profiles of the same type. 1. On the menu bar, click Policies and profiles. 2. Expand a profile type. 3. Click Rank <profile_type> profiles. 4. Use the arrows to move profiles up or down the ranking. 5. Click Save. 15

16 Create a BlackBerry Dynamics profile The BlackBerry Dynamics profile enables BlackBerry Dynamics for users and allows devices to use BlackBerry Dynamics apps, such as BlackBerry Work, BlackBerry Access, and BlackBerry Connect. BlackBerry UEM includes a Default BlackBerry Dynamics profile with preconfigured settings. If no BlackBerry Dynamics profile is assigned to a user account, a user group that a user belongs to, or a device group that a user's devices belong to, BlackBerry UEM sends the Default BlackBerry Dynamics profile to a user's devices. BlackBerry UEM automatically sends a BlackBerry Dynamics profile to a device when a user activates it, when you update an assigned BlackBerry Dynamics profile, or when a different BlackBerry Dynamics profile is assigned to a user account or device. You can assign the BlackBerry Dynamics profile to user accounts, user groups, or device groups. Note: If you have upgraded from BES12 version 12.4 or 12.5, have an existing BlackBerry Dynamics environment, and have not synchronized this environment with BlackBerry UEM, the BlackBerry Dynamics profile will contain only the settings available in BES12 version 12.4 or You must synchronize Good Control with BlackBerry UEM to see the updated profile. For more information about synchronizing Good Control with BlackBerry UEM, see Getting Started with BlackBerry UEM and BlackBerry Dynamics. 1. In the BlackBerry UEM management console, on the menu bar, click Policies and Profiles. 2. Click beside BlackBerrry Dynamics. 3. Type a name and description for the profile. 4. Click the tab for each device type in your organization and configure the appropriate values for each profile setting. 5. Select Enable UEM Client to enroll in BlackBerry Dynamics to allow the BlackBerry UEM Client to manage the activation of BlackBerry Dynamics so users do not have to use access keys to activate their BlackBerry Dynamics apps. 6. For more information about each profile setting, see BlackBerry Dynamics profile settings. 7. Click Add. BlackBerry Dynamics profile settings BlackBerry Dynamics profile setting Description Configuration Enable UEM Client to enrol BlackBerry Dynamics Require device management to use BlackBerry Dynamics apps When this setting is selected, the BlackBerry UEM Client manages the activation of BlackBerry Dynamics apps. Users do not have to use access keys to activate them. If you do not plan to use BlackBerry Dynamics in your environment, do not select this option. This setting specifies whether a device must be activated with MDM to use BlackBerry Dynamics apps. 16

17 BlackBerry Dynamics profile setting Description Password Password expiration Do not allow previous passwords Minimum password length Allowed occurrences of a character Require both letters and numbers Require both uppercase and lowercase Require at least one special character Do not allow sequences of more than two numbers Do not allow more than one password change per day Do not allow personal information This setting specifies whether the password for a BlackBerry Dynamics app expires and how long a password remains valid before it expires. This setting specifies whether previous passwords can be used and the maximum number of previous passwords that cannot be used for a BlackBerry Dynamics app. This setting specifies the minimum length of the password for a BlackBerry Dynamics app. This setting specifies how many times a character can appear in a password for a BlackBerry Dynamics app. This setting specifies whether the password must contain both letters and numbers for a BlackBerry Dynamics app. This setting specifies whether the password must contain both uppercase and lowercase letters for a BlackBerry Dynamics app. This setting specifies whether the password must contain at least one special character for a BlackBerry Dynamics app. This setting specifies whether the password can contain more than two sequential numbers (for example,1, 2, 3) for a BlackBerry Dynamics app. This setting specifies whether a password can be changed more than once every 24 hours for a BlackBerry Dynamics app. This setting specifies whether the following personal information can be used in a password for a BlackBerry Dynamics app: The user's first and last names (excluding initials) as recorded in Active Directory. The part of an address before sign. Allow Touch ID This setting specifies whether fblackberry Dynamics apps can be started using Touch ID when they are already open in the app switcher on ios devices. Lock screen Require password when BlackBerry Dynamics apps start This setting specifies whether a password is required each time a BlackBerry Dynamics app is started. Note: If you are using authentication delegation, do not select this option. 17

18 BlackBerry Dynamics profile setting Require password after period of inactivity Take action after invalid password attempts Description This setting specifies the period of inactivity that must elapse before a password is required. This setting specifies whether there is a limit to the number of times that a user can enter an incorrect password. If you select this rule, specify the number of times that a user can enter an incorrect password and the action that occurs after the limit has been reached. Choose one of the following actions: Lock out user Wipe Data Wearables Allow wearables This setting specifies whether BlackBerry Dynamics apps can be used on a wearable device. If you select this rule, specify the how much time must elapse before the wearable device is disconnected and whether the wearable can reconnect automatically. App authentication delegation You can select up to three apps to act as the authentication delegate on behalf of other apps so that users do not have to create a password for each BlackBerry Dynamics app that they install. After an authentication delegate is configured, each time a user opens a BlackBerry Dynamics app, the device displays the password screen for the authentication delegate instead of the app that they are attempting to open. After the user enters the password for the authentication delegate, the user can open the BlackBerry Dynamics app. You can choose any app to be the authentication delegate for other apps, but it is recommended that you choose your most commonly used app to be the primary authentication delegate to provide the most seamless experience for the user. Data leakage prevention Do not allow copying data from non BlackBerry Dynamics apps into BlackBerry Dynamics apps Do not allow copying data from BlackBerry Dynamics apps into non BlackBerry Dynamics apps Do not allow Android dictation This setting specifies whether users can copy data from non BlackBerry Dynamics apps to BlackBerry Dynamics apps. This setting specifies whether users can copy data from BlackBerry Dynamics apps to non BlackBerry Dynamics apps. This setting specifies whether Android device users can use voice dictation with BlackBerry Dynamics apps. 18

19 BlackBerry Dynamics profile setting Do not allow screen captures on Android devices Do not allow ios dictation Do not allow custom keyboards Enable FIPS Description This setting specifies whether Android device users can take screen captures in BlackBerry Dynamics apps. This setting specifies whether ios device users can use voice dictation with BlackBerry Dynamics apps. This setting specifies whether ios device users can use custom keyboards with BlackBerry Dynamics apps. This setting specifies whether compliance with U.S. Federal Information Processing standard is enforced. Certificates Enable device certificate store Allow user PKCS12 certificate management This setting specifies whether BlackBerry Dynamics apps can get certificates from the device certificate store. This setting specifies whether PKCS12 certificates can be used to log in to BlackBerry Dynamics apps. Agreement Enable an agreement message for BlackBerry Dynamics apps This setting specifies whether to display a message in BlackBerry Dynamics apps that the user must acknowledge. If authentication delegation is enabled, the message is displayed only in the authenticator app. If you select this rule, complete the following actions: Specify if the message is displayed each time the app is unlocked, otherwise the message is only displayed the first time the user opens the app. In the Message field, create the message that you want to display. Managing BlackBerry Dynamics compliance profiles BlackBerry Dynamics compliance profiles are imported from Good Control when you synchronize Good Control with BlackBerry UEM. You cannot edit BlackBerry Dynamics compliance profiles, but they can be used as a reference when you are creating new compliance profiles in BlackBerry UEM. Users that were assigned to a compliance profile in Good Control remain assigned to the same profile after they are synchronized with BlackBerry UEM. When a user is assigned to a BlackBerry Dynamics compliance profile, the BlackBerry Dynamics compliance profile takes precedence over any BlackBerry Dynamics rules in the BlackBerry UEM compliance profiles that a user may also be assigned to. For information on how to create compliance profiles in BlackBerry UEM, see Create a compliance profile. 19

20 Setting Jailbroken OS OS version verification Hardware model verification BlackBerry Dynamics library version verification Connectivity verification Description This setting specifies the actions that occur if a user or attacker bypasses various restrictions on a device to modify the OS, installs unapproved apps, or obtains elevated permissions and the actions that occur for BlackBerry Dynamics apps if a jailbroken OS is used. This setting specifies the versions of the OS that are allowed and restricted and the actions that occur for BlackBerry Dynamics apps if a restricted OS is installed on a device. This setting specifies the hardware models that are allowed and restricted and the actions that occur for BlackBerry Dynamics apps if a restricted hardware model is being used. This setting specifies the BlackBerry Dynamics libraries that can be used and the actions that occur for BlackBerry Dynamics apps if a device is using a disallowed version of the library. This setting specifies whether a device must connect to BlackBerry UEM within a specified number of days and the actions that occur for BlackBerry Dynamics apps if a device does not connect to BlackBerry UEM. The "Base connectivity interval on auth delegate app" subsetting specifies whether the app that is set as the authentication delegate manages the connectivity interval. If you use the authentication delegate to manage the connectivity interval, less frequently used apps will not be blocked or wiped if they do not connect to. BlackBerry UEM. Managing BlackBerry Dynamics apps You can create a library of BlackBerry Dynamics apps that you want to manage and monitor on ios, Android, and Windows Phone devices. To manage apps, you can add the apps to the app list and assign them to user accounts, user groups, or device groups. Adding BlackBerry Dynamics apps to the app list You can add public BlackBerry Dynamics apps from the BlackBerry Marketplace for Enterprise Apps and custom internal BlackBerry Dynamics apps. After the apps have been added to the app list, you can assign them to users. Note: For organizations with an existing BlackBerry Dynamics environment, BlackBerry Dynamics app entitlements and assignments that were configured in Good Control are synchronized from Good Control to BlackBerry UEM when you perform 20

21 the one-time synchronization between Good Control and BlackBerry UEM. The synchronized apps will be shown in the BlackBerry UEM app list and the apps will be assigned automatically to the same users in BlackBerry UEM. For more information about synchronizing Good Control with BlackBerry UEM, see see the Configuration content. Add public BlackBerry Dynamics apps to the app list To add public BlackBerry Dynamics apps to the app list in BlackBerry UEM, your organization must be entitled to use apps in the BlackBerry Marketplace for Enterprise Apps. The BlackBerry Marketplace for Enterprise Apps contains a catalog of BlackBerry Dynamics apps. After your organization is entitled to use the app, you can update the app list to synchronize the apps with BlackBerry UEM right away or wait until BlackBerry UEM synchronizes automatically. BlackBerry UEM synchronizes BlackBerry Dynamics apps every 24 hours.. 1. Log in to your account at 2. Locate the app in the BlackBerry Marketplace for Enterprise Apps and request a trial. The app will be made available to your organization and can be assigned to users after the app has been synchronized to BlackBerry UEM. 3. To purchase the app, follow the instructions provided by the app developer. After you finish: Update the app list to synchronize apps to BlackBerry UEM. View public BlackBerry Dynamics app entitlements 1. Log in to 2. Expand Entitlements. Update the app list You can update the app list to make sure that you have the latest information about BlackBerry 10, ios, Windows 10, and BlackBerry Dynamics apps in the apps list. If you have an Android for Work configuration, you can also update app information for Android apps. If you added Android apps before you configured Android for Work or app permissions have changed, you must update the app information to make them available on Android for Work devices. This also applies if you make any changes to your Android for Work connection. If you do not have an Android for Work connection or Windows Phone apps, information about Google Play apps must be updated manually. Updating the app information does not mean that the app is updated on a user s device. Users receive update notifications for their work apps in the same way that they receive update notifications for their personal apps. If you configured your Apple VPP account to automatically update the app information for ios apps, you must update the apps in the app list. 1. On the menu bar, click Apps. 2. Click. 21

22 Adding internal BlackBerry Dynamics apps An internal app is a custom app that was developed for your organization. You can add internal ios, Android, or Windows Phone 8.1 apps. Internal Windows 10 apps are not supported. When you add internal BlackBerry Dynamics apps, you perform the following actions: Step Action Specify the shared network location for storing internal apps Upload an application enrollment token for Windows Phone devices Add an internal BlackBerry Dynamics app entitlement Upload BlackBerry Dynamics app source files Specify the shared network location for storing internal apps Before you add internal apps to the available app list, you must specify a shared network location to store the app source files. To make sure that internal apps remain available, this network location should have a high availability solution and be backed up regularly. Also, do not create the shared network folder in the BlackBerry UEM installation folder because it will be deleted if you upgrade BlackBerry UEM. Before you begin: Create a shared network folder to store the source files for internal apps on the network that hosts BlackBerry UEM. Verify that the service account for the computer that hosts BlackBerry UEM has read and write access to the shared network folder. 1. On the menu bar, click Settings. 2. In the left pane, expand App management. 3. Click Internal app storage. 4. In Network location field, type the path of the shared network folder using the following format: \\<computer_name>\<shared_network_folder> The shared network path must be typed in UNC format (for example, \\ComputerName\Applications\InternalApps). 5. Click Save. 22

23 Upload an application enrollment token for Windows Phone devices An AET must be uploaded before users can install internal apps on Windows Phone devices. The apps that you want users to install must share a certificate with the AET that you have uploaded. For more information about how to generate an application enrollment token, visit msdn.microsoft.com to read How to generate an application enrollment token for Windows Phone. You also require an AET if you want to monitor internal or public Windows apps in compliance profiles. 1. On the menu bar, click Settings. 2. In the left pane, expand App management. 3. Click Windows Phone apps. 4. Click Browse and navigate to the AET that you want to upload. 5. Click Save. Add an internal BlackBerry Dynamics app entitlement To add an internal BlackBerry Dynamics app, you must add an entitlement for it. After the entitlement has been added, you can upload the app source files. Before you begin: Specify the shared network location for storing internal apps. If you are adding Windows Phone apps, upload an AET. 1. On the menu bar, click Apps. 2. Click. 3. Click Internal BlackBerry Dynamics app entitlements. 4. In the Name field, type the name of the app that you want to add. 5. In the BlackBerry Dynamics entitlement ID field, enter the entitlement ID of the app that you want to add. If you do not know the entitlement ID for the app, contact the app developer. The entitlement ID must be in the following format: Reverse domain name form, for example, com.yourcompany.appname. Cannot begin with any of the following com.blackberry com.good com.rim net.rim Cannot contain uppercase letters Must conform to the <subdomain> format defined in section of RFC 1035, as amended by Section 2.1 of RFC

24 6. In the BlackBerry Dynamics entitlement version field, enter the entitlement version. If you do not know they entitlement version for the app, contact the app developer. The entitlement version must be in the following format: From one to four segments of digits, separated by periods, for example, 100 or No leading zeroes in the numeric segments. For example, you cannot use 0100 or The length of the numeric segments can be from one to three characters, for example, Optionally, add an app description. 8. Click Add. After you finish: Upload BlackBerry Dynamics app source files Upload BlackBerry Dynamics app source files After a BlackBerry Dynamics app entitlement has been created, you can upload the source files for the applicable device platforms. Before you begin: Add an internal BlackBerry Dynamics app entitlement 1. On the menu bar, click Apps. 2. Click the app that you want to upload source files for. 3. Click the tab for the device platform that you want to upload a source file for. 4. In the App source file section, click Add. 5. Click Browse. Navigate to the app that you want to add or update. 6. Click Add. 7. If necessary, perform the following tasks: Manage BlackBerry Dynamics app settings for ios devices Manage BlackBerry Dynamics app settings for Android devices Manage settings for a BlackBerry Dynamics app You can manage app configurations, server configurations, and app settings. 1. On the menu bar, click Apps. 2. Click the BlackBerry Dynamics app that you want to change. 3. On the Settings > BlackBerry Dynamics tab, perform any of the following tasks: 24

25 Task Steps Specify a BlackBerry Dynamics profile for the app. If you want the app to use a specific BlackBerry Dynamics profile instead of the BlackBerry Dynamics profile that is assigned to the user, select the profile from the Override BlackBerry Dynamics profile drop-down list. Specify a compliance profile for the app. Add or change the app configuration for an internal app. If you want the app to use a specific compliance profile rather than the compliance profile that is assigned to the user, select the profile from the Override compliance profile profile drop-down list. 1. Beside App configuration, click Upload a template to add a new app configuration template. 2. Browse to the location of the template. 3. Click Save. Add or change the app configuration for a public app 1. In the App configuration table, click. 2. Type a name for the app configuration. 3. Edit the configuration settings. 4. Click Save. 5. If required, use the arrows to move the app configuration up or down to change the priority. Add or change the server configuration payload to specify the keys and values used to configure settings for the app. If the app has custom app policies, the custom policies are added to the Server configuration payload area. 1. In the Server configuration payload section, click Add. 2. In the text box, enter the XML or JSON code for the configuration payload. Allow the app to use user certificates Select whether the app can use user certificates as an authentication option. For more information about configuring your environment to support user certificates, see Connect BlackBerry UEM to your organization s BlackBerry Dynamics PKI Connector.. 4. Click the tab for the device platform that you want to manage and perform the following tasks: Manage BlackBerry Dynamics app settings for ios devices Manage BlackBerry Dynamics app settings for Android devices 5. Click Save. 25

26 Manage BlackBerry Dynamics app settings for ios devices After you have added a BlackBerry Dynamics app for ios to BlackBerry UEM, you can manage settings for the app such as, adding screenshots or selecting the form factors that the app can be installed on. Before you begin: Add public BlackBerry Dynamics apps to the app list or add an internal BlackBerry Dynamics app entitlement 1. On the menu bar, click Apps. 2. Click the BlackBerry Dynamics app with the settings that you want to change. 3. Click the ios tab. 4. If required, edit the app name, vendor, or description. 5. To filter apps in the app list by category and to organize the apps into categories in the work apps list on users' devices, you can select a category for the app. In the Category drop-down list, do one of the following: Option Description Select a category for the app 1. In the drop-down list, select a category. Create a category for the app 1. Type a name for the category. The "new category" will appear in the drop-down list with the new category label beside it. 2. Press Enter. 3. Press Enter. 6. To add screen shots of the app, click Add and browse to the screen shots. The supported image types are.jpg,.jpeg,.png, or.gif. 7. In the Supported device form factor drop-down list, select the form factors that the app can be installed on. For example, you can prevent the app from being available in the Work Apps app on ipad devices. 8. For ios apps, if you want the app to be deleted from the device when the device is removed from BlackBerry UEM, select Remove the app from the device when the device is removed from BlackBerry UEM. This option applies only to apps with a disposition marked as required and the default installation for required apps is set to prompt once. 9. If you want to prevent apps on ios devices from being backed up to the icloud online service, select Disable icloud backup for the app. This option applies only to apps with a disposition marked as required. You set the disposition of the app when you assign the app to a user or group. 10. In the Default installation for required apps drop-down list, perform one of the following actions: If you want users to receive one prompt to install the app on their ios devices, select Prompt once. If users dismiss the prompt, they can install the app later using the Work Apps screen in the BlackBerry UEM Client app or the Work Apps icon on the device. If you don't want users to receive a prompt, select No prompt. 26

27 The default installation method applies only to apps with a disposition marked as required. You set the disposition of the app when you assign the app to a user or group. 11. In the Convert installed personal app to work app drop-down list, select one of the following: To convert the app to a work app if it is already installed on ios 9 or later devices, select Convert to convert the app. After you assign the app to a user, the app is converted to a work app and can be managed by BlackBerry UEM. If you don't want to convert the app to a work app if it is already installed on ios 9 or later devices, select Do not convert. After you assign the app to a user, the app cannot be managed by BlackBerry UEM. 12. In the Restricted versions field, add any versions of the app that you want to prevent users from installing on their devices. If you add multiple versions, separate each version with a comma. 13. Click Save. Manage BlackBerry Dynamics app settings for Android devices After you have added a BlackBerry Dynamics app for Android devices to BlackBerry UEM, you can manage settings for the app, such as adding screenshots or categories. Before you begin: Add public BlackBerry Dynamics apps to the app list or add an internal BlackBerry Dynamics app entitlement 1. On the menu bar, click Apps. 2. Click the BlackBerry Dynamics app with the settings that you want to change. 3. Click the Android tab. 4. If required, edit the app name, vendor, or description. 5. To filter apps in the app list by category and to organize the apps into categories in the work apps list on users' devices, you can select a category for the app. In the Category drop-down list, do one of the following: Option Description Select a category for the app 1. In the drop-down list, select a category. Create a category for the app 1. Type a name for the category. The "new category" will appear in the drop-down list with the new category label beside it. 2. Press Enter. 3. Press Enter. 6. To add screen shots of the app, click Add and browse to the screen shots. The supported image types are.jpg,.jpeg,.png, or.gif. 27